Changelog

™

Download

Debian morph to Kicksecure (Hardware) Windows (VM) Linux (VM) Mac (VM) VirtualBox (VM) KVM (VM) Qubes (VM) USB ISO (coming soon) More options Source Code

About

Overview Features Why Open Source? Project Activities Contributors Mission & Vision

Docs

Documentation FAQ Troubleshooting

Community

Forums Contribute

Support

Free Plus Premium Contact

Tools Upload file Special pages Recent changes Print Version Page meta What links here Related changes Page information

Page Read Edit History Move Protection Unwatch Watch Delete Purge

User Preferences Watchlist Contributions Logout Create account Login

Donate

Kicksecure Release Notes, Changelog

17.0.4.5

anon-apt-sources-list:

• Remove duplication of debian bookworm onion (Thanks to TNT BOM BOM!)

anon-connection-wizard:

• fix paths
• notes
• snowflake
• remove unknown country specifics
• snowflake
• snowflake
• update default bridges as per Tor Browser 13.0a2

bootclockrandomization:

• tmpfiles.d improvement
• tmpfiles.d syntax fix

desktop-config-dist:

• fix, update sudoers for livecheck
• Fix Live Check systray fix `livecheck.sh` drop `--all` from `lsblk` options https://forums.kicksecure.com/t/livecheck-sh-script-broken-on-bookworm/269/13
• move `/etc/zprofile.d` parsing from `/etc/zshrc` to `/etc/zprofile` to avoid these scripts being parsed in terminal emulators running in X11 https://forums.whonix.org/t/change-default-shell-from-bash-to-zsh-by-default/14792/147
• chmod +x /etc/zsh/zprofile.dist
• ship `/etc/zsh/zprofile`
• Add zsh profile dir (Thanks to nyxnor!)
• Fix zsh deleting spaces after specific chars (Thanks to nyxnor!)

developer-meta-files:

• tmpfiles.d improvement
• tmpfiles.d syntax fix
• add symlinks from /etc/profile.d to /etc/zprofile.d

dist-base-files:

• --gecos -> --comment
• fix, do not attempt to set the default shell to /usr/bin/zsh if it already is
• enable zsh by default for existing and new builds
• re-enable zsh by default in new Qubes Templates builds

grub-live:

• drop dependency on `initramfs-tools` because `live-tools` already `Depends:` on it
• drop dependency on `live-boot-initramfs-tools` because `live-boot` already `Depends:` on it

helper-scripts:

• tmpfiles.d improvement
• tmpfiles.d syntax fix

kicksecure-base-files:

• add symlinks from /etc/profile.d to /etc/zprofile.d

kicksecure-meta-packages:

• drop dependency on busybox since no longer needed since Kicksecure was ported to dracut https://forums.whonix.org/t/note-installing-waydroid-will-remove-busybox-which-is-a-dep-to-kicksecure-dependencies-cli/16910
• fix, install `tirdad` by default on Kicksecure Hosts

kicksecure-welcome-page:

• add symlinks from /etc/profile.d to /etc/zprofile.d
• remove peekier search engine

legacy-dist:

• avoid zsh new user module for upgraded builds https://github.com/QubesOS/qubes-issues/issues/8343

msgcollector:

• add symlinks from /etc/profile.d to /etc/zprofile.d

open-link-confirmation:

• add symlinks from /etc/profile.d to /etc/zprofile.d
• Do not show an error popup if application (such as browser) exits non-zero For example if Tor Browser or Firefox gets killed, the exit code should be handled by the calling application as per usual.
• add error handler

rads:

• tmpfiles.d improvement
• tmpfiles.d syntax fix

ram-wipe:

• tmpfiles.d improvement
• tmpfiles.d syntax fix

sandbox-app-launcher:

• --gecos -> --comment

sdwdate:

• tmpfiles.d syntax fix

sdwdate-gui:

• tmpfiles.d improvement
• tmpfiles.d syntax fix
• improve error handling in case of sudo hardening

setup-dist:

• add symlinks from /etc/profile.d to /etc/zprofile.d
• remove symlink
• Use distinctive zsh extension (Thanks to nyxnor!)
• Add setup to zsh profile dir (Thanks to nyxnor!)

setup-wizard-dist:

• allow exiting application using ctrl + c (signal sigint) for easier debugging
• remove duplicate import
• fix centering the window at first boot
• reduce window hight
• better error handling in case of sudo issues
• better error handling in case of sudo issues

systemcheck:

• use `tee` instead of bash redirection for better error handling
• sanity test
• run `apparmor-info` with `--boot` to avoid showing already fixed apparmor issues from previous boots
• /var/lib/canary permission check
• /var/lib/canary permission check
• tmpfiles.d improvement
• tmpfiles syntax fix
• improve Qubes UpdatesProxy checks
• improve Qubes UpdatesProxy checks
• Qubes-Whonix: hint if "provides network" box might be unchecked

tb-default-browser:

• add symlinks from /etc/profile.d to /etc/zprofile.d

tb-starter:

• improve error handling in case using open-link-confirmation

tb-updater:

• tbb_hardcoded_version="12.5.3"
• alpha tbb_hardcoded_version="13.0a3"
• upstream link changes for Tor Browser alpha fix part 2/2 Thanks for @pgerber for the report and helping with this! https://github.com/Kicksecure/tb-updater/pull/22
• deprecate TB_LANG since no longer required
• remove `--language` because no longer needed since all Tor Browser downloads support all languages for a while now
• upstream link changes for Tor Browser alpha fix part 1/2 Thanks for @pgerber for the report and helping with this! https://github.com/Kicksecure/tb-updater/pull/22
• comments to prepare for upstream link changes https://github.com/Kicksecure/tb-updater/pull/22
• alpha tbb_hardcoded_version="13.0a2"
• skip connectivity test for arm64 due to unreported sourceforge blocking Tor issue https://github.com/Kicksecure/tb-updater/issues/21
• alpha tbb_hardcoded_version="13.0a1"
• tbb_hardcoded_version="12.5.2"
• update Tor Browser arm64 maintainer signing key

tirdad:

• Minor edits (Thanks to Sirus Shahini!)
• Add support for IPv6 (Thanks to Sirus Shahini!)
• Fix typos. (Thanks to Sirus Shahini!)

tor-control-panel:

• fix paths
• enable Whonix-Gateway system DNS for meek-azure and snowflake https://forums.whonix.org/t/censorship-circumvention-tor-pluggable-transports/2601/9
• import edit_etc_resolv_conf
• snowflake
• remove unknown country specifics
• move bridges_default file to anon-connection-wizard and depend on it to reduce code duplication

usability-misc:

• tmpfiles.d syntax fix
• improve detection of Debian testing based distributions
• dist-installer-cli Debian testing ("trixie") support
• dist-installer-cli Debian unstable ("sid") support
• dist-installer-cli Debian unstable ("sid") support
• improve Debian testing / unstable detection
• user adduser instead of usermod on Debian
• dist-installer-cli Debian unstable ("sid") support
• dist-installer-cli Debian unstable ("sid") support
• dist-installer-cli Debian unstable ("sid") support
• dist-installer-cli Debian unstable ("sid") support
• dist-installer-cli Debian unstable ("sid") support
• dist-installer-cli Debian unstable ("sid") support
• dist-installer-cli Debian unstable ("sid") support
• dist-installer-cli Debian trixie support
• try to start VMs before trying to start VirtualBox Manager because if it fails, it is less confusing to avoid starting VirtualBox Manager
• fix, don't notify that VirtualBox has been started into the background when using --dry-run
• fix, start both, VirtualBox Manager and VMs
• fix duplicate starts of VirtualBox Manager; new installer success message at the end
• fix launching VirtualBox Manager into the background instead of foreground to free the terminal
• view VirtualBox dkmks make.log on Debian if installation of VirtualBox failed
• if using `--dev` and if enabling Kicksecure repository, use Kicksecure developers repository instead of Kicksecure stable repository
• towards support for different codename for Kicksecure repository
• package lsb-release needed for also for VirtualBox Installer
• fix mirror range_arg check
• no longer use mirror by default
• mirror number change
• remove broken mirrors
• remove broken mirror
• --gecos -> --comment
• Maintain test consistency (Thanks to grass!)
• Fix zsh completion oracle-repo (Thanks to grass!)
• renamed: usr/share/zsh/vendor-completions/_dist-installer -> usr/share/zsh/vendor-completions/_dist-installer-cli
• dist-installer -> dist-installer-cli
• dnf
• dnf
• dnf
• dnf
• dnf
• dnf
• fix dnf search VirtualBox search string
• dnf search --cacheonly to avoid extraneous network connection
• add workaround to accept key into dnf database
• fix Fedora Oracle repository file creation
• fix Fedora Oracle repository file creation
• shellcheck
• https
• fix Fedora Oracle repository file creation
• virtualbox-installer -> virtualbox-installer-cli
• search for errors in package manager update output
• enable pipefail for bash
• improve Fedora repository availability check
• newlines
• start VirtualBox GUI into the background using `virtualbox & disown`
• consistency, `exit 0` instead of `exit`
• improve Fedora repository availability check
• improve VirtualBox version check
• improve VirtualBox version check
• fix unbound variable
• fix when to run update_sources
• newline
• improve VirtualBox version check
• avoid running update_sources multiple times for faster execution
• fix VirtualBox version detection
• installing the `adduser` package for Debian trixie now required on CI
• fix VirtualBox version detection
• fix VirtualBox version detection
• fix Debian VirtualBox package name detection
• Start VirtualBox together with VMs (Thanks to grass!)
• Update compiled manpages (Thanks to grass!)
• Rename installer (Thanks to grass!)
• Allow Kali Linux https://forums.whonix.org/t/whonix-linux-installer-development-discussion/15917/100 (Thanks to grass!)
• installing weak dependency packages `gcc` and `udev` when using `virtualbox.org` (Oracle) repository
• newline
• check if VirtualBox package is installed rather than virtualbox program
• ident style
• shower success confirmation if VirtualBox installer succeeded
• run the usual tests also for VirtualBox Installer
• check disk space also for VirtualBox Installer
• Debian testing fix
• defensively initialize `url_version_domain` variable
• test Oracle repository on CI
• Test VirtualBox Installer on CI
• use long option names
• info level output if SecureBoot is enabled or disabled
• Merge branch 'master' of https://bitbucket.org/uncut-grass/usability-misc (Thanks to nyxnor!)
• Fix usermod args (Thanks to grass!)
• Merge branch 'master' of https://bitbucket.org/uncut-grass/usability-misc (Thanks to nyxnor!)
• Fix typo (Thanks to grass!)
• Merge branch 'master' of https://bitbucket.org/uncut-grass/usability-misc (Thanks to nyxnor!)
• Change adduser to usermod (Thanks to grass!)
• Merge branch 'master' of https://bitbucket.org/uncut-grass/usability-misc (Thanks to nyxnor!)
• CI: Fedora doesn't have 'su' in CI (Thanks to grass!)
• Merge branch 'master' of https://bitbucket.org/uncut-grass/usability-misc (Thanks to nyxnor!)
• CI: fix wheel group (Thanks to grass!)
• Merge branch 'master' of https://bitbucket.org/uncut-grass/usability-misc (Thanks to nyxnor!)
• CI: closing if statement (Thanks to grass!)
• Merge branch 'master' of https://bitbucket.org/uncut-grass/usability-misc (Thanks to nyxnor!)
• CI: Fedora uses the wheel group (Thanks to grass!)
• Merge branch 'master' of https://bitbucket.org/uncut-grass/usability-misc (Thanks to nyxnor!)
• CI: Fedora doesn't have all adduser options (Thanks to grass!)
• Merge branch 'master' of https://bitbucket.org/uncut-grass/usability-misc (Thanks to nyxnor!)
• Fix ci for fedora not being noninteractive (Thanks to grass!)
• merge (Thanks to nyxnor!)
• Support Fedora in CI (Thanks to grass!)
• Fix old variable name (Thanks to grass!)
• merge (Thanks to nyxnor!)
• Fix merge conflict (Thanks to grass!)
• merge (Thanks to nyxnor!)
• Add Oracle repo and Fedora support (Thanks to grass!)
• trixie
• add Debian trixie (testing) support
• add Debian testing detection
• testing
• improve unsupported distribution check output
• Add missing shasum options (Thanks to grass!)
• Add signature unit test (Thanks to grass!)
• Improve error message for unknown systems (Thanks to grass!)
• support only sha512sum tool for verification
• Add unit test to checksum verification (Thanks to grass!)
• Descomplicate verification (Thanks to grass!)
• fix integrity checks
• Revert "Better log_run output catch" This reverts commit d31afaf2eb8a12915a9e5e0eda29724fdf5788a1. (Thanks to grass!)
• Better log_run output catch (Thanks to grass!)
• Improve verification steps logging (Thanks to grass!)
• Downgrade verification loglevels to notice (Thanks to grass!)
• Remove redundant fail from error logs (Thanks to grass!)
• Add missing options to manual page (Thanks to grass!)
• Fix apt line wrapping if output is not a tty With Bash, we can leave stdout to the tty. (Thanks to grass!)
• Improve log formatting of test cases (Thanks to grass!)
• update hardcoded testing-only simulated version number of empty hard drive test-only release because of XFCE -> Xfce change
• remove legacy XFCE -> Xfce support code
• spelling

vm-config-dist:

• add symlinks from /etc/profile.d to /etc/zprofile.d

derivative-maker:

• create symlinks from /etc/profile.d to /etc/zprofile.d
• iso
• Enable teardowns for automatic cleanup (Thanks to Rob Stringer!)
• Fix python syntax (Thanks to Rob Stringer!)
• Query droplet status via DO instead of cloud-init (Thanks to Rob Stringer!)
• Debug droplet facts (Thanks to Rob Stringer!)
• Add troubleshooting step to inspect VPS (Thanks to Rob Stringer!)
• windows installer
• live-build
• live-build
• live-build
• live-build
• live-build
• live-build
• live-build
• live-build
• live-build
• live-build
• live-build
• live-build
• set environment variable `derivative_maker=true` during the build process
• live-build
• live-build
• live-build
• live-build
• live-build
• live-build
• live-build
• live-build
• live-build
• live-build
• live-build
• live-build
• live-build
• live-build
• live-build
• live-build
• live-build
• live-build
• live-build
• live-build
• live-build
• live-build
• live-build
• renamed build-steps renamed: build-steps.d/1120_prepare-build-machine -> build-steps.d/1200_prepare-build-machine renamed: build-steps.d/1130_cowbuilder-setup -> build-steps.d/1300_cowbuilder-setup renamed: build-steps.d/1140_local-dependencies -> build-steps.d/1400_local-dependencies renamed: build-steps.d/1350_create-iso-config -> build-steps.d/1500_create-iso-config renamed: build-steps.d/1150_export-libvirt-xml -> build-steps.d/1600_export-libvirt-xml renamed: build-steps.d/2700_create-vm-text -> build-steps.d/1700_create-vm-text renamed: build-steps.d/1200_create-debian-packages -> build-steps.d/2100_create-debian-packages renamed: build-steps.d/1300_create-raw-image -> build-steps.d/3200_create-raw-image renamed: build-steps.d/1400_create-iso-chroot -> build-steps.d/3300_create-iso-chroot renamed: build-steps.d/1800_copy_vms_into_raw -> build-steps.d/3400_copy-vms-into-raw renamed: build-steps.d/1700_install-packages -> build-steps.d/3500_install-packages renamed: build-steps.d/2300_run-chroot-scripts-post-d -> build-steps.d/4300_run-chroot-scripts-post-d renamed: build-steps.d/2400_convert-raw-to-qcow2 -> build-steps.d/4400_convert-raw-to-qcow2 renamed: build-steps.d/2350_zerofree-raw -> build-steps.d/4400_zerofree-raw renamed: build-steps.d/2375_build-arm64-fs -> build-steps.d/4500_build-arm64-fs renamed: build-steps.d/2500_convert-raw-to-vdi -> build-steps.d/4500_convert-raw-to-vdi renamed: build-steps.d/2600_create-vbox-vm -> build-steps.d/4600_create-vbox-vm renamed: build-steps.d/2376_export-utm-packages -> build-steps.d/4600_export-utm-packages renamed: build-steps.d/2550_create-iso-image -> build-steps.d/4700_create-iso-image renamed: build-steps.d/2800_create-report -> build-steps.d/5100_create-report

17.0.1.9

• port to Debian 12 (bookworm)

anon-apt-sources-list:

• bookworm `non-free` to `non-free-firmware` split
• bookworm `non-free-firmware`

anon-connection-wizard:

• comment out unnecessary import I: anon-connection-wizard source: uses-python-distutils [usr/lib/python3/dist-packages/anon_connection_wizard/anon_connection_wizard.py:19] N: N: This package uses the Python distutils module. N: N: In Python 3.10 and 3.11, distutils has been formally marked as deprecated. N: Code that imports distutils will no longer work from Python 3.12. N: N: Please prepare for this deprecation and migrate away from the Python N: distutils module. N: N: See-Also: https://peps.python.org/pep-0632

desktop-config-dist:

• Revert "`Depends: gnome-colors-common` for livecheck" This reverts commit 14544b881dccc81a63b76d0126e9a0ca4cc28c1a.
• `Depends: gnome-colors-common` for livecheck
• livecheck systray icons
• check if images exist

developer-meta-files:

• abolish /rw/config parsing (Does not influence Qubes specific /rw/config parsing.)
• towards install_ppcross_using_debian_source_package
• import from Whonix-Installer

dist-base-files:

• enable zsh by default for new builds https://forums.whonix.org/t/change-default-shell-from-bash-to-zsh-by-default/14792

genmkfile:

• set `derivative_repository_name`
• skip make uch if CHANGES file exists

hardened-kernel:

• removed outdated .travis.yml file

helper-scripts:

• lightdm https://forums.whonix.org/t/display-manager-lightdm-gdm3-sddm-or-no-display-manager-startx/12457

kicksecure-base-files:

• bump /etc/kicksecure_version

kicksecure-meta-packages:

• install auditd by default useful for aa-logprof
• lightdm https://forums.whonix.org/t/display-manager-lightdm-gdm3-sddm-or-no-display-manager-startx/12457
• remove dependency on `apt-transport-https` because now integrated in `apt`
• `policykit-1` -> `polkitd`, `pkexec`

legacy-dist:

• remove bashrc migration legacy
• support `downloadonly` option for `release-upgrade`

libvirt-dist:

• XFCE -> Xfce
• removed outdated .travis.yml file

live-config-dist:

• bump major version

open-link-confirmation:

• abolish /rw/config parsing (Does not influence Qubes specific /rw/config parsing.)

rads:

• lightdm https://forums.whonix.org/t/display-manager-lightdm-gdm3-sddm-or-no-display-manager-startx/12457
• fix, renamed usr/libexec/tmpfiles.d/rads.conf -> usr/lib/tmpfiles.d/rads.conf
• abolish /rw/config parsing (Does not influence Qubes specific /rw/config parsing.)

sdwdate:

• fix, restart sdwdate-pre every time sdwdate is restarted
• delete sclockadj only when package is removed using apt-get with purge option otherwise during `release-upgrade` postrm script might run, delete sclockadj while sdwdate is still running
• Qubes seccomp fix
• defcon onion fix
• Update 30_default.conf Removed not working URLs (Thanks to TNT BOM BOM!)
• Update 30_default.conf Renewed Defcon URL (Thanks to TNT BOM BOM!)
• Update 30_default.conf renewed the intercept URL, and removed duplicate from securedrop (since using the same new URL) (Thanks to TNT BOM BOM!)
• Update 30_default.conf Remove the TLS from https://www.propublica.org/ onion service

https://p53lf57qovyuvwsc6xnrppyply3vtqm7l6pcobkmyqsiofyeznfu5uqd.onion
http://p53lf57qovyuvwsc6xnrppyply3vtqm7l6pcobkmyqsiofyeznfu5uqd.onion  (Thanks to TNT BOM BOM!)

• moved /usr/libexec/sdwdate/sclockadj.c -> usr/src/sdwdate/sclockadj.c

systemcheck:

• add firmware and microcode packages to list of expected nonfreeodm packages
• abolish /rw/config parsing (Does not influence Qubes specific /rw/config parsing.)

tb-starter:

• abolish /rw/config parsing (Does not influence Qubes specific /rw/config parsing.)

tb-updater:

• tbb_hardcoded_version="12.5.1"
• tbb_hardcoded_version="12.5"
• abolish /rw/config parsing (Does not influence Qubes specific /rw/config parsing.)
• alpha tbb_hardcoded_version="12.5a7"
• tbb_hardcoded_version="12.0.7"

timesanitycheck:

• update minimum_unixtime

tirdad:

• signed commit

usability-misc:

• Merge branch 'master' into scurl-improvements
• Disable SC2317 globally (Thanks to grass!)
• Change running vm detection method (Thanks to grass!)
• Fail if trying to import a VM that is running (Thanks to grass!)
• install Kicksecure signing key
• implement adding Kicksecure repository
• towards bookworm support
• fix, do not hardcode distribution codename
• distro_codename
• oldstable
• fix, do not run Nested Virtualization Test when dry run
• handle XFCE -> Xfce renaming for Whonix 17
• XFCE -> Xfce
• remove usr/share/usability-misc/tbb-foxyproxy/foxyproxy.xml https://forums.whonix.org/t/new-version-of-tbb-no-longer-accepts-foxyproxy-plugin/2565/57
• symlink /usr/bin/virtualbox-installer
• Fix test statement not handling errors Reminder to use if statements because they don't have this problem. (Thanks to grass!)
• Add standalone VirtualBox installer (Thanks to grass!)
• improve curl-download and redirect scurl-download to it (Thanks to nyxnor!)
• better to quote every arg (Thanks to nyxnor!)
• quote args with spaces, that if passed as singl arg, they were unquoted by the shell (Thanks to nyxnor!)
• improve scurl-download to behave like wget (Thanks to nyxnor!)

derivative-maker:

• non-free non-free-firmware
• sanity test
• avoid head/tail due to issues
• deprecated `--build`` and `--clean` for code simplification `derivative-delete` will replace `--clean`
• rework internalrun
• rework internalrun
• installer-dist upload support
• Remove tasks to delete existing VMs since VPS is newly created (Thanks to Rob Stringer!)
• Install VirtualBox after repo source (Thanks to Rob Stringer!)
• Wait for cloud init apt process completetion (Thanks to Rob Stringer!)
• Add maintained virtualbox installation script and logging (Thanks to Rob Stringer!)
• Wait for connection to create users (Thanks to Rob Stringer!)
• Bump inventory to debian 12 (Thanks to Rob Stringer!)
• Add CI testing branches (Thanks to Rob Stringer!)
• VirtualBox version update
• XFCE -> Xfce
• remove no longer needed udev udevadm workaround comments
• apt-cacher-ng fix
• automate adding `AllowUserPorts: 0` to `/etc/apt-cacher-ng/acng.conf`
• remove `qemu` from build dependencies because package `qemu` is no longer available in Debian bookworm.
• stunnel -> stunnel4
• download VirtualBox from Debian sid because not yet available from Debian fasttrack https://salsa.debian.org/fasttrack-team/support/-/issues/51
• use Tor packages from Debian stable instead of Tor Project repository
• add packages only to the repository these originate from In other words, no longer adding all packages to all derivative specific repositories.
• abolish /rw/config parsing (Does not influence Qubes specific /rw/config parsing.)
• use mmdebstrap from Debian instead from help-steps/mmdebstrap
• windows installer
• Windows-Installer
• add windows/Whonix-Starter

Kicksecure 16.0.9.8

desktop-config-dist:

• remove unncessary comments (Thanks to nyxnor!)
• improve highlight colors and fix =command problem (Thanks to nyxnor!)
• fix zsh prompt mising color (Thanks to nyxnor!)

developer-meta-files:

• remove monero-gui
• dm-git-commit-checkout-latest
• Windows Installer
• Windows Installer
• Windows Installer
• Windows Installer
• rsync
• installer-dist
• installer-dist
• installer-dist
• installer-dist

helper-scripts:

• add initrd-file-detect / kernel-file-detect

kicksecure-meta-packages:

• remove monero-gui
• consistent use of `Pre-Depends: legacy-dist`

kicksecure-welcome-page:

• CSS redesign to fit for all imaginable screen sizes (Thanks to Hans!)

legacy-dist:

• Prevent question "Should kexec-tools handle reboots (sysvinit only)?" by kexec-tools package kexec-tools is a dependency of security-misc.

mediawiki-shell:

• genmkfile uch
• improvements
• improvements
• improvements
• improvements
• major revision
• Initial commit (Thanks to Matthew Newton!)

ram-wipe:

• update-grub
• renamed: lib/systemd/system/cold-boot-attack-defense-kexec-prepare.service -> lib/systemd/system/ram-wipe-kexec-prepare.service
• remove no longer needed file /etc/sysctl.d/40_ram-wipe.conf
• rework message output
• fix, run cold-boot-attack-defense-kexec-prepare.service only when needed
• fix, renamed: debian/security-misc.triggers -> debian/ram-wipe.triggers
• config-package-dev hide /etc/sysctl.d/30_security-misc_kexec-disable.conf
• add debian install file (generated using "genmkfile debinstfile")
• Added files for cold boot defense (Thanks to Friedrich Doku!)
• genmkfile uch
• debinstfile
• Depends: helper-scripts because contains kernel-file-detect and initrd-file-detect
• kexec is required for cold boot attack defense. kernel.kexec_load_disabled=0
• import /etc/default/grub.d/40_ram-wipe.cfg from security-misc
• initial commit

sdwdate:

• add `sendmsg` secomp call (needed when using `debug` on kernel command line)
• restore correct permissions in /var/lib/sdwdate folder if changed by something else such as it happens in Qubes

security-misc:

• move kexec disabling to dedicated file `/etc/sysctl.d/30_security-misc_kexec-disable.conf` so ram-wipe can `config-package-dev` `hide` this config file
• move ram-wipe scripts to dedicated ram-wipe package
• migrate ram-wipe to dedicated package
• disable kexec (revert enabling kexec) remove kexec-utils for ram-wipe since moved to its own package
• migrate to ram-wipe package
• use warn instead of info for now because dracut does not show info messages when kernel parameter quiet is set
• improve kernel and initrd file detection
• improve kernel and initrd file detection
• drop_caches
• DRACUT_QUIET=no
• prevent "wait: pid 55 is not a child of this shell"
• lower debugging
• protect against wipe RAM reboot loop
• long options
• Depends: kexec-tools required for cold boot attack defense second RAM wipe after reboot
• long options
• long options
• --no-legend
• test if readable
• lower debugging
• chmod +x
• Get rid of /dev/kmsg (Thanks to Friedrich Doku!)
• Change echo to info. Included more reliable way of getting initrd and kernel. Allow user custom kexec (Thanks to Friedrich Doku!)
• fix last line (Thanks to Friedrich Doku!)
• Checking job queue instead of dbus (Thanks to Friedrich Doku!)
• Update wipe-ram.sh (Thanks to Friedrich Doku!)
• Update wipe-ram-needshutdown.sh (Thanks to Friedrich Doku!)
• Update module-setup.sh (Thanks to Friedrich Doku!)
• Update wipe-ram.sh (Thanks to Friedrich Doku!)
• Update wipe-ram-needshutdown.sh (Thanks to Friedrich Doku!)
• Update module-setup.sh (Thanks to Friedrich Doku!)
• Update cold-boot-attack-defense-kexec-prepare.service (Thanks to Friedrich Doku!)
• Update cold-boot-attack-defense-kexec-prepare (Thanks to Friedrich Doku!)
• Update cold-boot-attack-defense-kexec-prepare.service (Thanks to Friedrich Doku!)
• Update cold-boot-attack-defense-kexec-prepare (Thanks to Friedrich Doku!)
• Update wipe-ram.sh (Thanks to Friedrich Doku!)
• Update wipe-ram-needshutdown.sh (Thanks to Friedrich Doku!)
• Update module-setup.sh (Thanks to Friedrich Doku!)
• Update wipe-ram.sh (Thanks to Friedrich Doku!)
• Update wipe-ram-needshutdown.sh (Thanks to Friedrich Doku!)
• Update module-setup.sh (Thanks to Friedrich Doku!)
• Update cold-boot-attack-defense-kexec-prepare (Thanks to Friedrich Doku!)
• Update wipe-ram.sh (Thanks to Friedrich Doku!)
• Update wipe-ram-needshutdown.sh (Thanks to Friedrich Doku!)
• Update module-setup.sh (Thanks to Friedrich Doku!)
• Added checks (Thanks to Friedrich Doku!)
• added files (Thanks to Friedrich Doku!)
• Merge branch 'Kicksecure:master' into framebuffer (Thanks to Raja Grewal!)
• Typo (Thanks to Raja Grewal!)
• Add comment about legacy Apple fiesystems (Thanks to Raja Grewal!)
• Include several framebuffer drivers into blacklist These were previously commented out to test for compatibility issues. (Thanks to Raja Grewal!)

systemcheck:

• show output of `sudo apparmor-info` when using `--verbose`
• show seccomp issues when using --verbose

tb-updater:

• alpha tbb_hardcoded_version="12.5a3"
• tbb_hardcoded_version="12.0.3"
• alpha tbb_hardcoded_version="12.5a2"
• tbb_hardcoded_version="12.0.2"
• tbb_hardcoded_version="12.0.1"
• tbb_hardcoded_version="12.0"
• Change min $tbb_version for TB_LANG="ALL" This resolves curl not finding packages ending with "en-US" since new packages use "ALL" instead (and versions < 12.0a4 no longer seem to be available): https://dist.torproject.org/torbrowser/12.0/ (Thanks to Andrea Varesio!)
• alpha tbb_hardcoded_version="12.0a5"

usability-misc:

• Merge branch 'master' into installer * master: fix fasttrack onion insertion (Thanks to grass!)
• fix fasttrack onion insertion (Thanks to grass!)
• shellcheck
• fix log_run and fasstrack repo adding only if necessary (Thanks to grass!)
• changes to su, xtrace, fasttrack no su function xtrace printed to screen fasttrack torified or +onionized repository (Thanks to grass!)
• deal with testing not having complete /etc/os-release (Thanks to grass!)
• better error handling in case starting VirtualBox VMs fails due to unexpected reasons
• a failing vboxmanage startvm is not considered a bug if virtualization detection failed
• nested_virtualization_detected
• improve output if nested virtualization is detected
• do not hardcode domain name
• show which root commands are executed on the user's system for transparency
• improve RAM and virtualization test output
• improve output in case of errors
• shellcheck
• request logs to be included in bug reports
• point user to debug log
• set shebang to bash for better error handling
• test_pkg
• improve root_cmd
• fix doas support
• CI
• install ca-certificates
• fix su support
• guard against /etc/os-release not containing VERSION_ID
• fix fasttrack repository detection
• fix Ubuntu version detection
• CI
• CI
• set note why ubuntu has the version set (Thanks to nyxnor!)
• try mint latest (Thanks to nyxnor!)
• try linux mint 3rd party image (Thanks to nyxnor!)
• better handling of disabled colors (Thanks to nyxnor!)
• add another environment variable to disable colors (Thanks to nyxnor!)
• fix build with checking out repo before paths-filter (Thanks to nyxnor!)
• newline to test build only if file is modified (Thanks to nyxnor!)
• try another gh action checkout version (Thanks to nyxnor!)
• add support for no color (Thanks to nyxnor!)
• fix yml syntax (Thanks to nyxnor!)
• run build only if installer was changed (Thanks to nyxnor!)
• build fails without sudo (Thanks to nyxnor!)
• fix yml syntax (Thanks to nyxnor!)
• test without sudo (Thanks to nyxnor!)
• remove debug lines from build (Thanks to nyxnor!)
• fix shellcheck (Thanks to nyxnor!)
• fix build with ca (Thanks to nyxnor!)
• fix shellcheck (Thanks to nyxnor!)
• use portable id to get user (Thanks to nyxnor!)
• try to get username (Thanks to nyxnor!)
• misc (Thanks to nyxnor!)
• try with sudo (Thanks to nyxnor!)
• fix build exiting (Thanks to nyxnor!)
• remove extra line (Thanks to nyxnor!)
• remove ps dependency (Thanks to nyxnor!)
• fix unbound variable distro_version (Thanks to nyxnor!)
• print env vars (Thanks to nyxnor!)
• better bash (Thanks to nyxnor!)
• better method to check if shell is bash (Thanks to nyxnor!)
• set shell for the workflow (Thanks to nyxnor!)
• fix ubuntu version check (Thanks to nyxnor!)
• remove sudo from workflow (Thanks to nyxnor!)
• add test case for workflow (Thanks to nyxnor!)
• fix tty problem for build workflow (Thanks to nyxnor!)
• print logs at the end hopefully (Thanks to grass!)
• identify problem with tty not being connected to terminal (Thanks to grass!)
• remove newline (Thanks to grass!)
• fix build not having ps (Thanks to grass!)
• beautify output of exec (Thanks to grass!)
• fix build path (Thanks to grass!)
• live again (Thanks to grass!)
• destroy will to live (Thanks to grass!)
• add CI workflow for GH actions (Thanks to grass!)
• better logging xtrace for bash and fix mint (Thanks to grass!)
• fix help message ordering (Thanks to grass!)
• allow multiple process to be killed (Thanks to grass!)
• clean run_installer into more functions (Thanks to grass!)
• fix end exit for options that doesn't hit main (Thanks to grass!)
• improve logging mechanism (Thanks to grass!)
• change date logging to increasing number (Thanks to grass!)
• fix date to be utc (Thanks to grass!)
• add comments to explain import_only functionality (Thanks to grass!)
• fix import_only to only manage the specified vm (Thanks to grass!)
• fix mirror wrong subdir (Thanks to grass!)
• explain problem with current logging to file implementation (Thanks to grass!)
• fix dialog failing due to parent script redirection (Thanks to grass!)
• fix mirror zsh completion (Thanks to grass!)
• fix zsh completion of --import-only (Thanks to grass!)
• fix get_arg quitting by unhandled case if opt=value was being used, it was returning false, making the script abort. (Thanks to grass!)
• add import-only (Thanks to grass!)
• add mode to log to file and option to not show errors (Thanks to grass!)
• add commit hash placeholdre for distribution (Thanks to grass!)
• uncomment pre_check functions (Thanks to grass!)
• add mirrors option (Thanks to grass!)
• fix spelling mistake (Thanks to grass!)
• fix not informing about what package is missing (Thanks to grass!)
• fix netcat-openbsd pkg name (Thanks to grass!)
• add allow errors (dirty mode) (Thanks to grass!)
• fix pre check (Thanks to grass!)
• add testers mode (Thanks to grass!)
• fix not failing on the first download error (Thanks to grass!)
• misc changes (Thanks to grass!)
• add no-import (Thanks to grass!)
• fix zsh completion (Thanks to grass!)
• explain why the log_run can't be encapsulated (Thanks to grass!)
• improve testing variable length (Thanks to grass!)
• remove unused shellcheck (Thanks to grass!)
• fix curl printing too much information (Thanks to grass!)
• fix not printing cmd to test internet connection (Thanks to grass!)
• fix compression and partial not being used (Thanks to grass!)
• fix timeout not accepting user signals (Thanks to grass!)
• print pid (Thanks to grass!)
• change rsync option from inplace to simply partial (Thanks to grass!)
• add optimizations for transfers (Thanks to grass!)
• fix timeout of transfer Each program has different timeout options that work in different ways. Implement program specific timeouts when possible and resort to external core utils utility to ensure the maximum timeout is enforced. (Thanks to grass!)
• fix shellcheck warnings (Thanks to grass!)
• fix variable mispelling (Thanks to grass!)
• fix rsync now showing progress (Thanks to grass!)
• fix max size for whonix xfce images current version 16.0.8.2 is already 2.1Gib and version 16.0.8.9 is at 2.2GiB. (Thanks to grass!)
• fix rsync now showing while file was skipped (Thanks to grass!)
• revert printing testing internet command dumps too much data and only useful for testing (Thanks to grass!)
• fix download links (Thanks to grass!)
• improve scurl-download to behave like wget (Thanks to nyxnor!)

derivative-maker:

• remove monero-gui
• iso
• iso
• port ISO creation to Debian's live-build "`lb`"
• live-build
• live-build
• live-build
• live-build
• live-config
• live-build
• live-build
• live-build
• live-build
• live-build
• live-config apt.conf
• live-build APT config
• `apt` `Acquire::Retries=5` increase to 5 same as live-build
• live-build
• add help-steps/live-build
• live-config
• live-config
• fix running with `debootstrap`
• live-build
• live-build
• live-config
• live-config
• add help-steps/live-config
• run live-build `lb config` in folder live-build
• --target windows
• add Whonix-Starter-Binary Whonix.exe
• add Whonix-Installer for Windows
• Add tag pushes (Thanks to Rob Stringer!)
• Try base ref instead (Thanks to Rob Stringer!)
• Try changing ref var (Thanks to Rob Stringer!)
• Encrypt vault with correct secrets password (Thanks to Rob Stringer!)
• Run workflow on PR open (Thanks to Rob Stringer!)
• Revert debug changes (Thanks to Rob Stringer!)
• Add vncserver password (Thanks to Rob Stringer!)
• Add pseudocode for configuring VNC (Thanks to Rob Stringer!)
• Indent incorrect yaml (Thanks to Rob Stringer!)
• Debug (Thanks to Rob Stringer!)
• Rotate ssh keys (Thanks to Rob Stringer!)
• encrypt vault and rotate secrets (Thanks to Rob Stringer!)
• Add temp patch for debugging (Thanks to Rob Stringer!)
• Install xfce4 package (Thanks to Rob Stringer!)
• Delete extraneous, duplicate /etc/apt/sources.list.d/0000debian_stable_current_clearnet.list by mmdebstrap.
• Enable extended L2, reduce cluster size fixes https://github.com/adrelanos/Whonix/pull/1 https://forums.whonix.org/t/help-welcome-kvm-development-staying-the-course/166/515
• add ram-wipe package https://forums.whonix.org/t/is-ram-wipe-possible-inside-whonix-cold-boot-attack-defense/5596
• add mediawiki-shell package
• installer-dist
• installer-dist
• installer-dist
• installer-dist
• installer-dist
• installer-dist
• installer-dist
• installer-dist
• lower debugging

Kicksecure 16.0.9.0

derivative-maker:

• sanity test
• Add host to hostfile (Thanks to Rob Stringer!)
• Rename include gui-build role task (Thanks to Rob Stringer!)
• Change droplet size for tier restrictions (Thanks to Rob Stringer!)
• Rotate SSH keys after accidental commit (Thanks to Rob Stringer!)
• Refactor source install (Thanks to Rob Stringer!)
• Remove whitespace (Thanks to Rob Stringer!)
• Call build VM script main function (Thanks to Rob Stringer!)
• Rename build roles for clarity (Thanks to Rob Stringer!)
• Restructure log logic (Thanks to Rob Stringer!)
• Remove redundant cleanup logic and shutdown for loopbacks (Thanks to Rob Stringer!)
• Restructure small resource build roles (Thanks to Rob Stringer!)
• Remove redundant call of common role (Thanks to Rob Stringer!)
• Restructure roles for small-resource builds (Thanks to Rob Stringer!)
• Fix broken VPS_IP assignment (Thanks to Rob Stringer!)
• Add folder structure for different build types (Thanks to Rob Stringer!)
• Restructure gather build logs task (Thanks to Rob Stringer!)
• Allow untagged builds for commit pipelines (Thanks to Rob Stringer!)
• Install VirtualBox keys and repository (Thanks to Rob Stringer!)
• Restructure ansible user authorized_keys copy (Thanks to Rob Stringer!)
• Restructure delete inventory play (Thanks to Rob Stringer!)
• Change ssh user for bootstrap play (Thanks to Rob Stringer!)
• Refactor vars decryption and encryption paths (Thanks to Rob Stringer!)
• Restructure tasks to common role (Thanks to Rob Stringer!)
• Add community general install (Thanks to Rob Stringer!)
• Add formatting for localhost and create user block (Thanks to Rob Stringer!)
• Temporarily change droplet size to account for account restrictions (Thanks to Rob Stringer!)
• Create ansible user, allow ssh, and passwordless sudo (Thanks to Rob Stringer!)
• Add VPS_IP variable definition (Thanks to Rob Stringer!)
• Restructure delete inventory playbook (Thanks to Rob Stringer!)
• Remove unnecessary inventory flag (Thanks to Rob Stringer!)
• Add correct teardown task (Thanks to Rob Stringer!)
• Add local connection and vault password arguments to teardown functionality (Thanks to Rob Stringer!)
• Add execution permission to teardown script (Thanks to Rob Stringer!)
• Add teardown build script (Thanks to Rob Stringer!)
• Rename VPS per DigitalOcean requirements (Thanks to Rob Stringer!)
• Change yml formatting (Thanks to Rob Stringer!)
• Create and include delete inventory task (Thanks to Rob Stringer!)
• Create droplet with SSH key id (Thanks to Rob Stringer!)
• Create SSH key resource (Thanks to Rob Stringer!)
• Change ssh key to string (Thanks to Rob Stringer!)
• Add automated_builder_vps creation (Thanks to Rob Stringer!)
• Loop through existing droplets and delete (Thanks to Rob Stringer!)
• Troubleshoot droplet counting conditionals (Thanks to Rob Stringer!)
• Add inventory for runs (Thanks to Rob Stringer!)
• Add initial droplet creation strategy (Thanks to Rob Stringer!)
• Revert "temporarily disable fasttrack repository" This reverts commit ea20d301bb2ff0acef1b756b9e552aebe0bae353.
• make mmdebstrap when using `--connection onion` actually use onions
• temporarily disable fasttrack repository
• build sources: fix, remove clearnet APT repository from onion apt sources list
• build sources: add the fasttrack onion for `--connection onion` that was just made available by upstream https://forums.whonix.org/t/install-debian-fasttrack-archive-keyring-enable-debian-fasttrack-repository-by-default/11456/9 https://web.archive.org/web/20221107195903/https://securityheaders.com/?q=https%3A%2F%2Ffasttrack.debian.net%2F&followRedirects=on
• Start Virtual Box VMs with GUI and update documentation (Thanks to Rob Stringer!)
• improve environment variables passing
• env_vars_keep_list=" tbb_version tb_onion anon_shared_inst_tb dist_build_unsafe_io "
• fix, allow passing environment variables such as `tbb_version` during package installation
• add kicksecure-welcome-page
• remove tabs
• add package kicksecure-welcome-page

anon-apt-sources-list:

• comment: add fasttrack onion https://forums.whonix.org/t/install-debian-fasttrack-archive-keyring-enable-debian-fasttrack-repository-by-default/11456/9 https://web.archive.org/web/20221107195903/https://securityheaders.com/?q=https%3A%2F%2Ffasttrack.debian.net%2F&followRedirects=on

desktop-config-dist:

• fix removal of items in the previous commit (Thanks to nyxnor!)
• fix home and end for different keyboards (Thanks to nyxnor!)
• Fix /etc/zsh_prompt for shells with `no_unset` shell option (aka `set -u`) set (Thanks to Erin Schlarb!)
• enabled bracketed paste by default not sure it works using every paste method, but will leave enabled as it may cause more good than harm (Thanks to nyxnor!)
• remove extendedglob, too advanced (Thanks to nyxnor!)
• create empty .zshrc to skip zsh-newuser-install https://www.kicksecure.com/wiki/Shell (Thanks to nyxnor!)
• Merge branch 'master' of https://github.com/Kicksecure/desktop-config-dist (Thanks to nyxnor!)
• improve following kali linux (Thanks to nyxnor!)

developer-meta-files:

• rsync-ssl
• rsync-ssl
• dm-check-mirrors

kicksecure-meta-packages:

• remove dependency on xserver-xorg-video-qxl https://forums.whonix.org/t/help-welcome-kvm-development-staying-the-course/166/501
• add kicksecure-welcome-page to kicksecure-desktop-applications-recommended
• install more packages by default - hunspell-en-us - gpa - ffmpeg - pinentry-qt (or pinentry-x11) - pdf - youtube-dl https://forums.kicksecure.com/t/add-remove-extra-packages/135/4
• install vlc media player by default https://forums.kicksecure.com/t/add-remove-extra-packages/135
• no longer install wget by default https://forums.kicksecure.com/t/add-remove-extra-packages/135

kicksecure-welcome-page:

• Update JS libs, bugfix superwide screen, bugfix modalclose (Thanks to Hans!)
• hide Firefox welcome page
• use minified jquery version from Debian package sources
• remove trailing white spaces
• deleted: usr/share/doc/homepage/kicksecure-welcome-page/end-of-year-banner/jquery.cookie.js
• Depends: libjs-jquery
• deleted: usr/share/doc/homepage/kicksecure-welcome-page/end-of-year-banner/jquery.js
• playbuttons payments localStorage jquery-debian (Thanks to Hans!)
• Library file update (Thanks to Hans!)
• jQuery plain correcting reference (Thanks to Hans!)
• jquery plain not min as source (Thanks to Hans!)
• End of year files (Thanks to Hans!)
• Kicksecure End Of Year Banner (Thanks to Hans!)
• set local kicksecure-welcome-page as default homepage in Firefox ESR
• Image attribution for CC (Thanks to Hans!)
• Kicksecure welcome page redesign (Thanks to Hans!)
• genmkfile uch
• add kicksecure-logo-text.png
• minor: link to root domain, not index.html
• ahmia
• add icon for brave search
• Add onions as much as possible instead of TLS only https://forums.whonix.org/t/local-browser-homepage-for-tor-browser-in-whonix/347/106 (Thanks to TNT BOM BOM!)
• remove hardcoded font, use font from Debian package sources instead
• update copyright since complete rewrite
• Welcome Page Revision (Thanks to Your Name!)
• usr/share/homepage -> usr/share/doc/homepage
• add link to https://web.archive.org/https://t.me/s/Whonix_
• no need for tabindex
• add telegram news channel
• onion forums
• upgrade to Whonix logo 2020 version
• have to use file:///usr/share/homepage/whonix-welcome-page/logo.png
• back to real image logo Thanks to @torjunkie for bringing this up! https://forums.whonix.org/t/illustrations-images-wishlist-for-whonix/3352/13
• add search engines
• switch forums to clearnet link as onion is broken https://forums.whonix.org/t/onion-forum-broken/8870
• research project
• fix, only set TOR_DEFAULT_HOMEPAGE if not already set
• reactive default homepage since fixed in Tor Browser 9
• no longer set TOR_DEFAULT_HOMEPAGE variable https://forums.whonix.org/t/noscript-with-security-slider-at-safest-permits-around-30-sites/8160
• https://www.whonix.org/wiki/Dev/Licensing
• add improved legal protections clauses The license for software created by Whonix is the GNU General Public License as published by the Free Software Foundation, either version 3 of the License, or (at your option) any later version with additional terms applicable per GNU GPL version 3 section 7. The additional terms are based on the Doom 3 license which is Debian refers to as `GPL-3+-with-id-software-additional-terms`, which is Debian DFSG [1] (The Debian Free Software Guidelines) approved and which is therefore suitable for Debian `main`. Whonix made applied minimal changes to it: * Rewrite `The Doom 3 BFG Edition GPL Source Code` to the more common `this program` which is used throughout the GPL. * Added a "trump clause" [2], in other words, any conflicts or disputes between the additional terms and the GPLv3 shall be resolved in favor of the GPLv3 by adding `Notwithstanding any other provision of this License` (as mentioned in GPL FAQ [3]) at the beginning of the additional terms. [1] https://www.debian.org/social_contract#guidelines [2] https://www.fsf.org/news/canonical-updated-licensing-terms [3] https://www.gnu.org/licenses/gpl-faq.html#v3Notwithstanding For more considerations, see also: https://www.whonix.org/wiki/Dev/Licensing
• Merge branch 'master' of https://github.com/Whonix/whonix-welcome-page (Thanks to irykoon!)
• Update Copyright header (Thanks to irykoon!)
• Beautify welcome-page for Tor Browser 8.0a It is recommended NOT merging this commit until Tor Browser 8.0 becomes stable as it won't make the page in Tor Browser 7.5.x look better. (Thanks to irykoon!)
• whonix.org/blog -> forum.whonix.org/c/news As discussed on: https://forums.whonix.org/t/replacing-whonix-wordpress-blog-https-www-whonix-org-blog/5351/7 (Thanks to irykoon!)
• Beautify Whonix Ascii Logo (Thanks to irykoon!)
• move to v3 onion
• move to v3 onion
• Remove the redundant whonix_new.html (Thanks to irykoon!)
• Beautify Whonix Welcome page in Tor Browser The 7.0.9 release broke the Whonix welcome page in Tor Browser (https://forums.whonix.org/t/the-7-0-9-release-broke-the-whonix-landing-page-in-tor-browser/4489). Although the prvious welcome page still works, it is better to beautify it. This fix include replacing Whonix logo png with Ascii Art, removal of invlalid links and enlarging font size. Still this is a temporary workaround and please feel free to checkout to the previous one, once the breakage problem is fixed by TPO. (Thanks to irykoon!)
• Beautify Whonix Welcome page in Tor Browser The 7.0.9 release broke the Whonix welcome page in Tor Browser (https://forums.whonix.org/t/the-7-0-9-release-broke-the-whonix-landing-page-in-tor-browser/4489). Although the prvious welcome page still works, it is better to beautify it. This fix include replacing Whonix logo png with Ascii Art, removal of invlalid links and enlarging font size. Still this is a temporary workaround and please feel free to checkout to the previous one, once the breakage problem is fixed by TPO. (Thanks to irykoon!)
• onionize Whonix related links on welcome page (Thanks to irykoon!)
• updated README.md
• updated Whonix forums url Thanks to @HulaHoopWhonix for the report.
• Removed search box due to fingerprinting issues due to outdated, Whonix specific POST parameters. The Tor Project changed away from startpage.com. (Old Startpage submission URL and POST parameters have also since changed.) Thanks to unconventional for reporting this issue and explaining how to disable the search box. https://www.whonix.org/forum/index.php/topic,1564.0.html
• packaging, bumped Standards-Version from 3.9.4 to 3.9.6 for jessie support
• Added licensing comments... This file is part of Whonix. Copyright (C) 2015 WhonixQubes See the file COPYING for copying conditions. - usr/share/homepage/whonix-welcome-page/whonix.html - usr/share/homepage/whonix-welcome-page/stylesheet.css (Thanks to WhonixQubes!)
• Removed JavaScript... JavaScript is not used in this initial static webpage version. - Removed file: usr/share/homepage/whonix-welcome-page/javascript.js - Removed reference from: usr/share/homepage/whonix-welcome-page/whonix.html (Thanks to WhonixQubes!)
• added genmkfile to Build-Depends
• updated readme
• set from TOR_HOMEPAGE to TOR_DEFAULT_HOMEPAGE as per https://trac.torproject.org/projects/tor/ticket/13835#comment:8
• set, export environment variable TOR_HOMEPAGE to set TorBrowser homepage to /usr/share/homepage/whonix-welcome-page/whonix.html https://trac.torproject.org/projects/tor/ticket/13835
• initial packaging
• Added "target" and "rel" HTML tags to links in Disclaimer text... Makes uniform with other external web links on page. - target="_blank" (helps open link in new tab). - rel="noreferrer" (can help blank HTTP REFERER field). ./usr/share/homepage/whonix-welcome-page/whonix.html (Thanks to WhonixQubes!)
• Called JavaScript file with "script" tag in HTML head... - Referenced relative path of "javascript.js" - Used proper media type of "application/javascript" ./usr/share/homepage/whonix-welcome-page/whonix.html (Thanks to WhonixQubes!)
• Added javascript.js ./usr/share/homepage/whonix-welcome-page/javascript.js (Thanks to WhonixQubes!)
• Adjusted spacing and size of resource links in stylesheet... - Decreased padding of list items to allow for font size increase. - Increased font size of link anchors for better visibility. ./usr/share/homepage/whonix-welcome-page/stylesheet.css (Thanks to WhonixQubes!)
• Added "tabindex" attributes to HTML elements for logical ordered tab sequencing. ./usr/share/homepage/whonix-welcome-page/whonix.html (Thanks to WhonixQubes!)
• Fixed centering of list items of resource links in stylesheet. ./usr/share/homepage/whonix-welcome-page/stylesheet.css (Thanks to WhonixQubes!)
• Added explicit UTF-8 charset declaration to the stylesheet... ./usr/share/homepage/whonix-welcome-page/stylesheet.css (Thanks to WhonixQubes!)
• Changed title tag text to "Whonix Welcome Page" from "Welcome to Whonix"... ./usr/share/homepage/whonix-welcome-page/whonix.html Provides better enduring page usage context and user association to the formal name of the page. (Thanks to WhonixQubes!)
• Changed indent style to tabs from spaces for better code workability... ./usr/share/homepage/whonix-welcome-page/whonix.html ./usr/share/homepage/whonix-welcome-page/stylesheet.css (Thanks to WhonixQubes!)
• Inserted latest HTML (whonix.html) and CSS (stylesheet.css) from Whonix Development Forum... ./usr/share/homepage/whonix-welcome-page/whonix.html ./usr/share/homepage/whonix-welcome-page/stylesheet.css Whonix Development Forum thread message: https://www.whonix.org/forum/index.php/topic,365.msg5816.html#msg5816 (Thanks to WhonixQubes!)
• Added logo.png... ./usr/share/homepage/whonix-welcome-page/logo.png Source of file: https://www.whonix.org/w/images/e/e0/210-Banner.png SHA512 Hash: ec3b40a272070b9c71bcc91461d662f31f7370d5877cff69c52888169d89f1cc8d00a77a90b8d22280ce07eb587acf43f905672c079aae7e7a5e491dfc9c42cc (Thanks to WhonixQubes!)
• Added ./usr/share/homepage/whonix-welcome-page & whonix.html & stylesheet.css... ./usr/share/homepage/whonix-welcome-page ./usr/share/homepage/whonix-welcome-page/whonix.html ./usr/share/homepage/whonix-welcome-page/stylesheet.css (Thanks to WhonixQubes!)
• Initial commit (Thanks to WhonixQubes!)

repository-dist:

• man page: document `--transport` plain-tls, plain-tls-tor, onion or onion-tls

sdwdate:

• Update 30_default.conf added descriptions to archive.ph links since they are not understandable from the link (because the link is shortened by default) (Thanks to TNT BOM BOM!)
• Update 30_default.conf added geti2p gitlab onion mirror (Thanks to TNT BOM BOM!)
• Update 30_default.conf Rearranged onion+TLS mirrors and added them to the top (better view/easy editing or finding) (Thanks to TNT BOM BOM!)
• Update 30_default.conf Removed elude and fsfe as both onion mirrors are down (Thanks to TNT BOM BOM!)
• Update 30_default.conf deleted keybase as its not working (Thanks to TNT BOM BOM!)
• Merge branch 'master' into patch-8
• Update 30_default.conf added protonmail onion mirror (Thanks to TNT BOM BOM!)
• Update 30_default.conf deleting privacy2ws3ora5p4qpzptqr32qm54gf5ifyzvo5bhl7bb254c6nbiyd.onion mirror due to misconfigured TLS:

> * stderr: connect error: SOCKSHTTPSConnectionPool(host='privacy2ws3ora5p4qpzptqr32qm54gf5ifyzvo5bhl7bb254c6nbiyd.onion', port=443): Max retries exceeded with url: / (Caused by SSLError(SSLCertVerificationError(1, '[SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: certificate has expired (_ssl.c:1123)')))  (Thanks to TNT BOM BOM!)

• Update 30_default.conf removed FB (Thanks to TNT BOM BOM!)
• Update 30_default.conf Added 4 new (famous) mirrors:

- BBC
- Facebook
- NYT
- Archive.ph  (Thanks to TNT BOM BOM!)

security-misc:

• pam-info: support non-root environments (such as during graphical display manager login and xscreensaver)
• pam-info refactoring
• pam-info refactoring
• pam-info fix
• pam-info refactoring
• pam-info refactoring
• also support /usr/local/etc/pam-info-debug
• pam-info: create debug log file ~/pam-info-debug.txt when file /etc/pam-info-debug exists

systemcheck:

• systemcheck_tor_bootstrap_wait_max="300"

tb-updater:

• tbb_hardcoded_version="11.5.8"
• tbb_hardcoded_version="11.5.7"
• alpha tbb_hardcoded_version="12.0a4"
• Make update-torbrowser work with new multi-lang builds As of v12.0a4 Tor Browser is shipped as a multi-language archive and language-specific archives are no longer available. This patch makes this new multi-lang version install properly but does not handle starting Tor Browser with the correct locale. I'm not entirely sure how the locale should be handled. Is it good enough to just use the system language (which Tor Browser now does by default) or should some other solution be used? If the system language is good enough, I'd suggest just merging this change as is and once v12 stable is released TB_LANG support can be removed. (Thanks to Peter Gerber!)
• tbb_hardcoded_version="11.5.6"
• tbb_hardcoded_version="11.5.5"

tor-ctrl:

• unlimit circuit hops vanguards compatibility (Thanks to nyxnor!)
• fix hanging of tor on WS (Thanks to nyxnor!)
• make temporary file be created on tmpdir avoid putitng files on current directory (Thanks to nyxnor!)
• make help message column less then 80 chars (Thanks to nyxnor!)
• source_addr https://github.com/nyxnor/tor-ctrl/issues/32 (Thanks to nyxnor!)
• fix https://github.com/nyxnor/tor-ctrl/issues/31 (Thanks to nyxnor!)

usability-misc:

• fix testing connnection without proxy (Thanks to grass!)
• fix rsync with torsocks (Thanks to grass!)
• fix missing test key (Thanks to grass!)
• fix problem if ws/gw exists and the other counterpart doesn't (Thanks to grass!)
• fix shell completion files to complet (Thanks to grass!)
• fix testing if package is installed (Thanks to grass!)
• add extrace space (Thanks to grass!)
• fix rsync downloads other relevant changes: - fix cmd to check proxy evaluation - better check directory prefix validity (Thanks to grass!)
• improve transfer utility with rsync (Thanks to grass!)
• add rsync as transfer util (unfinished) (Thanks to grass!)
• fix duplication of variable definition Previously was required because the code was not allowing empty var when using set_arg, which happened on the first definition of a variable. (Thanks to grass!)
• add mention about redownload and reimport when booting guest (Thanks to grass!)
• add pledge for reimport (Thanks to grass!)
• add reimport option ability to reimport over existing vms, leads to data loss, requires more warnings. (Thanks to grass!)
• add separate sections to help discern the steps (Thanks to grass!)
• add --redownload (Thanks to grass!)
• fix dialog types comments (Thanks to grass!)
• prefer dialog over whiptail problems with dialogs: - dialog prints empty lines on exit - whiptail does not set default option when scroll text is neeed (Thanks to grass!)
• fix directory prefix by creating directory (Thanks to grass!)
• change default directory prefix (Thanks to grass!)
• fix pre_check problems during dry-run (Thanks to grass!)
• fix pre_check not quitting when there is not enough space (Thanks to grass!)
• skip starting vms if dry-run is set (Thanks to grass!)
• inform which machines are gonna be started (Thanks to grass!)
• improve boot of vms (Thanks to grass!)
• change aborting if vm exists to allow booting vm (Thanks to grass!)
• ask to start/boot guest at the end of the run (Thanks to grass!)
• log verbatim commands (Thanks to grass!)
• dev mode, nested virt detection (Thanks to grass!)
• fix pre_check not quitting when failing (Thanks to grass!)
• do not fail anymore for get_virtualization not needing to handle that anymore as we are not failing if not virtualization available. (Thanks to grass!)
• remove symlinks will be added later by the debian packaging mechanism (Thanks to grass!)
• copyright all files and link to COPYING for all licenses (Thanks to grass!)
• use dh-links instead of hardcoded symlinks
• ignore debian build files (Thanks to grass!)
• simplify credential assignment - portable number generators is hard to find and does not give enough entropy when calling on a loop withing the same second. - date +%N is not portable (Thanks to grass!)
• fix log message in the wrong place (Thanks to grass!)
• make no request if image was already downloaded - requires user to set --guest-version. (Thanks to grass!)
• increase connection timout for first trial (Thanks to grass!)
• reserve curl exit codes and fix curl args (Thanks to grass!)
• enhance vm existence check (Thanks to grass!)
• put filename functionality to manpage (Thanks to grass!)
• fix installer proxy for whonix systems - proxy and credentials were not being set, but whonix users deserver an eascy option to use SOCKS proxy also. - set exit codes for easy of debugging and script parsing automation. (Thanks to grass!)
• improve man page option's description (Thanks to grass!)
• fix man page missing new line (Thanks to grass!)
• create zsh completion script (Thanks to grass!)
• create bash completion script (Thanks to grass!)
• create minimal man page for testing (Thanks to grass!)
• improve installer help message (Thanks to grass!)
• better description of elapsed time (Thanks to grass!)
• nice message to open hypervisor after vm import (Thanks to grass!)
• set dir prefix to an already existing dir ($HOME) (Thanks to grass!)
• fix sed path that has '/' char (Thanks to grass!)
• set download directory via command-line option let the user choose the directory where files will be saved to. (Thanks to grass!)
• fix importation of kicksecure Import was defaulting to two systems, now it defaults to 1 unless whonix is being used. (Thanks to grass!)
• fix downloading only the first file - exec spawns a different process and was giving problems stopping at the first to be downloaded. - fix curl proxy random credentials if not using onion but SOCKS proxy is set. (Thanks to grass!)
• fix urls variables Comments are necessary to keep track of that many url format. A bug was occurring of usign both clearnet and onion urls. (Thanks to grass!)
• fix test_pkg and functions order (Thanks to grass!)
• uncoment essential function (Thanks to grass!)
• distrust version queried from API - check if it is a valid string of only numbers and dot (.). - check if it has less than 12 chars. (Thanks to grass!)
• improve parsing script name and header message - fix set_arg() arg_saved not saving variables correctly - fix parse_name script name parsing - set header info for chosen flavor (Thanks to grass!)
• set options by file name (Thanks to grass!)
• shellcheck fixes (Thanks to grass!)
• move installer-dist to /usr/bin dir (Thanks to grass!)
• merge installer to usability-misc (Thanks to grass!)
• implement dry-run - guards against server partion content transfer with function calls. - run in dry-run mode for debugging, where important commands are printed instead of executed. - check if fasttrack repo is already enabled. (Thanks to grass!)
• initial commit Installer for: - Whonix/Kicksecure - Virtualbox/KVM(unfinished) - CLI/XFCE - onion/clearnet (Thanks to grass!)
• work on whonix-dev-backup

Kicksecure 16.0.8.2

apparmor-profile-torbrowser:

• @{HOME}/.config/ibus/bus/* r, Thanks to @vvoovv for the suggestion! Fixes https://forums.whonix.org/t/cant-type-japanese-only-in-tor-browser/14620/5
• move to format by aa-genproof
• remove `#include <abstractions/totem>` because not available by default to avoid error message during installation

bindp:

• -D_FORTIFY_SOURCE=3

debug-misc:

• systemd

desktop-config-dist:

• fix file name (Thanks to nyxnor!)
• switch Zsh configuration to use config-package-dev method https://forums.whonix.org/t/change-default-shell-from-bash-to-zsh-by-default/14792/74
• renamed: etc/zsh/.aliasrc -> etc/zsh/aliasrc renamed: etc/zsh/.shrc -> etc/zsh/shrc renamed: etc/zsh/.zshrc -> etc/zsh/zshrc renamed: etc/zsh/.zshrc_bindkeys -> etc/zsh/zshrc_bindkeys renamed: etc/zsh/.zshrc_completions -> etc/zsh/zshrc_completions renamed: etc/zsh/.zshrc_prompt -> etc/zsh/zshrc_prompt
• stop setting environment variable ZDOTDIR=/etc/zsh/dist https://forums.whonix.org/t/change-default-shell-from-bash-to-zsh-by-default/14792/74
• /etc/zsh/dist -> /etc/zsh https://forums.whonix.org/t/change-default-shell-from-bash-to-zsh-by-default/14792/74
• renamed: etc/zsh/dist/.aliasrc -> etc/zsh/.aliasrc renamed: etc/zsh/dist/.shrc -> etc/zsh/.shrc renamed: etc/zsh/dist/.zshrc -> etc/zsh/.zshrc renamed: etc/zsh/dist/.zshrc_bindkeys -> etc/zsh/.zshrc_bindkeys renamed: etc/zsh/dist/.zshrc_completions -> etc/zsh/.zshrc_completions renamed: etc/zsh/dist/.zshrc_prompt -> etc/zsh/.zshrc_prompt
• correct shebang (Thanks to nyxnor!)
• fix lightdm compatibility with desktop-config-dist Zsh set `ZDOTDIR=/etc/zsh/dist` environment variable also using `/etc/X11/Xsession.d` mechanism For compatibility with lightdm, the ZDOTDIR environment variable cannot only be set inside: `/usr/lib/systemd/system.conf.d/30_kicksecure-desktop-config-dist-zsh.conf` `export ZDOTDIR=/etc/zsh/dist` https://forums.whonix.org/t/change-default-shell-from-bash-to-zsh-by-default/14792/54
• correct vi cursor type bulletproof method that doesn't require fixing the cursor on external applications (Thanks to nyxnor!)
• merge (Thanks to nyxnor!)
• separate zshrc into small files (Thanks to nyxnor!)
• fix accept enter key to accept tab completion
• forward-word (Thanks to nyxnor!)
• another round of rm whitespaces (Thanks to nyxnor!)
• remove whitespace (Thanks to nyxnor!)
• merge (Thanks to nyxnor!)
• correct zsh POS1 and ENDE keys (Thanks to nyxnor!)
• split into desktop-config-dist and desktop-config-dist-dependencies https://forums.whonix.org/t/change-default-shell-from-bash-to-zsh-by-default/14792
• renamed: usr/lib/systemd/system.conf.d/30_kicksecure.conf -> usr/lib/systemd/system.conf.d/30_kicksecure-desktop-config-dist-zsh.conf
• add zsh files (Thanks to nyxnor!)

developer-meta-files:

• chmod +x
• exclude files from unicode check https://forums.whonix.org/t/detecting-malicious-unicode-in-source-code-and-pull-requests/13754/17
• try higher compression of VirtualBox `.ova` images https://forums.whonix.org/t/allow-us-to-download-the-vm-files-in-a-compressed-format-like-zip-7z-gzip-etc/14210/6
• add scripts to extract all external links from wiki `dm-wiki-to-weblinks` / `dm-file-to-weblinks` / `dm-wiki-link-clean`
• check for unicode before building any packages
• simplify
• move
• remove no longer used round robin mirror_tester since no longer using round robin mirroring
• move
• delete diffp since nowadays replaced by diffoscope
• remove long time unused whonix_build_twice

dist-base-files:

• improve function user_shell_to_zsh
• not set user shell to zsh by default yet due to remaining open issues: https://forums.whonix.org/t/change-default-shell-from-bash-to-zsh-by-default/14792/41
• change default shell from bash to zsh by default https://forums.whonix.org/t/change-default-shell-from-bash-to-zsh-by-default/14792
• Depends: zsh, zsh-syntax-highlighting, zsh-autosuggestions
• addgroup -> adduser fix

genmkfile:

• fix `genmkfile deb-install` if package is already installed
• Depends: rsync
• fix `sudo make install` in case the package contains a `/lib` folder use `rsync` instead of `cp`

grub-live:

• keep grub live boot menu related entries grouped together, instead of having one entry per installed kernel implemented by removing `GRUB_DISABLE_SUBMENU=y` Thanks to @TNT_BOM_BOM for the suggestion! https://forums.whonix.org/t/reduce-numbers-of-grub-live-mode-boot-menu-entries/15710
• fix dracut support

helper-scripts:

• add developer usability helper script dev-adrelanos
• support hushlogin - less output in terminal emulator https://forums.whonix.org/t/support-hushlogin-less-output-in-terminal-emulator/15827
• /usr/libexec/helper-scripts/bashrc-terminal-emulator: fix "return: can only `return' from a function or sourced script" when executed
• add onion-time-pre-script wrapper script
• add tool to save website on web.archive.org `ia-save`
• remove /etc/apparmor.d/usr.sbin.anondate-get / /etc/apparmor.d/usr.sbin.anondate-set since not ready and causing an error message https://forums.whonix.org/t/whonix-apparmor-profiles-development-discussion/108/731 Thanks to @0x1f for the bug report!
• `grep-find-unicode-wrapper` - new helper-script to detect invisible potentially malicious unicode https://forums.whonix.org/t/detecting-malicious-unicode-in-source-code-and-pull-requests/13754

kicksecure-meta-packages:

• `kicksecure-dependencies-cli`: `Depends:` `desktop-config-dist` because `dist-base-files` sets default shell to `zsh` but the zsh configuration folder is shipped by package `desktop-config-dist`. https://forums.whonix.org/t/change-default-shell-from-bash-to-zsh-by-default/14792
• move to kicksecure-desktop-environment-essential-gui desktop-config-dist, desktop-config-dist-dependencies https://forums.whonix.org/t/change-default-shell-from-bash-to-zsh-by-default/14792
• add desktop-config-dist-dependencies https://forums.whonix.org/t/change-default-shell-from-bash-to-zsh-by-default/14792
• fix package name `dummy-dependency-hardened-electrum` -> `dummy-dependency-electrum`
• fix package name `dummy-dependency-hardened-monero-gui` -> `dummy-dependency-monero-gui`
• Install `apparmor-profiles-kicksecure` by default. This results in installing the following packages by default: - apparmor-profiles - apparmor-profiles-extra - apparmor-profile-thunderbird - apparmor-profile-torbrowser - apparmor-profile-hexchat This was implemented by adding `Depends: apparmor-profiles-kicksecure` to package `kicksecure-recommended-cli`. Also provide package `dummy-dependency-apparmor-profiles-kicksecure` as an easy opt-out. https://forums.whonix.org/t/install-apparmor-profiles-apparmor-profiles-extra-apparmor-profiles-kicksecure-by-default/13753
• `apparmor-profiles` and `apparmor-profiles-extra` to `apparmor-profiles-kicksecure` https://forums.whonix.org/t/install-apparmor-profiles-apparmor-profiles-extra-apparmor-profiles-kicksecure-by-default/13753

kicksecure-network-conf:

• add debian install file (generated using "genmkfile debinstfile")
• fix `hostname` showing `localhost.localdomain` instead of `localhost` The hostname is set to `localhost` in `/etc/hostname` already. However, NetworkManager considers that an invalid hostname and therefore changes it. Therefore disable NetworkManager hostname management by setting NetworkManager `hostname-mode=none`. https://forums.whonix.org/t/kicksecure-etc-hostname-etc-hosts/10919

libvirt-dist:

• addgroup -> adduser fix

monero-gui:

• monero-gui-linux-x64-v0.18.1.2.tar.bz2 https://web.archive.org/web/20221003093800/https://github.com/monero-project/monero-gui/releases/tag/v0.18.1.2 https://web.archive.org/web/20221003093801/https://downloads.getmonero.org/gui/monero-gui-linux-x64-v0.18.1.2.tar.bz2 https://web.archive.org/web/20221003093757/https://www.getmonero.org/downloads/hashes.txt
• delete for upcoming update
• monero-gui-linux-x64-v0.18.1.1.tar.bz2 https://web.archive.org/web/20220930110458/https://github.com/monero-project/monero-gui/releases/tag/v0.18.1.1 https://web.archive.org/web/20220930110454/https://downloads.getmonero.org/gui/monero-gui-linux-x64-v0.18.1.1.tar.bz2 https://web.archive.org/web/20220930111404/https://www.getmonero.org/downloads/hashes.txt
• delete for upcoming update
• monero-gui-linux-x64-v0.18.1.0.tar.bz2 https://web.archive.org/web/20220812163722/https://github.com/monero-project/monero-gui/releases/tag/v0.18.1.0 https://web.archive.org/web/20220812195005/https://downloads.getmonero.org/gui/monero-gui-linux-x64-v0.18.1.0.tar.bz2 https://web.archive.org/web/20220814020250/https://www.getmonero.org/downloads/hashes.txt
• delete for upcoming update
• monero-gui-linux-x64-v0.18.0.0.tar.bz2 https://web.archive.org/web/20220716092549/https://github.com/monero-project/monero-gui/releases/tag/v0.18.0.0 https://web.archive.org/web/20220720132340/https://downloads.getmonero.org/gui/monero-gui-linux-x64-v0.18.0.0.tar.bz2 https://web.archive.org/web/20220722163842/https://www.getmonero.org/downloads/hashes.txt
• update maintenance-prepare-new
• delete for upcoming update

sandbox-app-launcher:

• -D_FORTIFY_SOURCE=3
• fix, add `--ro-bind-try /usr/libexec /usr/libexec` https://forums.whonix.org/t/system-wide-sandboxing-framework-sandbox-app-launcher/9008/372
• https://forums.whonix.org/t/delete-disable-nobody-user-from-whonix-passwd/14085
• fix error message if application is not installed
• fix `ERROR: File '/usr/share/sandbox-app-launcher/wrapper-script-wx-wx' does not exist.` Thanks to @TNT_BOM_BOM for the bug report! https://forums.whonix.org/t/system-wide-sandboxing-framework-sandbox-app-launcher/9008/368
• mkdir --parents
• fix `ERROR: File '/usr/share/sandbox-app-launcher/wrapper-script-wx-wx' does not exist.` Thanks to @TNT_BOM_BOM for the bug report! https://forums.whonix.org/t/system-wide-sandboxing-framework-sandbox-app-launcher/9008/368

sdwdate:

• add new securedrop instances + alphabetic
• TLS
• remove 7
• Revert "Update 30_default.conf" This reverts commit f2f62ae7e4ea954773d5aae2be001fe8a76e9bf2.
• Update 30_default.conf Offline removed:

http://potatoynwcg34xyodol6p6hvi5e4xelxdeowsl5t2daxywepub32y7yd.onion/ http://aco6injncogk3siaubyh5sterx7w5pocqdrm7mna7u4wuukscgnqpeid.onion/ http://b52gknakgsyqqeq476oi5nymw6yapysfig4owqgwppi5qpuk4az6bxad.onion/ http://gppg43zz5d2yfuom3yfmxnnokn3zj4mekt55onlng3zs653ty4fio6qd.onion/ http://e2kkexl7exz6rg7fhl4oftkaeojm7wlbw567hqu2tbrjlixsjjoynzad.onion/ http://kogbxf4ysay2qzozmg7ar45ijqmj2vxrwqa4upzqq2i7sqj7wv7wcdqd.onion/ http://ppw2pmtagxykinex6uubypsommtrcg6ytdh6bcr6agq2wxnrweao4cad.onion/ ---- Added TLS: http://dlegal66uj5u2dvcbrev7vv6fjtwnd4moqu7j6jnd42rmbypv3coigyd.onion/ to https://dlegal66uj5u2dvcbrev7vv6fjtwnd4moqu7j6jnd42rmbypv3coigyd.onion/ ---- Added in alphabetical orientation of securedrop onion links similar to securedrop website: (only working links added)

https://securedrop.org/directory/  (Thanks to TNT BOM BOM!)

• sdwdate-log-viewer: include output by timesanitycheck
• improve sdwdate-log-viewer
• -D_FORTIFY_SOURCE=3
• suspend-pre/post: stop/restart both, tor and vanguards systemd unit
• suspend-pre/post: tor@default -> tor
• lower debugging
• suspend-pre/post: improve output in verbose mode
• suspend-post: Delete Tor consensus before restarting Tor. Without this, Tor keeps the stale Tor consensus even after restarting Tor.
• Qubes suspend pre/post: disable restart of Tor This is to work around an upstream bug in Tor. Otherwise Tor circuits might be expired but Tor won't notice it and also Tor control protocol won't report it. https://forums.whonix.org/t/sdwdate-and-sdwdate-gui-development-thread/1137/392
• addgroup -> adduser fix
• simplify main loop counter output message

security-misc:

• Update README.md (Thanks to Raja Grewal!)
• Comment out machine check exception (Thanks to Raja Grewal!)
• addgroup -> adduser fix
• cold-boot-attack-defense wait longer to make messages readable by user
• undo `"force kernel to panic on "oopses"` because implemented differently already https://forums.whonix.org/t/set-oops-panic-kernel-parameter-or-kernel-panic-on-oops-1-sysctl-for-better-security/7713
• force kernel to panic on "oopses" (Thanks to Raja Grewal!)
• update details around disabling SMT (Thanks to Raja Grewal!)
• update SRBDS mitigation (Thanks to Raja Grewal!)
• CPU mitigation - MMIO Stale Data (Thanks to Raja Grewal!)
• CPU mitigation - L1D FLushing (Thanks to Raja Grewal!)
• CPU mitigation - SRBDS (Thanks to Raja Grewal!)
• shuffle and rewording (Thanks to Raja Grewal!)
• Merge branch 'harden' of https://github.com/raja-grewal/security-misc into harden (Thanks to Raja Grewal!)
• delete repeated commands (Thanks to Raja Grewal!)
• enforce default net.ipv6.icmp_ignore_bogus_error_responses (Thanks to Raja Grewal!)
• Merge branch 'Kicksecure:master' into harden (Thanks to Raja Grewal!)
• Corrected kerenl module disabling (Thanks to Raja Grewal!)
• Update README.md (Thanks to Raja Grewal!)
• Revert "enforce defualt net.ipv4.ip_forward" This reverts commit 57b5b2145c4e6779f0b879ee4199d46938f20965. (Thanks to Raja Grewal!)
• enforce of IOMMU TLB invalidation (Thanks to Raja Grewal!)
• disables random.trust_bootloader (Thanks to Raja Grewal!)
• add reference (Thanks to Raja Grewal!)
• enable randomize_kstack_offset (Thanks to Raja Grewal!)
• disable slub_debug (Thanks to Raja Grewal!)
• enforce defualt net.ipv4.ip_forward (Thanks to Raja Grewal!)
• enforce default net.ipv4.icmp_ignore_bogus_error_responses (Thanks to Raja Grewal!)
• enforce default kernel.randomize_va_space (Thanks to Raja Grewal!)
• Updated README.md (Thanks to Raja Grewal!)
• More verbose kernel module blocking error logs (Thanks to Raja Grewal!)
• Updated comments (Thanks to Raja Grewal!)
• Blacklist automatic loading of CD-ROM modules (Thanks to Raja Grewal!)
• Incorporated Ubuntu’s kernel module blacklists (Thanks to Raja Grewal!)
• renamed: usr/bin/disabled-by-security-misc -> bin/disabled-by-security-misc
• not blacklist CD-ROM / DVD yet https://forums.whonix.org/t/blacklist-more-kernel-modules-to-reduce-attack-surface/7989/31
• replace /bin/false -> /bin/disabled-by-security-misc (Thanks to Raja Grewal!)
• Updated descriptions of disabled modules (Thanks to Raja Grewal!)
• Revert "replace /bin/false -> /bin/true" This reverts commit f0511635a9725f79863c41a7b8d9f8a077ba8788. (Thanks to Raja Grewal!)
• Update README.md (Thanks to raja-grewal!)
• replace /bin/false -> /bin/true (Thanks to raja-grewal!)
• Blacklist more modules (Thanks to raja-grewal!)
• add `/etc/default/grub.d/40_cold_boot_attack_defense.cfg`
• Update hide-hardware-info (Thanks to Krish-sysadmin!)
• drop_caches before and after sdmem
• sync
• wipe RAM at shutdown: Ensure any remaining disk cache is erased by Linux' memory poisoning by running: `echo 3 > /proc/sys/vm/drop_caches` Inspired by Tails: https://gitlab.tails.boum.org/tails/tails/-/blob/master/config/chroot_local-includes/usr/local/lib/initramfs-pre-shutdown-hook
• improvement
• - introduce `wiperam=skip` kernel parameter to skip wipe ram - introduce `wiperam=force` kernel parameter to force wipe ram inside VMs
• improvement
• skip ram wipe inside VMs https://forums.whonix.org/t/is-ram-wipe-possible-inside-whonix-cold-boot-attack-defense/5596/40
• undo
• improvement
• credits
• update file names
• move
• improvements
• do not power off too fast so wipe ram messages can be read
• delete no longer required `usr/lib/dracut/modules.d/40sdmem-security-misc/README.md`
• improvements
• ram wipe on shutdown: fix, added `need_shutdown` hook Otherwise dracut does not run on shutdown. Without `need_shutdown` file `/run/initramfs/.need_shutdown` does not get created. And without that file `/usr/lib/dracut/dracut-initramfs-restore`, which itself is started by `/lib/systemd/system/dracut-shutdown.service` does nothing.
• verbose
• improvements
• improve usr/lib/dracut/modules.d/40sdmem-security-misc/module-setup.sh
• add shebang /bin/sh to fix lintian warning security-misc: executable-not-elf-or-script usr/lib/dracut/modules.d/40sdmem-security-misc/wipe.sh
• - Wipe LUKS Disk Encryption Key for Root Disk from RAM during Shutdown to defeat Cold Boot Attacks - Confirm in console output if encrypted mounts (root disk) is unmounted. (Because that is a pre-condition for wiping the LUKS full disk encryption key from RAM.) Thanks to @friedy10! https://github.com/friedy10/dracut/tree/master/modules.d/40sdmem https://forums.whonix.org/t/is-ram-wipe-possible-inside-whonix-cold-boot-attack-defense/5596

systemcheck:

• https://forums.kicksecure.com/t/failure-update-system-addgroup-addgroup-with-two-arguments-is-an-unspecified-operation/88
• /usr/libexec/helper-scripts/curl_exit_codes rix,
• Tor connectivity test: add output of `onion-time-pre-script`
• AppArmor actually do not allow /usr/local/lib/python*/ https://forums.whonix.org/t/sdwdate-suddenly-dies/14150
• AppArmor: /usr/local/lib/python*/** mr, https://forums.whonix.org/t/sdwdate-suddenly-dies/14150/2
• report if /var/lib/systemcheck/.msgcollector/msgdispatcher-error.log exists
• report if /run/systemcheck/.msgcollector/msgdispatcher-error.log exists
• improve Tor running check error message

tb-starter:

• undo /rw changes https://forums.whonix.org/t/rw-config-versus-usr-local-etc/15621
• move /rw/config as the last dir to be sourced (Thanks to nyxnor!)
• add tb_no_start to man (Thanks to nyxnor!)
• fail early with tb_no_start and add info message https://forums.whonix.org/t/inform-user-that-torbrowser-wont-start/15298/5 (Thanks to nyxnor!)

tb-updater:

• tbb_hardcoded_version="11.5.4"
• alpha tbb_hardcoded_version="11.5.2"
• alpha tbb_hardcoded_version="12.0a2"
• tbb_hardcoded_version="11.5.2"
• chroot
• improve Tor Browser ARM64 connectivity check
• alpha tbb_hardcoded_version="12.0a1"
• fix --reset
• tbb_hardcoded_version="11.5.1"
• clean up deprecated tbb_hardened_version_chosen
• fix --reset
• tbb_hardcoded_version="11.5"
• Rename --update-only to --only-if-newer. As suggested by @adrelanos in https://github.com/Kicksecure/tb-updater/pull/18#issuecomment-1186157912 (Thanks to irykoon!)
• Support --update-only flag. When the Tor Browser is already up-to-date, the current tb-updater will still ask users if they want to download and reinstall it. With this `--update-only` flag turned on, the tb-updater will exit with a message like "Skip downloading: current Tor Browser 11.5 is already up-to-date". This flag is especially useful when tb-updater is run regularly to keep the Tor Browser up-to-date because it saves user from spending time and resources downloading an already up-to-date Tor Browser. (Thanks to irykoon!)
• implement `--reset` to allow a hard reset of Tor Browser https://www.whonix.org/wiki/Tor_Browser/Advanced_Users#Tor_Browser_Hard_Reset https://forums.whonix.org/t/tor-browser-downloader-anondist-suggestion/14151 Thanks to @anonhelp for the suggestion!
• implement opt-in `TB_NO_CLEANUP=true`, which if set, skips deletion of downloaded Tor Browser tarballs
• debug
• update Tor Browser arm64 maintainer signing key https://forums.whonix.org/t/arm64-tor-browser-maintainer/11786/7
• alpha tbb_hardcoded_version="11.5a13"
• tbb_hardcoded_version="11.0.15"
• Increase Tor Browser size limit to 200 MiB About to be released 11.5a13 exceeded this limit. See https://dist.torproject.org/torbrowser/11.5a13/ (Thanks to Peter Gerber!)

usability-misc:

• apt-get-noninteractive / dpkg-noninteractive: `export NEEDRESTART_MODE="l"`

vm-config-dist:

• addgroup -> adduser fix

derivative-maker:

• Create seperate build process for commits and tags (Thanks to Rob Stringer!)
• remove trailing whitespace
• Add automated_builder ansible suite to CI (Thanks to Rob Stringer!)
• additionally download virtualbox-guest-additions-iso from Debian sid
• introduce variable binary_image_ovf
• skip_name_list="pts dev proc sys hostname resolv.conf hosts hostname"
• skip checking non-existing file system objects (file, folders) for stray processes still running inside the chroot
• skip /proc /dev /sys checking for still running processes inside chroot No useful debug information.
• more defensive unmount
• check for stray mounts
• check for stray loop devices
• improve umount_kill.sh
• dist_build_script_build_dependency+=" coreutils " required by help-steps/umount_kill.sh, provides 'realpath'
• add lsof to build script dependencies required by help-steps/umount_kill.sh
• root
• unicode
• install developer-meta-files locally on build machine because it provides dm-reprepro-wrapper
• apt-get-noninteractive
• improve root check
• run build script as user and only run commands as root with sudo when required using `$SUDO_TO_ROOT` (as opposed to previously using `$SUDO_TO_USER`) refactoring part 2 https://forums.kicksecure.com/t/derivative-maker-build-script-running-as-user-versus-root-versus-sudo-design/76
• addgroup -> adduser fix
• addgroup -> adduser fix
• `export SOURCE_DATE_EPOCH` towards reproducible builds
• run build script as user and only run commands as root with sudo when required using `$SUDO_TO_ROOT` (as opposed to previously using `$SUDO_TO_USER`) refactoring part 1 https://forums.kicksecure.com/t/derivative-maker-build-script-running-as-user-versus-root-versus-sudo-design/76
• towards Kicksecure ISO
• check source code of derivative-maker and packages in the derivative-maker packages folder for unicode before building https://forums.whonix.org/t/detecting-malicious-unicode-in-source-code-and-pull-requests/13754 Thanks to @TNT_BOM_BOM for the report!
• dracut
• dracut
• dracut
• dracut
• dracut
• dracut
• dracut

Kicksecure 16.0.5.3

TODO:

Kicksecure 16.0.5.0

anon-connection-wizard:

• update default bridges

dist-base-files:

• Update motd copyright year It's still outdated in various other files (both website and packages), but with this fix users will be greeted on the terminal with the correct copyright info. (Thanks to Andrea Varesio!)

genmkfile:

• variables

helper-scripts:

• rewrite usr/libexec/helper-scripts/repair_torrc.py in bash usr/libexec/helper-scripts/repair-torrc
• Hardened Malloc Original was renamed to Hardened Malloc Default

kicksecure-meta-packages:

• add iotop to kicksecure-recommended-cli

monero-gui:

• monero-gui-linux-x64-v0.17.3.2.tar.bz2 https://web.archive.org/web/20220501150445/https://github.com/monero-project/monero-gui/releases/tag/v0.17.3.2 https://web.archive.org/web/20220430025141/https://downloads.getmonero.org/gui/monero-gui-linux-x64-v0.17.3.2.tar.bz2 https://web.archive.org/web/20220525112107/https://www.getmonero.org/downloads/hashes.txt
• new file: maintenance-prepare-new not part of package being built
• new file: maintenance-delete-old not part of package being built
• delete for upcoming update

msgcollector:

• fix warning "tb_updater_gui:141: DeprecationWarning: an integer is required (got type float)" Thanks to TNT_BOM_BOM for the bug report! https://forums.whonix.org/t/tb-updater-gui-deprecationwarning-an-integer-is-required-got-type-float/13706
• fix for DeprecationWarning: an integer is required (got type float). Implicit conversion to integers using __int__ is deprecated, and may be removed in a future version of Python.

repository-dist:

• remove deprecated legacy parameter `--refresh-keys`
• fix, restore usage information if no parameters are given
• default to plain-tls-tor https://forums.whonix.org/t/tool-to-onionize-all-apt-sources/13367/28
• single file to be changed (Thanks to nyxnor!)
• whonix double repo parse Signed-off-by: nyxnor <nyxnor@protonmail.com> (Thanks to nyxnor!)
• autodetect OS; block kicksecure from enabling whonix repo Signed-off-by: nyxnor <nyxnor@protonmail.com> (Thanks to nyxnor!)
• add transports (Thanks to nyxnor!)

sdwdate:

• fix, add to systemd SystemCallFilter mremap prctl
• Update 30_default.conf (Thanks to TNT BOM BOM!)
• Update 30_default.conf (Thanks to TNT BOM BOM!)
• onion-tester maintenance script: no longer create file in working directory terminal output only
• Fix syscall whitelist for Python 3.10.x on PowerPC Necessary for Debian Sid ppc64 and ppc64el. I have no idea whether a similar change is needed on x86 or ARM. Also no idea what attack surface is introduced by that syscall. (Thanks to Jeremy Rand!)
• AppArmor: explicitly allow network access Fixes https://forums.whonix.org/t/sdwdate-apparmor-profile-broken-on-bookworm/13521 (Thanks to Jeremy Rand!)
• Fix syscall whitelist for bookworm on ppc64el Both added syscalls were already whitelisted for ARM. It's not obvious to me why they only started mattering for ppc64el on Bookworm and higher (Bullseye unaffected), but seems worth fixing. (Thanks to Jeremy Rand!)
• lower debugging

security-misc:

• hide-hardware-info: disable selinux whitelist by default (Thanks to 0xC0ncord!)
• hide-hardware-info: make indentation consistent (Thanks to 0xC0ncord!)
• hide-hardware-info: re-enable restrictions on sysfs when using SELinux When using SELinux, restrict the parts of sysfs explicitly to ensure restrictions are working as expected. (Thanks to 0xC0ncord!)

setup-dist:

• prevent eventual autostart in future Qubes versions

setup-wizard-dist:

• fix: do not autostart in Kicksecure for Qubes

systemcheck:

• Hardened Malloc Original was renamed to Hardened Malloc Default
• Hardened Malloc Original was renamed to Hardened Malloc Full
• fix check journal if journal is longer then operating system ARG_MAX limit

tb-updater:

• alpha tbb_hardcoded_version="11.5a11"
• tbb_hardcoded_version="11.0.13"
• tbb_hardcoded_version="11.0.7"

timesanitycheck:

• update usr/share/timesanitycheck/minimum_unixtime

tor-control-panel:

• update default bridges
• remove tor-control-panel.service since running repair-torrc does not belong into this package

tor-ctrl:

• improve usage and less repeated code https://github.com/nyxnor/tor-ctrl/issues/27 (Thanks to nyxnor!)
• explain which socket failed and which worked https://github.com/nyxnor/tor-ctrl/issues/27 (Thanks to nyxnor!)
• sort socket per tor system https://github.com/nyxnor/tor-ctrl/issues/27 (Thanks to nyxnor!)
• var: don't compare integers, compare if empty or not (Thanks to nyxnor!)
• enhance socket selection https://github.com/nyxnor/tor-ctrl/issues/27 (Thanks to nyxnor!)
• sort socket per tor system https://github.com/nyxnor/tor-ctrl/issues/27 (Thanks to nyxnor!)
• info about which socket it connected https://github.com/nyxnor/tor-ctrl/issues/27 (Thanks to nyxnor!)
• try TBB socket and env var till finding something https://github.com/nyxnor/tor-ctrl/issues/27 (Thanks to nyxnor!)
• do not ommit exits from normal streams (Thanks to nyxnor!)
• make less connections to the controller when possible (Thanks to nyxnor!)
• fix duplicate https://github.com/nyxnor/tor-ctrl/issues/28 (Thanks to nyxnor!)
• tor-ctrl-observer https://github.com/nyxnor/tor-ctrl/issues/28 (Thanks to nyxnor!)
• misc (Thanks to nyxnor!)
• the typo https://github.com/nyxnor/tor-ctrl/issues/30 (Thanks to nyxnor!)
• the typo https://github.com/nyxnor/tor-ctrl/issues/30 (Thanks to nyxnor!)
• do no share circuits on public forums https://github.com/nyxnor/tor-ctrl/issues/30 (Thanks to nyxnor!)
• shellcheck (Thanks to nyxnor!)
• fi https://github.com/nyxnor/tor-ctrl/issues/26 (Thanks to nyxnor!)
• restore also from file, not just folders https://github.com/nyxnor/tor-ctrl/issues/26 (Thanks to nyxnor!)
• restore from a singe file https://github.com/nyxnor/tor-ctrl/issues/26 (Thanks to nyxnor!)
• finish permanent mode https://github.com/nyxnor/tor-ctrl/issues/26 (Thanks to nyxnor!)
• fix return carriage https://github.com/nyxnor/tor-ctrl/issues/26 (Thanks to nyxnor!)
• fix return carriage https://github.com/nyxnor/tor-ctrl/issues/26 (Thanks to nyxnor!)
• small fixes to permanent mode (Thanks to nyxnor!)
• introducing permanent onion mode https://github.com/nyxnor/tor-ctrl/issues/26 (Thanks to nyxnor!)
• don't print exits on stream private mode https://github.com/nyxnor/tor-ctrl/issues/28 (Thanks to nyxnor!)
• fix again 250 hide https://github.com/nyxnor/tor-ctrl/issues/28 (Thanks to nyxnor!)
• fix ^250 (Thanks to nyxnor!)
• tone down warning on private mode https://github.com/nyxnor/tor-ctrl/issues/28 (Thanks to nyxnor!)
• remove DIR_FETCH from private tor-ctrl-stream https://github.com/nyxnor/tor-ctrl/issues/28 (Thanks to nyxnor!)
• small changes to -onion (Thanks to nyxnor!)
• add TBB instructions fix https://github.com/nyxnor/tor-ctrl/issues/27 (Thanks to nyxnor!)
• fix tor-ctrl-onion port arg (Thanks to nyxnor!)
• grep fixed strings where to avoid problems with ipv6 relays (Thanks to nyxnor!)
• invert hostname order (Thanks to nyxnor!)
• grep fixed string to not fail on [] fix https://github.com/nyxnor/tor-ctrl/issues/25 (Thanks to nyxnor!)
• add tor as a dependency as we use --verify-config (Thanks to nyxnor!)
• configure.sh (Thanks to nyxnor!)
• add newline (Thanks to nyxnor!)
• make streams without circuits cleaner (Thanks to nyxnor!)
• onion hostname is only lower-case (Thanks to nyxnor!)
• fix max stream close circuit (Thanks to nyxnor!)
• fix tor-ctrl-onion max streams (Thanks to nyxnor!)
• add nonanonymous and maxtreams for tor-ctrl-onion https://github.com/nyxnor/tor-ctrl/issues/17 (Thanks to nyxnor!)
• add ONION_CLIENT_AUTH_{ADD,REMOVE,VIEW} to tor-ctrl-onion https://github.com/nyxnor/tor-ctrl/issues/24 and https://github.com/nyxnor/tor-ctrl/issues/17 (Thanks to nyxnor!)
• remove shift from getopts (Thanks to nyxnor!)
• check if tor-ctrl is installed to use secondary scripts (Thanks to nyxnor!)
• fix V3Auth (Thanks to nyxnor!)
• initial tor-ctrl-onion https://github.com/nyxnor/tor-ctrl/issues/17 (Thanks to nyxnor!)
• fix double quoting (Thanks to nyxnor!)
• fix https://github.com/nyxnor/tor-ctrl/issues/21 (Thanks to nyxnor!)
• move hostname to inside () fix for https://github.com/nyxnor/tor-ctrl/issues/22 (Thanks to nyxnor!)
• fix catting no file for the first run fix for https://github.com/nyxnor/tor-ctrl/issues/22 (Thanks to nyxnor!)
• saving hostname to a temporary file fix https://github.com/nyxnor/tor-ctrl/issues/22 (Thanks to nyxnor!)
• save strean information as soon as client tried to connect "SENTCONNECT" / ; Sent a connect cell along a circuit "SENTRESOLVE" / ; Sent a resolve cell along a circuit Now, stream does not need to succeed or be closed, it is better this way cause we can see all tried connections/resolves (Thanks to nyxnor!)
• add stream purpose (Thanks to nyxnor!)
• even if the stream does not close, print it SUCCEEDED does not appear on stream NEWRESOLVE that is for DNS_REQUEST, so we need to keep the CLOSED option but in the case it has SUCCEEDED to connect but not closed yet, still print it (Thanks to nyxnor!)
• print stream ordered by number fix https://github.com/nyxnor/tor-ctrl/issues/23 (Thanks to nyxnor!)
• fix tor-ctrl-stream listening to torscosk requests https://github.com/nyxnor/tor-ctrl/issues/22 (Thanks to nyxnor!)
• add machine mode (default not set), this means info messages will be printed by default https://github.com/nyxnor/tor-ctrl/issues/19 (Thanks to nyxnor!)
• just attempt to install highest package version from parent directory (Thanks to nyxnor!)
• --no-sign package on configure.sh I presume whonix automated script takes care of this for signing new releases without depending on this custom script (Thanks to nyxnor!)
• fix sending empty line has two or more consecutives \n \n this occurs if there is a user made typo, just avoid it (Thanks to nyxnor!)
• don't attempt to sign package from readme instructions if not signed, error code is 25,lets use flag --no-sign so error code is zero and not red alarming on the screen (Thanks to nyxnor!)
• fix bold header on tor-ctrl-stream (Thanks to nyxnor!)
• update manuals (Thanks to nyxnor!)
• format text to left and numbers to right (Thanks to nyxnor!)
• fix tor-ctrl-stream trap signal https://github.com/nyxnor/tor-ctrl/issues/18 (Thanks to nyxnor!)
• tor-ctrl-stream prints whole stream without format first fix https://github.com/nyxnor/tor-ctrl/issues/18 (Thanks to nyxnor!)
• fix https://github.com/nyxnor/tor-ctrl/issues/15. Print bandwidth and contry for circuits (Thanks to nyxnor!)
• add deb option to configure.sh and make .gitignore pattern more broad (Thanks to nyxnor!)
• readme' (Thanks to nyxnor!)
• typo readme (Thanks to nyxnor!)
• update readme about sharing private info (Thanks to nyxnor!)
• 'tor-ctrl -w' quits with INT and 'tor-ctrl-stream' resumes with INT. Closes https://github.com/nyxnor/tor-ctrl/issues/13 (Thanks to nyxnor!)
• add shellcheck option in configure.sh (Thanks to nyxnor!)
• update docs (Thanks to nyxnor!)
• add dot files (Thanks to nyxnor!)

vm-config-dist:

• variables