Merge branch 'master' of git://git.tails.boum.org/tails
Merge branch 'master' of git://git.tails.boum.org/tails

Conflicts:
	wiki/src/press.mdwn
Install Linux 3.14-2 (ABI bumped) from sid.
Fix condition clause in tails-security-check (Closes: #7657).

Without this fix: the condition clause always returns true; so, as long as an
entry in the Atom feed has at least one category assigned, the is_not_fixed
function returns false, and no notification for this entry is displayed.
Install gnome-user-guide (Closes: #7618).
Install cups-pk-helper (Closes: #7636).
Merge branch 'feature/linux-3.14-2' into stable
Merge remote-tracking branch 'origin/master' into stable
Disable runtime APT proxy configuration when using APT in binary_local-hooks (Closes: #7691).

If we don't do this, APT can't download lists from the Internet. And then, in
some situations, it lacks the information needed to install dpkg-dev. I'm not
sure why it can even work in some other cases, but in any case, this hook
makes oh so much sense to me with this modification.
Compress the SquashFS more aggressively (Closes: #7706).

In my tests on current experimental branch, this makes the ISO 10% smaller, but
makes the build take 63% more (real) time, and eat 110% more (user) CPU time.
It seems worth it for released ISO images.

Likely, most developers that didn't do it yet will now set
MKSQUASHFS_OPTIONS='-comp gzip' when doing their regular builds... although the
time gained by gzip (vs. aggressive xz) at build time is compensated, in many
cases, by faster IO (e.g. when copying the ISO out of the build VM, when booting
the ISO, when installing the ISO on a USB stick).
Prevent dhclient from sending the hostname over the network (Closes: #7688).

First, we have to use the "keyfile" NetworkManager plugin only; that is, we
disable the "ifupdown" one:

  * it's needed, because the only the "keyfile" plugin supports setting
    dhcp-send-hostname to false, while the "ifupdown" plugin retrieves the
    hostname to send from /etc/hostname;
  * it's OK, because we actually don't use the functionality provided by the
    "ifupdown" plugin (that is, reading from /etc/network/interfaces -- that
    only configures the loopback connection in Tails, which is itself ignored by
    NetworkManager anyway).

Second, we configure the NetworkManager "keyfile" plugin to *not* send the
hostname over DHCP by default. Likely this can be overridden on
a per-connection basis.

Third, we tell dhclient itself not to send the hostname. This is needed because
NetworkManager runs dhclient with the `-cf /var/run/nm-dhclient-eth0.conf`
option, and generates that file by concatenating `/etc/dhcp/dhclient.conf`
with its own settings.
Add an I2P boot parameter

During the build process, the following are moved to /usr/share/tails:
  - /usr/share/i2p
  - /usr/sbin/wrapper to /usr/share/tails/i2p
  - /usr/share/applications/i2p.desktop to /usr/share/tails/i2p

The I2P binaries are changed to be owned by i2psvc:i2psvc to prevent it
being run from the new location under /usr/share/tails/i2p.

If the string 'i2p' is entered on at the boot prompt, these files are
returned to ther original locations, making I2P accessible. Also, the
I2P sudoers file is written to the system, allowing the amnesia user to
run tails-start-i2p as the i2psvc user.
stricter I2P fw rules

This commit will:
- deny I2P from accessing the LAN
- deny I2P from accessing the loopback device, except for select
  whitelisted services
- allow I2P access to the Internet

The ACCEPT rules will only be enabled when the string 'i2p' is passed at
the boot prompt.

The rules which DENY or REJECT access for the 'i2psvc' user will always
be applied.
disable I2P plugins

Plugins for I2P--without using persistence--don't make much sense.
A default of 'disable' here may also eliminate a possible attack vector.

I know of some Tails users that use I2P-Bote, a mail-like application
available as an I2P plugin, and they manually enable persistence for
I2P. A user that is able to manually enable persistence can easily
re-enable plugin support, if desired.
I2P: Keep POP3 email on server

The default in the I2P webmail app was to keep mail on the server, but
that setting was changed recently.

This configuration setting (susimail.config) will only be copied over in
I2P 0.9.14 and newer.
Merge branch 'bugfix/7618-gnome-help' into stable
Merge remote-tracking branch 'origin/bugfix/7636-printers-configuration' into stable
Merge remote-tracking branch 'origin/master' into stable
Automatically test hostname leaks (Closes: #7712).
Write design doc wrt. not leaking hostname over DHCP.