-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 == Date == This release was made the 26 August 2022 by Denis 'GNUtoo' Carikli. == Introduction == At the time of writing, Trisquel 9 (etiona) is the only GNU/Linux distribution compliant with the Free System Distribution Guidelines (FSDG) that can build Replicant 6.0. It however requires Java-8 to build Replicant 6.0, and when using update-alternatives to switch to java 8 globally, proguard which is also needed to build Replicant stops working because it was built for Java 11. So we provide various ways to install the fix until it is fixed in Trisquel 9 (etiona): - - you can install the proguard shell wrapper in /usr/bin/ (as the Replicant build system expects it to be there). - - You can install the proguard packages that were modified to use Java 11 instead of the default Java which is set to Java 8 when building Replicant. == How to verify this release == It's a good practice to verify software releases. It enables to detect corrupted downloads and sometimes even attacks[1]. All the technical information needed to verify the tarball is included in this file. This way, all the important information like the release date, how to build and install it and so on is also authenticated. Without that, an attacker can also rename an older release that has been signed by the same person and make people think that it's the new release. That could be an issue if one day security issues are found in older releases. To do that you first need to download the GPG key of the person that prepared the release: gpg --keyserver keys.gnupg.net --recv-key \ FB31DBA3AB8DB76A4157329F7651568F80374459 You then need to verify this README file with the following command: gpg --verify README.txt It should says "Good signature", and look similar to this output: gpg: Signature made jeu. 28 janv. 2021 12:38:15 CET gpg: using RSA key 782F9DDBE36BA7F3D4DE49065F5DFCC14177E263 gpg: Good signature from "Denis 'GNUtoo' Carikli " [undefined] gpg: WARNING: This key is not certified with a trusted signature! gpg: There is no indication that the signature belongs to the owner. Once this is done you can verify the released archive. As this file (README.txt) contains a checksum at the end, you can simply run this command to check the tarball: sha512sum -c --ignore-missing README.txt It should then say "OK", and the output will be somewhat similar to this one: package-helpers.tar.xz: OK proguard: OK proguard_6.0.1-2+9.0trisquel1_all.deb: OK proguard_6.0.1-2+9.0trisquel1_amd64.buildinfo: OK proguard_6.0.1-2+9.0trisquel1_amd64.changes: OK proguard_6.0.1-2+9.0trisquel1.dsc: OK proguard_6.0.1-2+9.0trisquel1.tar.gz: OK proguard-cli_6.0.1-2+9.0trisquel1_all.deb: OK proguard-gui_6.0.1-2+9.0trisquel1_all.deb: OK sha512sum: WARNING: 106 lines are improperly formatted References: - ----------- [1]https://www.leviathansecurity.com/blog/the-case-of-the-modified-binaries/ == Installation == To install the proguard packages, you can simply run the following commands: sudo apt install proguard dpkg -i 9.0trisquel1_all.deb proguard-cli_6.0.1-2+9.0trisquel1_all.deb \ proguard-gui_6.0.1-2+9.0trisquel1_all.deb Instead if you want to install the fix temporarily without having to install and/or review the packages yourself you can simply use the following command: sudo install -m 755 proguard -t /usr/bin/ == How was packages were made == The tarball was made with a Trisquel 9 (etiona) virtual machine, on an x86_64 computer with the following commands in the package-helpers directory: cd helpers bash make-proguard BUILDDIST=etiona BUILDARCH=amd64 pbuilder build PACKAGES/proguard/*.dsc The source of the package helpers can either be found in the package-helpers.tar.xz tarball or at the following URL: https://git.replicant.us/contrib/GNUtoo/infrastructure/trisquel-package-helpers/ As this release is only meant to be temporary the URL above may change. In addition, a tarball with the patches (patches.tar.xz) is also provided, and it was made with the following commands: tar cf patches.tar $(git format-patch db7fa33) xz -9e patches.tar They are to be applied on the following commit: commit db7fa33f3cf9b7a74c4dd482d20d4bc414f791f7 Author: Ruben Rodriguez Date: Fri Aug 20 17:44:55 2021 -0400 Abrowser: updates for v91, new process-json-files.py == Checksums == bdd4ec81bf7e2fbaf41985fd4c25f681f85bc02adba173e585b534cbc064b339b7dbda34cd4ac6acb778f45fb1332ec52b25285d294a6f27d59a89356ad38201 package-helpers.tar.xz d331ed7cc9120b2280ce872d7df5ecf6027a506e8e62eb3ce3716831c9256b832407408d16705badb2690f6b05310608e4a0e0adc3f1fd53704203c991539fad proguard fb64bf19b3e329ae0f1589672910f27e1062613f6ac9b44a71a360728971025c586fb8f58d0db5dcdf8c8870ea49f50954c560ef5418af3e81849c6ead6d89d2 proguard_6.0.1-2+9.0trisquel1_all.deb 31e15fb79f28d569405c1047c8093c681832e29ac5058fe9900e0f44a7f9ab841f93d830ff334a492d02e784ee876ae5ceeba3f0b23f43346816c0293eddcf8d proguard_6.0.1-2+9.0trisquel1_amd64.buildinfo dd0dab207779a83aff1756e5e97d525632138a06b072a464cf32a1321f2bd59810c330e341c0478d4e1ee8e5ff59c79d7a17d36231695449020cb324e8d12a91 proguard_6.0.1-2+9.0trisquel1_amd64.changes 7148eed89ded3577aa3b566fa3389fa79a821a80eb2018645b84d1e2e814c6e794717cc1c0873f3a034a3b7a4767546f43657c5cd3976eedf9b3d79f76a43c29 proguard_6.0.1-2+9.0trisquel1.dsc 8cc8b8db7a8b93fdd0a77e47a1a09f55435f07b556def1294e921132390063a2c317a27bcd13c78e68c7817a8bb06037998151babcd83817a86913dc7fd647d9 proguard_6.0.1-2+9.0trisquel1.tar.gz 9f6982ff81a31f53574dd074ef41ee18404ab343a79d06f929efbd2f600e49b5fae37e09622ef89c58ce860e52be4d3896d5684a765565577e98cd44f063006c proguard-cli_6.0.1-2+9.0trisquel1_all.deb 28b718d8f1b8ad933845af60ad3d29acae6e498b043ffb129583ead9d320fe340fce7030f332ddd3441bdfcbec43bd882ba6cac19d6cbd24cb678512d9956c55 proguard-gui_6.0.1-2+9.0trisquel1_all.deb 40b11fa6e945821efc89f251264f0e92feef236a28a1f1a1e224857472a994ddbac3089ccc365339d35fc2918a4a808e3ab552de430520da64bea969fc1fc3ac patches.tar.xz -----BEGIN PGP SIGNATURE----- iQIzBAEBCAAdFiEEeC+d2+Nrp/PU3kkGX138wUF34mMFAmEmv0AACgkQX138wUF3 4mPD5xAAmBRu0ddKUqV74ONEXlSB5/tZuU+vCPCLGMB4C4uUIsRbI9g4mEbgvvGz kH/U0sEwm1k/JS690r8k6inU2GFqz3WiYvD0m146Q5ClAL7cy/Ssp0OygGnGyvFe 52l5sA81WM6rr6rJQ1SL8+9HgfalQ9gqxB6e6Bb6m6Pd8ew2TTmI64UhU4iVdkfQ g9/+7O0sA6JNB5K3JyV3cc7OikF9C9KbyHjzUunB3fyCB4ug5UHKiI0rSsRwa3hz YOdpe/zoB09qt+I29Et09nk98DFhNRRZ7+XvUUUzktP+JXs8jw5TsSk5KW5yEBBd ALKB6nfMgwIXj3Xc/wun05JV4kuff0QMeh+2km1TOVNE4UUUaMz6lhRnfZRcOiAu CZcvkXnkDdA+7RhvxK5ZH4Vm0Dgn+JdDtAkclnZuE5pw3hhjkKa2z78QP223gPNi 1t0cRbz/mF3U41aVlefGwOEXBijKQ+0uH6jljv2graQkJl6hGnY+3lkI2Nl1yyDP 3Rk+fvP+d9sAwZEbBEscM+OU75+gFj+17G3XKv5f2Gj9lf17jUNHq0NktS50ZmsI iFnQhZ0iCTKUQ1S2tLj2IcwMaynWvTo0MbEC2jRH+JAiPGaefNnjkuE1V4YimOk+ 9TxcBrRIao7WKVn6fq1ACcF6reRGYqqOTevPD/WjI+Xiv14vNwY= =gDse -----END PGP SIGNATURE-----