commit 13b9058a20af5e462ddd02a37b8715b39315c2b6
Merge: 991243e 20deb2e
Author: Patrick Schleizer <adrelanos@whonix.org>
Date:   Fri Jul 31 13:19:29 2026 -0400

    Merge remote-tracking branch 'refs/remotes/org-ai-assisted/master'

commit 20deb2ecfffaed678bde822113d75c025988cf7f
Merge: 991243e 0db850b
Author: assisted-by-ai (Bot Account) (Machine Account) <228987186+assisted-by-ai@users.noreply.github.com>
Date:   Fri Jul 31 10:07:51 2026 -0400

    Merge pull request #13 from org-ai-assisted/ai

    consumer-claude-code: mention-only triggers; gate the firewall test jobs on CI_ENABLED_ORG_AI_ASSISTED

commit 0db850b74834e536a1b93f3ebf4c9f7548d8627e
Merge: f0a2509 1a18bcf
Author: claude (dev138 9b889944-0a22-45e7-8fd6-c189113e33b9) <noreply@anthropic.com>
Date:   Fri Jul 31 09:35:29 2026 -0400

    Merge remote-tracking branch 'org-ai-assisted/ai' into ai

commit f0a2509b666d5eb496cf9f37ece5aad139434f93
Author: claude (dev138 9b889944-0a22-45e7-8fd6-c189113e33b9) <noreply@anthropic.com>
Date:   Fri Jul 31 09:33:13 2026 -0400

    ci: gate the local workflows on CI_ENABLED_ORG_AI_ASSISTED

    Our workflows ran wherever the branch landed. Merged upstream they burn
    Kicksecure/Whonix runner quota and post our CI into repos that never
    asked for it; on a contributor fork they run the whole suite unbidden.
    Only 5 of 136 workflow files across the fleet carried any owner gate.

    Gate: a job-level `vars.CI_ENABLED_ORG_AI_ASSISTED == 'true'`, set once
    as an organization variable on org-ai-assisted. Zero runner cost -- a job
    whose `if:` is false never allocates one -- and the run still reports
    green, so upstream and forks are not handed a red X for a lane they did
    not opt into. A fork that WANTS the lane sets the same variable in its
    own repo; no patch to these files, no fork of our workflows.

    ANDed in front of any existing fork-PR guard rather than replacing it.

    Verified: the workflow-yaml validator reports 0 findings for this repo.

    Generated with assistance from Claude Code.

commit 1a18bcff39f96dfd50d4c3422e17bcc4425a5166
Author: assisted-by-ai (Bot Account) (Machine Account) <228987186+assisted-by-ai@users.noreply.github.com>
Date:   Thu Jul 30 11:59:21 2026 -0400

    consumer-claude-code: propagate the corrected template

    Byte-identical to developer-meta-files consumer-templates.

    The github.ref comment was wrong for one of the two events it described:
    issue_comment fires with the default branch ref, pull_request_review_comment
    with the PR merge ref (refs/pull/<number>/merge). No behaviour change -- the
    concurrency group reaches github.ref only if neither number field is set, and
    one always is for the events this workflow accepts.

    Generated with assistance from Claude Code.

commit 60d211ab7ef259e84aab3d5ddaa2e04e24f77a52
Author: claude (dev118 bd22decd-3027-4ab5-9e48-11adfe39b279) <noreply@anthropic.com>
Date:   Tue Jul 28 13:50:30 2026 -0400

    consumer-claude-code: mention-only triggers (propagated from template)

    Byte-identical cp from developer-meta-files/consumer-templates.

    pull_request and workflow_dispatch resolve to claude-code-action's
    agent mode, whose trigger is a non-empty 'prompt' input that this
    workflow does not pass, so those events could only spin up a runner
    and exit without calling the model - a green "Claude Code Review"
    check that reviewed nothing.

    Co-Authored-By: Claude <noreply@anthropic.com>

commit 991243e2d15307ef3677794580d64464ceef7e33
Author: Patrick Schleizer <adrelanos@whonix.org>
Date:   Tue Jul 28 13:24:59 2026 +0000

    bumped changelog version

commit eca7656202cce7322e09dcaae283d2a12f87041c
Merge: 7857467 b8c7bd0
Author: Patrick Schleizer <adrelanos@whonix.org>
Date:   Tue Jul 28 08:21:24 2026 -0400

    Merge remote-tracking branch 'refs/remotes/org-ai-assisted/master'

commit b8c7bd008daf810bc2b7d4bd85d80575a28cb90f
Author: claude <noreply@anthropic.com>
Date:   Tue Jul 28 06:17:26 2026 -0400

    consumer-codex-review: drop OPENAI_API_KEY forward to the disabled reusable

    Propagates org-ai-assisted/developer-meta-files#167. The reusable is a no-op
    stub (job 'if: false') and no longer declares an OPENAI_API_KEY secret;
    forwarding an undeclared secret is rejected by GitHub at workflow startup
    (startup_failure). Dropping the forward lets the no-op run green; Codex review
    stays cleanly disabled.

    Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

commit 7857467aa55ea8f6c6797ae16c7db9f5e99df9c0
Merge: 56bac40 977b98b
Author: Patrick Schleizer <adrelanos@whonix.org>
Date:   Thu Jul 23 08:20:51 2026 -0400

    Merge remote-tracking branch 'refs/remotes/org-ai-assisted/master'

commit 56bac40b362e2f16542f136a85c28ffc826b9768
Merge: e8e6aa8 34044fb
Author: Patrick Schleizer <adrelanos@whonix.org>
Date:   Thu Jul 23 05:57:35 2026 -0400

    Merge remote-tracking branch 'refs/remotes/ArrayBolt3/arraybolt3/trixie'

commit 977b98b4233643d5046a8b4d631dea513232ed41
Author: assisted-by-ai (Bot Account) (Machine Account) <228987186+assisted-by-ai@users.noreply.github.com>
Date:   Wed Jul 22 10:21:29 2026 -0400

    consumer-claude-code: forward CLAUDE_CODE_OAUTH_TOKEN (claude review OAuth port)

commit 34044fb4874b3606e4378f8532f43476ed16e0a5
Author: Aaron Rainbolt <arraybolt3@gmail.com>
Date:   Tue Jul 21 22:19:08 2026 -0400

    Use graphical messages in firewall editor scripts when sudo is unavailable

commit e8e6aa82a238d042dfa66b9276a0e7abccc0d236
Author: Patrick Schleizer <adrelanos@whonix.org>
Date:   Wed May 20 22:36:38 2026 +0000

    bumped changelog version

commit 0c110e91af4b0fc86afc56f7c6379c8efd808f41
Author: Patrick Schleizer <adrelanos@whonix.org>
Date:   Wed May 20 16:57:40 2026 -0400

    genmkfile uch

commit 9b72e6f9894f73d1fb39be2ad9c96f2639750d9f
Author: Patrick Schleizer <adrelanos@whonix.org>
Date:   Mon May 18 21:52:38 2026 +0000

    bumped changelog version

commit 9c8e4f1482afbcacd83e4afa4b748ffbd14fa88e
Merge: 34af8fb e849397
Author: Patrick Schleizer <adrelanos@whonix.org>
Date:   Mon May 18 17:49:25 2026 -0400

    Merge remote-tracking branch 'refs/remotes/org-ai-assisted/master'

commit e849397ff3940ca2d9a8bc9fa1ed263a93744f03
Merge: 34af8fb 670d059
Author: assisted-by-ai (Bot Account) <228987186+assisted-by-ai@users.noreply.github.com>
Date:   Mon May 18 17:24:41 2026 -0400

    Merge pull request #12 from org-ai-assisted/claude/fix-genmkfile-exit-codes-Xi0NP

    ci: bump actions/upload-artifact from v4 to v7.0.1 (mirror Whonix#19)

commit 670d059e2baa6e26fcac8b72e2352645f47db8fd
Author: Claude <noreply@anthropic.com>
Date:   Mon May 18 21:24:11 2026 +0000

    ci: bump actions/upload-artifact from v4 to v7.0.1

    Mirrors upstream Whonix/whonix-firewall#19 (Dependabot).

    Pinned SHA 043fb46d1a93c77aae656e7c1c64a875d1fc6a0a corresponds to
    the actions/upload-artifact v7.0.1 release tag (verified against
    https://github.com/actions/upload-artifact/releases/tag/v7.0.1).

    The two `uses:` lines in .github/workflows/local-firewall-tests.yml
    are 'nft-scripts' (dry-run job) and 'nft-diff' (PR job). Both
    artifacts have distinct names and live in different jobs, so v4's
    "no append to same artifact" constraint (still in force in v7)
    does not bite. Basic inputs (name / path / retention-days) are
    unchanged between v4 and v7.

commit 34af8fb97bc96550d0bfe1ab8829f481abc783ca
Author: Patrick Schleizer <adrelanos@whonix.org>
Date:   Mon May 18 10:18:16 2026 +0000

    bumped changelog version

commit f3ca556e064238c26b438b85714800890de741bc
Merge: 2cc625b e79ae8a
Author: Patrick Schleizer <adrelanos@whonix.org>
Date:   Sun May 17 16:23:22 2026 -0400

    Merge remote-tracking branch 'refs/remotes/org-ai-assisted/master'

commit e79ae8a65ca7f4ef354a81c6669578cf7fab97ad
Merge: 2cc625b c30c02b
Author: assisted-by-ai (Bot Account) <228987186+assisted-by-ai@users.noreply.github.com>
Date:   Sun May 17 14:02:51 2026 -0400

    Merge pull request #11 from org-ai-assisted/claude/fix-dependabot-action-UnL7w

    dependabot.yml: drop docker block (sync to new canonical)

commit c30c02bca23285dfffad6af8255402f2fcdcd82b
Author: Claude <noreply@anthropic.com>
Date:   Sun May 17 17:59:43 2026 +0000

    trim file commentary

commit d3c81c18fb5c49de7b31c84128925e578be11091
Author: Claude <noreply@anthropic.com>
Date:   Sun May 17 17:43:21 2026 +0000

    dependabot.yml: drop docker block (sync to new canonical)

    The previous canonical at
    developer-meta-files/consumer-templates/.github/dependabot.yml
    carried a docker package-ecosystem block on the documented theory
    that the block was a "harmless no-op" in repos without a
    /Dockerfile. That theory was wrong: the dependabot-action errors
    with `dependency_file_not_found` and aborts the whole job -
    including the github-actions ecosystem run that shares it - so
    this repo lost its github-actions Dependabot coverage too.

    Sync to the new canonical, which carries github-actions only.

    See org-ai-assisted/developer-meta-files PR #105 for the
    canonical change and the docker-bearing-repo opt-out mechanism.

commit 2cc625b92d7ea5fcd1b96a4688cb08ff0e40778a
Author: Patrick Schleizer <adrelanos@whonix.org>
Date:   Sat May 16 06:08:37 2026 -0400

    add .github/dependabot.yml

commit 250f20128807e57a747eb16c9deffca3f81b430f
Author: Patrick Schleizer <adrelanos@whonix.org>
Date:   Sat May 16 06:01:52 2026 -0400

    update .github/workflows/consumer-claude-code.yml

commit 8a2c5c2d7e73e29dd20106958e943185a5213670
Author: Patrick Schleizer <adrelanos@whonix.org>
Date:   Fri May 15 18:43:51 2026 +0000

    bumped changelog version

commit 52cf7db26b51d446272791ac01c91b6aad044487
Merge: babb227 4a981d4
Author: Patrick Schleizer <adrelanos@whonix.org>
Date:   Fri May 15 13:18:31 2026 -0400

    Merge remote-tracking branch 'refs/remotes/org-ai-assisted/master'

commit 4a981d4dc7d672e66c19c4a31b126e1fd9561685
Merge: 109d0b2 0963b24
Author: assisted-by-ai (Bot Account) <228987186+assisted-by-ai@users.noreply.github.com>
Date:   Tue May 12 15:29:02 2026 -0400

    Merge pull request #10 from org-ai-assisted/claude/review-github-actions-IQwcy

    workflow triggers: normalize to push(master) + pull_request(master) + workflow_dispatch

commit 0963b249c7c41b81e8b0e1cdf2c828bcd8d0ce86
Author: Claude <noreply@anthropic.com>
Date:   Tue May 12 19:25:53 2026 +0000

    workflow triggers: normalize to push(master) + pull_request(master) + workflow_dispatch

    Two changes:

    1. Propagate dmf canonical updates for consumer-claude-code.yml
       and consumer-codex-review.yml: bare `pull_request:` ->
       `pull_request: branches: [master]`. Matches the byte-identical
       canonical in
       developer-meta-files/consumer-templates/.github/workflows/.
    2. Tighten local-firewall-tests.yml triggers:
       - push: branches: ['*'] -> branches: [master]
       - pull_request: (any base) -> branches: [master]

    Practical impact: feature-branch pushes / PRs no longer trigger
    the firewall dry-run nor the AI reviews. The org's typical
    workflow (feature-branch -> master PR) is unaffected. Manual
    workflow_dispatch remains available for ad-hoc runs.

commit 109d0b2d61cdd7e0ace4a11206f8832a6b3b2eef
Merge: eed7476 9aea942
Author: assisted-by-ai (Bot Account) <228987186+assisted-by-ai@users.noreply.github.com>
Date:   Tue May 12 13:48:35 2026 -0400

    Merge pull request #9 from org-ai-assisted/claude/review-github-actions-IQwcy

    scorecard: remove consumer-scorecard.yml (org-wide opt-out)

commit 9aea942fce5afa537d9810fb47107d9cea2e4210
Author: Claude <noreply@anthropic.com>
Date:   Tue May 12 17:45:56 2026 +0000

    scorecard: remove consumer-scorecard.yml (org-wide opt-out)

    Per the consumer-template architecture's opt-in-by-file-presence
    rule, deleting a consumer-*.yml is the opt-out signal:
    pkg_update_consumer_workflows refreshes only files that already
    exist on the consumer side; the next propagation pass will not
    re-create this.

    Org-wide policy: Scorecard's value-to-noise ratio is low (many
    false positives, non-actionable signals). Keeping it only in
    derivative-maker (the canonical baseline) where the org-wide
    supply-chain signal is most useful.

    Spec:
    https://github.com/org-ai-assisted/developer-meta-files/blob/master/agents/github-actions-consumer-templates.md

commit eed74760bea3b5f721b6a0bb5037dae64344b629
Merge: 58597cf 0ca0a47
Author: assisted-by-ai (Bot Account) <228987186+assisted-by-ai@users.noreply.github.com>
Date:   Tue May 12 12:47:17 2026 -0400

    Merge pull request #8 from org-ai-assisted/claude/review-github-actions-IQwcy

    workflows: rename legacy unprefixed to consumer- prefix

commit 0ca0a472f350b3da3f6920b557018b336bc94e45
Author: Claude <noreply@anthropic.com>
Date:   Tue May 12 16:44:37 2026 +0000

    workflows: align consumer-*.yml byte-identical to dmf canonicals

    Follow-up to the rename commit: in addition to renaming the
    files, content must be byte-identical to the canonical wrappers
    in developer-meta-files/consumer-templates/.github/workflows/.

    Differences absorbed by this commit:

    - scorecard.yml cron slot: per-repo allocation -> uniform
      org-wide '0 6 * * 0' (the canonical's slot).
    - Header comments: switched to the standard "Managed by
      pkg_update_consumer_workflows" template so contributors see
      the propagation contract.

    User-facing `name:` fields unchanged.

    Spec:
    https://github.com/org-ai-assisted/developer-meta-files/blob/master/agents/github-actions-consumer-templates.md

commit bdffbdc8033aa2eea8977820113368cd45f2ead6
Author: Claude <noreply@anthropic.com>
Date:   Tue May 12 16:42:49 2026 +0000

    workflows: rename legacy unprefixed to consumer- prefix

    Per consumer-template architecture (G-A-005, three-prefix
    convention): wrappers around developer-meta-files reusables
    carry the `consumer-` prefix. This is the bulk rollout of the
    prefix to this repo's universal wrappers.

    Each file is byte-identical to its corresponding canonical in
    developer-meta-files/consumer-templates/.github/workflows/.

    User-facing `name:` fields unchanged. cron slots converge on
    the org-wide singleton (`0 6 * * 0` for Scorecard) per spec
    "Scheduling in byte-identical templates" - GitHub queue
    serializes; Scorecard's low value-to-noise ratio makes that
    contention acceptable.

    Spec:
    https://github.com/org-ai-assisted/developer-meta-files/blob/master/agents/github-actions-consumer-templates.md

commit 58597cf8eea85f2424b9c47f425c4b97b385fd06
Merge: babb227 2f1fca8
Author: assisted-by-ai (Bot Account) <228987186+assisted-by-ai@users.noreply.github.com>
Date:   Tue May 12 12:28:12 2026 -0400

    Merge pull request #7 from org-ai-assisted/claude/review-github-actions-IQwcy

    firewall-tests: rename to local- prefix

commit 2f1fca80fd814ff4f2b04577633092bdbb51b0bf
Author: Claude <noreply@anthropic.com>
Date:   Tue May 12 16:17:21 2026 +0000

    firewall-tests: rename to local- prefix

    Per consumer-template architecture: workflows that live only in
    one repo (not propagated by pkg_update_consumer_workflows) carry
    the `local-` prefix. firewall-tests.yml is one such - it runs
    this repo's nft dry-run + base-vs-PR diff and has no equivalent
    in any other consumer.

    No behavior change.

    Spec:
    https://github.com/org-ai-assisted/developer-meta-files/blob/master/agents/github-actions-consumer-templates.md

commit babb2271135d2f9fceb0486e5b437affddcaab2a
Author: Patrick Schleizer <adrelanos@whonix.org>
Date:   Mon May 11 21:24:14 2026 +0000

    bumped changelog version

commit b3012f507d9e4cf63d1029e3bfdcdfc3e16ad47a
Author: Patrick Schleizer <adrelanos@whonix.org>
Date:   Mon May 11 17:05:18 2026 -0400

    fix

commit bce0070899e72a0370a6b269e3c1842a80e1d2b1
Author: Patrick Schleizer <adrelanos@whonix.org>
Date:   Mon May 11 17:04:55 2026 -0400

    .

commit 970c90edd6e6b514e0a43de97c054ce2ebb81714
Author: Patrick Schleizer <adrelanos@whonix.org>
Date:   Mon May 11 17:04:19 2026 -0400

    fix

commit 649c634649db2ab5657f33ab82ca8877df01801a
Author: Patrick Schleizer <adrelanos@whonix.org>
Date:   Mon May 11 20:32:14 2026 +0000

    bumped changelog version

commit f6ef507614942badec56b9ad48d4bcbcfdbc618a
Merge: 25a343b 7edc6c8
Author: Patrick Schleizer <adrelanos@whonix.org>
Date:   Mon May 11 15:30:01 2026 -0400

    Merge remote-tracking branch 'refs/remotes/org-ai-assisted/master'

commit 7edc6c8429457d856f8950831c632cc2704883a1
Author: assisted-by-ai (Bot Account) <228987186+assisted-by-ai@users.noreply.github.com>
Date:   Sun May 10 20:19:01 2026 -0400

    workflows: add concurrency blocks (#5)

    3 cancellable.

commit 5790dd41eef108b01243f5d2ca37a5436242f54c
Author: assisted-by-ai (Bot Account) <228987186+assisted-by-ai@users.noreply.github.com>
Date:   Sun May 10 19:40:27 2026 -0400

    firewall-tests.yml: add per-job timeout-minutes: 15 (#4)

    Hang protection on both jobs.

commit 16473fa89fc1cf41fb998a0fd42a62ecd9660df0
Author: assisted-by-ai (Bot Account) <228987186+assisted-by-ai@users.noreply.github.com>
Date:   Sun May 10 19:21:23 2026 -0400

    firewall-tests.yml: use developer-meta-files install-deps composite (#3)

    4 inline blocks (2x genmkfile + 2x helper-scripts) -> 2 composite steps.

commit 52e52daef29a11419fd080ae9c8ef2fdbe441c44
Author: assisted-by-ai (Bot Account) <228987186+assisted-by-ai@users.noreply.github.com>
Date:   Sun May 10 17:59:40 2026 -0400

    workflows: forward only required AI secret explicitly (#2)

    claude-code.yml: explicit ANTHROPIC_API_KEY map. codex-review.yml: explicit OPENAI_API_KEY map. CI failures pre-merge are expected: claude-code-review action self-validates against master (resolves post-merge); dry-run tests blocked on genmkfile dctrl-tools fix landing first.

commit 25a343b94e0d822139b8cd397639bd8f8f5863e8
Merge: 0b665a1 f6c6fa0
Author: Patrick Schleizer <adrelanos@whonix.org>
Date:   Sun May 10 15:16:42 2026 -0400

    Merge remote-tracking branch 'refs/remotes/org-ai-assisted/master'

commit f6c6fa0afd5ff85f7dd2b181b0d6fdd8c8888c23
Author: Claude <noreply@anthropic.com>
Date:   Fri May 8 15:49:16 2026 +0000

    claude-code: restore id-token: write

    Reverts the earlier 'drop id-token' commit. Verified against a live
    workflow log that the action DOES use OIDC federation:

      Requesting OIDC token...
      OIDC token successfully obtained
      Exchanging OIDC token for app token...
      Using GITHUB_TOKEN from OIDC

    The action federates the runner's id-token to an Anthropic-controlled
    GitHub App which mints a higher-privilege GITHUB_TOKEN used to post
    review comments. Without id-token: write the next run would have
    failed with 'Could not fetch an OIDC token'.

commit ef7556f3225eef22bb6a19a124f9f2653b78e328
Author: Claude <noreply@anthropic.com>
Date:   Fri May 8 15:24:10 2026 +0000

    scorecard: drop inline cron allocation table

    The org-wide allocation table is single-source-of-truth in
    developer-meta-files/.github/workflows/reusable-scorecard.yml. Each
    consumer should carry only its own cron line with no commentary.

commit 6c009536fac430f3bbbde8a5b53533cd8bc29fa3
Author: Claude <noreply@anthropic.com>
Date:   Fri May 8 15:21:18 2026 +0000

    claude-code: drop id-token: write

    The reusable workflow no longer needs id-token: write (the action
    authenticates to api.anthropic.com via a static ANTHROPIC_API_KEY;
    OIDC federation is unused). Drop the permission to honor
    least-privilege - an OIDC token, if forged or leaked, can
    authenticate to cloud-provider integrations.

commit 31c9487d655c98a08048796c107711d48cf9868a
Author: Claude <noreply@anthropic.com>
Date:   Fri May 8 14:50:30 2026 +0000

    ci: add scorecard, Claude Code Review, OpenAI Codex Review

    Thin consumer wrappers around the reusables in
    org-ai-assisted/developer-meta-files. Brings whonix-firewall
    in line with the helper-scripts / kloak / security-misc baseline.

commit 0b665a13b5083f126788bb781270e54ec26cc542
Author: Patrick Schleizer <adrelanos@whonix.org>
Date:   Thu May 7 18:46:31 2026 +0000

    bumped changelog version

commit 2a1dceaf1aabe79c305e70dbcc270840a0c2953a
Merge: 64ef2fc f658b78
Author: Patrick Schleizer <adrelanos@whonix.org>
Date:   Wed May 6 13:45:30 2026 -0400

    Merge remote-tracking branch 'org-ai-assisted/claude/read-agents-meta-file-uKeT9'

commit f658b780c59015e9b73bbeb5d2d20033ee57a023
Author: assisted-by-ai (Bot Account) <server@kicksecure.com>
Date:   Wed May 6 08:17:09 2026 -0400

    ci: SHA-pin actions/checkout + actions/upload-artifact

commit 746d4d0f32334ffc01018fe1c612577def4927bf
Author: assisted-by-ai (Bot Account) <server@kicksecure.com>
Date:   Wed May 6 08:03:56 2026 -0400

    ci: clone genmkfile/helper-scripts from same org, no Kicksecure fallback

    Per maintainer feedback: drop the silent Kicksecure fallback - any
    org choosing to host its own CI of whonix-firewall must explicitly
    fork genmkfile + helper-scripts. A silent cross-org clone would be
    a supply-chain footgun. The workflow now hard-errors on missing
    repos with a clear "repository not found" message.

commit 73ded79fecb044b9962f92f6722fd809f62cafe5
Author: claude-code <claude-code@assisted-by-ai>
Date:   Wed May 6 11:38:26 2026 +0000

    test: classic PAT workflow-scope push capability

commit 2c0230656654a1b193ba7459d6a2ac88bf99db99
Author: assisted-by-ai (Bot Account) <server@kicksecure.com>
Date:   Wed May 6 07:38:02 2026 -0400

    ci: clone genmkfile/helper-scripts/msgcollector from same org with Kicksecure fallback

    Replace hardcoded `git clone https://github.com/Kicksecure/<pkg>.git`
    with same-org-first + Kicksecure-fallback so feature branches in the
    same org can self-test against each other and don't have to wait for
    a Kicksecure-master sync. Resolves to:

      - same-org `<pkg>` (e.g. org-ai-assisted/<pkg>) when present
      - Kicksecure/<pkg> upstream when same-org fork is missing

commit 3488eaad38329b824e24781bf5cfff1762799826
Author: assisted-by-ai (Bot Account) <server@kicksecure.com>
Date:   Wed May 6 07:21:13 2026 -0400

    Revert: dctrl-tools install in workflow; genmkfile bootstraps it now

    The 'Install apt pre-reqs' step that apt-installed dctrl-tools is no
    longer necessary - genmkfile now self-bootstraps it inside the
    deb-all-dep target (org-ai-assisted/genmkfile PR adding
    make_ensure_dctrl_tools). Per-workflow boilerplate is the wrong layer
    for that bootstrap; do it once in genmkfile instead.

commit e681dd50453b155cf155cbbc9f8ca067921e2a90
Author: assisted-by-ai (Bot Account) <server@kicksecure.com>
Date:   Wed May 6 06:09:15 2026 -0400

    ci: install dctrl-tools before genmkfile so deb-all-dep finds grep-dctrl

    Recent ubuntu-latest runner images stopped shipping dctrl-tools by
    default. The first `genmkfile deb-all-dep` step in both jobs failed:

      make-helper-one.bsh: ERROR: required command 'grep-dctrl' not found in PATH.

    (confirmed in the Actions log of run 25407254976.)

    Add an 'Install apt pre-reqs' step before each 'Install genmkfile'
    step that apt-installs dctrl-tools (and any future deb-all-dep
    runtime deps that surface).

commit d19edc830dadead5e1318edea21a289b85330752
Author: assisted-by-ai (Bot Account) <server@kicksecure.com>
Date:   Tue May 5 19:08:45 2026 -0400

    ci: cancel-in-progress on workflow re-run

    Add (or enable) concurrency: cancel-in-progress: true on workflow yml
    files that lacked it. Re-pushed runs of the same workflow on the same
    ref (re-tagged release, force-push, etc.) now cancel the in-flight
    run instead of stacking.

commit fddeff12bc694e178d839f494b67258788363763
Author: assisted-by-ai (Bot Account) <server@kicksecure.com>
Date:   Tue May 5 17:51:56 2026 -0400

    ci: add persist-credentials: false to all checkout steps

commit 64ef2fc3cc5263549bc5435b2a54ad3e98693b61
Author: Patrick Schleizer <adrelanos@whonix.org>
Date:   Fri Apr 24 11:20:59 2026 +0000

    bumped changelog version

commit 7df389a634ce02fa4abfb2e42686cc6693e47cd3
Author: Patrick Schleizer <adrelanos@whonix.org>
Date:   Fri Apr 24 07:20:40 2026 -0400

    CI

commit c6868f6f4ef21bbeada52b7bc5f06e1494b6cd63
Author: Patrick Schleizer <adrelanos@whonix.org>
Date:   Fri Apr 24 10:16:44 2026 +0000

    bumped changelog version

commit d8c11462d3dcb9e1ba287904a2c10b8cf745d6e8
Author: Patrick Schleizer <adrelanos@whonix.org>
Date:   Fri Apr 24 05:22:42 2026 -0400

    CI

commit 9d669b984299318f2af321439a1a70b80709f7a7
Merge: e8b0449 9e903fe
Author: Patrick Schleizer <adrelanos@whonix.org>
Date:   Fri Apr 24 05:17:47 2026 -0400

    Merge remote-tracking branch 'assisted-by-ai/claude/fix-ci-firewall-tests'

commit 9e903fe1e7db7deeb2fd45001d9d38abf166b8ec
Author: Claude <noreply@anthropic.com>
Date:   Fri Apr 24 09:09:22 2026 +0000

    Fix CI: install helper-scripts via genmkfile for test suite

    firewall-common now sources /usr/libexec/helper-scripts/strings.bsh
    (from Kicksecure helper-scripts package) which is not available on
    GitHub Actions ubuntu-latest runners. All 13 dry-run tests failed
    with exit 1 because the firewall scripts could not source the file.

    CI workflow now installs the real helper-scripts package:
    - apt-get install safe-rm (test script dependency)
    - git clone Kicksecure/genmkfile, install via deb-all-dep + install
    - git clone Kicksecure/helper-scripts, install via genmkfile install

    Both dry-run-tests and nft-diff jobs updated.

    Test script: removed inline helper-scripts stub that is no longer
    needed now that the real package is installed in CI.

    https://claude.ai/code/session_012mEmFr2YCscBvPKLoxz4eu

commit e8b0449c95674847ab3030776d0c1ad17eebf25b
Author: Patrick Schleizer <adrelanos@whonix.org>
Date:   Thu Apr 23 10:43:09 2026 +0000

    bumped changelog version

commit b02eac3dec61082b7f8bc022405b8b3a83f08922
Author: Patrick Schleizer <adrelanos@whonix.org>
Date:   Thu Apr 23 06:40:20 2026 -0400

    CI

commit 4092f5c969a6041dc4f789ab42e349fe1584f288
Author: Patrick Schleizer <adrelanos@whonix.org>
Date:   Thu Apr 23 06:37:04 2026 -0400

    fix

commit bb4ba6ad68b1c08df233ab517f0c815edc2b3fea
Author: Patrick Schleizer <adrelanos@whonix.org>
Date:   Wed Apr 22 13:23:37 2026 +0000

    bumped changelog version

commit ef2fb45313e1820f91f34a94ab4d4d716d0ecfcc
Merge: 930b9ed ae793b0
Author: Patrick Schleizer <adrelanos@whonix.org>
Date:   Wed Apr 22 09:03:43 2026 -0400

    Merge remote-tracking branch 'ArrayBolt3/arraybolt3/trixie'

commit ae793b04f56b19e3cbbf9f640d4e10afd338ea0c
Author: Aaron Rainbolt <arraybolt3@gmail.com>
Date:   Mon Apr 20 22:24:25 2026 -0400

    Harden against command injection

commit 930b9ed2f9c9487273b508bf7b9734a66bca01ec
Author: Patrick Schleizer <adrelanos@whonix.org>
Date:   Thu Apr 16 12:32:32 2026 +0000

    bumped changelog version

commit 3fc29b94e8d02a9e4841bf67a7fbac1c2ed2e7f2
Author: Patrick Schleizer <adrelanos@whonix.org>
Date:   Thu Apr 16 02:11:39 2026 -0400

    refactoring

commit ba5534a850c555790f10d68299dbe16e6153959e
Author: Patrick Schleizer <adrelanos@whonix.org>
Date:   Thu Apr 16 02:07:34 2026 -0400

    CI

commit 5bfdf9997605fed66157da779495fd9fe9e9aec0
Merge: d958ede 29e36b6
Author: Patrick Schleizer <adrelanos@whonix.org>
Date:   Thu Apr 16 02:06:29 2026 -0400

    Merge remote-tracking branch 'ArrayBolt3/arraybolt3/trixie'

commit 29e36b69279607f065d88372a25c6d12480fc1f7
Author: Aaron Rainbolt <arraybolt3@gmail.com>
Date:   Tue Apr 14 23:16:43 2026 -0400

    Modified and squashed commit of the following:

    commit bc74814e0d854d46f7fea4dd29c2d574e2d41779
    Author: Claude <noreply@anthropic.com>
    Date:   Fri Apr 10 09:52:22 2026 +0000

        Fix test-output/.gitignore to actually ignore root-level .nft files

        The previous content was a plain text comment, not a valid gitignore
        pattern. Add *.nft glob with exceptions for old/ and new/ subdirs.

        https://claude.ai/code/session_012mEmFr2YCscBvPKLoxz4eu

    commit 925541d85cc46e8b053b588cd1468d6287b25e1a
    Author: Claude <noreply@anthropic.com>
    Date:   Fri Apr 10 09:51:50 2026 +0000

        Restore firewall_mode validation to reject invalid values

        The refactored firewall_mode_detection() treated any value other than
        "timesync-fail-closed" as "full", silently defaulting to fail-open on
        typos (e.g., "timesync_fail_closed" with underscores). The previous
        code had explicit validation that errored on unsupported values.

        Restore the error: firewall_mode must be exactly "full" or
        "timesync-fail-closed". Any other value now triggers error_handler
        with a message showing the invalid value.

        https://claude.ai/code/session_012mEmFr2YCscBvPKLoxz4eu

    commit efb65f8ea3048e4a65e1dad4c9a913659f9c632c
    Author: Claude <noreply@anthropic.com>
    Date:   Fri Apr 10 09:36:45 2026 +0000

        Add .gitignore for transient test-output root files

        The test suite writes to test-output/ on each run. The canonical
        artifacts are in test-output/old/ and test-output/new/. Ignore
        root-level .nft files from ad-hoc re-runs.

        https://claude.ai/code/session_012mEmFr2YCscBvPKLoxz4eu

    commit f212d8b14f8f8d31966ce20d0cf9c4e99591723e
    Author: Claude <noreply@anthropic.com>
    Date:   Fri Apr 10 09:36:25 2026 +0000

        Update test script to follow Whonix coding style

        - set -o errexit -o nounset -o errtrace -o pipefail
        - printf '%s\n' instead of echo throughout
        - Self-identification: all output lines prefixed with $0:
        - Local variable declarations separated from assignments
        - ${variable} style for all expansions
        - Array-based timeout_wrapper instead of string splitting
        - Long option names: --force, --recursive, --archive, --parents, --quiet
        - End-of-options marker (--) after options
        - grep --quiet instead of grep -q
        - Two-space indentation (already correct)
        - No trailing whitespace

        https://claude.ai/code/session_012mEmFr2YCscBvPKLoxz4eu

    commit 62a9857971b4e21ee5196a92085bb0bcc95a20ce
    Author: Claude <noreply@anthropic.com>
    Date:   Fri Apr 10 09:07:11 2026 +0000

        Add generated nft scripts (old vs new) and timeout wrapper

        test-output/old/: nft scripts generated from master (pre-fix) code.
          - host-default.nft is truncated (28 lines) because the old host
            firewall crashed on unset variables in nft_input_rules_gateway().

        test-output/new/: nft scripts generated from this branch (post-fix)
          for all 13 test configurations. All pass nft --check validation.

        Rule diff summary (gateway default _ the only change for default configs):
          +add rule inet filter input icmpv6 type packet-too-big ct state related counter accept
          (ICMPv6 PMTUD fix _ no other default-config rules changed)

        Workstation default: no rule changes.
        Host default: was broken on master, now produces 56 valid rules.

        Test script changes:
        - Add timeout_wrapper (timeout --kill-after=5 30) for all privileged
          commands to prevent hangs from accidentally loading drop-all rules
        - Add nft --check syntax validation after each dry-run test
        - Fix exit code assertion being swallowed by output redirection

        https://claude.ai/code/session_012mEmFr2YCscBvPKLoxz4eu

    commit f7ac0d4f33e4749f17c90047d511d5d9499f1a21
    Author: Claude <noreply@anthropic.com>
    Date:   Fri Apr 10 07:53:22 2026 +0000

        Remove .gitignore to track test output nft scripts in git

        Recording generated nft scripts in version control allows diffing
        the actual firewall rules across commits.

        https://claude.ai/code/session_012mEmFr2YCscBvPKLoxz4eu

    commit 170b381b6491da3d04889cefa91d09287cbfd4bc
    Author: Claude <noreply@anthropic.com>
    Date:   Fri Apr 10 07:01:18 2026 +0000

        Add .gitignore for test output artifacts

        https://claude.ai/code/session_012mEmFr2YCscBvPKLoxz4eu

    commit f7f65215859009e9fc81eaa3449ef3d7eef71e59
    Author: Claude <noreply@anthropic.com>
    Date:   Fri Apr 10 07:00:53 2026 +0000

        Add CI test suite, fix host firewall missing variable defaults

        Host firewall crash fix:
        - The host firewall calls nft_input_rules_gateway() which, in full mode,
          accesses gateway-specific variables (GATEWAY_ALLOW_INCOMING_DIR_PORT,
          DIR_PORT, OR_PORT, CONTROL_PORT_FILTER_PROXY_ENABLE,
          WORKSTATION_ALLOW_SOCKSIFIED, WORKSTATION_TRANSPARENT_DNS/TCP,
          INT_IF, INT_TIF, port variables). These were never defined in the
          host's variables_defaults(), causing set -u to crash the script.
          Added all required variable defaults.

        CI test suite (tests/test_firewall_dry_run.sh):
        - 13 test configurations covering all major code paths:
          gateway (default, VPN, timesync, timesync+sdwdate, socksified=0),
          workstation (default, tunnel, timesync, outgoing IP list),
          host (default, VPN), CLI (--mode full, --mode timesync-fail-closed)
        - Each test runs the firewall with --dry-run, verifies exit code,
          and checks the generated nft script for expected/unexpected rules
        - Generated nft scripts saved as artifacts for manual review

        GitHub Actions workflow (.github/workflows/firewall-tests.yml):
        - dry-run-tests job: runs the test suite on every push and PR
        - nft-diff job: on PRs, generates nft scripts from both base and PR
          branches and diffs them to show exactly which firewall rules changed

        https://claude.ai/code/session_012mEmFr2YCscBvPKLoxz4eu

    commit 67396ed465e597bd7167dfcc98097a2fa92fc6c8
    Author: Claude <noreply@anthropic.com>
    Date:   Thu Apr 9 20:18:32 2026 +0000

        Fix --mode CLI option being overridden by config files

        get_options() runs before source_config_folder(), so the config file's
        firewall_mode=full was overwriting the --mode CLI value. Fix by storing
        the CLI value in a separate firewall_mode_cli variable (initialized in
        common_variables_defaults_pre, set in get_options), then applying it at
        the start of firewall_mode_detection() where it takes precedence over
        the config file setting.

        https://claude.ai/code/session_012mEmFr2YCscBvPKLoxz4eu

    commit 39edca46450c46ef133c52e5a5ce84b5773a983a
    Author: Claude <noreply@anthropic.com>
    Date:   Thu Apr 9 20:12:17 2026 +0000

        Add --mode CLI option, fix debug labels and config comments

        Add --mode full|timesync-fail-closed CLI option so users can override
        the firewall mode per invocation, e.g.:
          sudo whonix_firewall --mode full

        This provides an easy way to switch to full mode when running the
        firewall manually, without editing configuration files.

        Also:
        - Fix debug message labels from 'firewall_mode is' to
          'firewall_mode_detected is' for consistency with the variable rename
        - Fix stale comments still referencing 'firewall_mode' where
          'firewall_mode_detected' is meant
        - Clean up config file comments: remove internal variable name
          reference, document --mode override, improve wording

        https://claude.ai/code/session_012mEmFr2YCscBvPKLoxz4eu

    commit e29054135b84a96299e1d80118a90e476cc0cb7a
    Author: Claude <noreply@anthropic.com>
    Date:   Thu Apr 9 20:06:49 2026 +0000

        Separate firewall_mode config from firewall_mode_detected runtime state

        The firewall_mode variable was used as both a user configuration setting
        and internal runtime state, causing a name collision. Setting
        firewall_mode="timesync-fail-closed" in config would permanently lock
        the firewall in restricted mode because detection was skipped entirely
        when the variable was already set.

        New design:
        - firewall_mode: user configuration setting (default: "full").
          "full" disables timesync-fail-closed entirely.
          "timesync-fail-closed" is a user opt-in to restrict network until
          sdwdate succeeds, then automatically transitions to full mode.
        - firewall_mode_detected: internal runtime state set by
          firewall_mode_detection(). All runtime firewall rule checks now
          use this variable instead of the config variable.

        Changes:
        - Default firewall_mode to "full" in common_variables_defaults_post
        - Rewrite firewall_mode_detection() to set firewall_mode_detected
          based on sdwdate status files (only when user opts in)
        - Replace all runtime $firewall_mode checks with
          $firewall_mode_detected in gateway, workstation, host, and common
        - Add firewall_mode_detected to variable_list in all scripts
        - Update config file comments to document the two-variable design
        - Document ip6 nexthdr vs ip6 protocol in qubes_gateway()

        https://claude.ai/code/session_012mEmFr2YCscBvPKLoxz4eu

    commit 52b535917befac72d79baee78b51e127ea9312e9
    Author: Claude <noreply@anthropic.com>
    Date:   Thu Apr 9 19:55:11 2026 +0000

        Fix firewall_mode config/state clash, eval injection, and restarter pipefail

        firewall_mode variable clash:
        - The firewall_mode variable was used both as a user config setting and
          as internal runtime state. Setting firewall_mode="timesync-fail-closed"
          in config caused firewall_mode_detection() to skip detection entirely
          (via the 'if [ -n "${firewall_mode}" ]' guard), permanently locking
          the firewall in timesync-fail-closed mode with no way to transition
          to full mode after sdwdate succeeds.
        - Fix: only skip detection when firewall_mode="full" (user explicitly
          opts out of timesync-fail-closed). For all other values, always run
          detection based on sdwdate status files, overriding the config value.

        Premature timesync-fail-closed bypass:
        - Remove first_run_current_boot.status from mode detection. Previously,
          any firewall restart after the first load would switch to full mode
          even if sdwdate had not yet succeeded. This defeated the purpose of
          timesync-fail-closed since a manual restart or any restarter trigger
          would bypass the time verification check. The status file is still
          created by status_files() for other uses, just no longer influences
          mode detection.

        eval injection in print_variables:
        - Replace 'eval value=$item' with bash indirect expansion '${!item}'.
          A malicious config file could override variable_list to inject
          arbitrary code via eval (e.g., variable_list="x; malicious_cmd").
          While config dirs are root-owned, bash -n validation does not prevent
          this since the payload is syntactically valid bash.

        firewall-restarter pipefail:
        - Add 'set -o pipefail' for consistency with the main firewall scripts.

        https://claude.ai/code/session_012mEmFr2YCscBvPKLoxz4eu

    commit 89e839539dc5a02bd975eba33a4b026e5c992ffd
    Author: Claude <noreply@anthropic.com>
    Date:   Thu Apr 9 19:46:43 2026 +0000

        Fix invalid ip6 protocol syntax in workstation outgoing_allow_ip_list

        Same class of bug as the qubes_gateway() fix: 'ip6 protocol tcp' is not
        valid nftables syntax (ip6 header uses 'nexthdr', not 'protocol').
        Changed to 'ip6 nexthdr tcp'. This would cause nft --check to fail when
        outgoing_allow_ip_list is configured, preventing the firewall from loading.

        No remaining 'ip6 protocol' occurrences exist in the codebase.

        https://claude.ai/code/session_012mEmFr2YCscBvPKLoxz4eu

    commit 2c0d0ca025bf0e74877199a58fd0091461bb858e
    Author: Claude <noreply@anthropic.com>
    Date:   Thu Apr 9 19:41:15 2026 +0000

        Fix Qubes IPv6 syntax, add ICMPv6 PMTUD, revert host firewall_mode

        - Fix invalid nftables syntax in qubes_gateway(): 'ip6 protocol' is not
          a valid nftables expression (the ip6 header has 'nexthdr', not
          'protocol'). Changed to 'ip6 nexthdr udp' and 'ip6 nexthdr tcp'.
          This would cause nft --check to fail on Qubes systems, preventing the
          firewall from loading.
        - Add ICMPv6 Packet Too Big rule alongside the existing IPv4
          frag-needed rule in nft_input_rules_gateway(). Packet Too Big is the
          IPv6 equivalent of frag-needed and is required for IPv6 Path MTU
          Discovery. Without it, ICMPv6 Packet Too Big was dropped by the
          'ip6 nexthdr icmpv6 counter drop' rule, breaking IPv6 PMTUD.
        - Revert firewall_mode=full from host config since the host will use
          sdwdate and timesync-fail-closed mode is applicable.

        https://claude.ai/code/session_012mEmFr2YCscBvPKLoxz4eu

    commit 5951725bee96687248b63a4456844d69ddc0d491
    Author: Claude <noreply@anthropic.com>
    Date:   Thu Apr 9 19:38:09 2026 +0000

        Address review feedback: revert NAT chains, add documentation

        - Revert workstation NAT chains back to regular (non-base) chains.
          The workstation has no NAT rules, so these are dead code. Making
          them base chains would add packet processing overhead for no benefit.
        - Add code comment explaining why delete is used instead of flush
          in host firewall nft_defaults (delete removes stale chains, flush
          only removes rules but keeps chains intact).
        - Add code comment explaining why ICMPv6 neighbor discovery is needed
          in host firewall output (required for IPv6 link-layer resolution).
        - Add code comment explaining why clearnet user rule must be in filter
          table not nat table (nat accept only controls NAT evaluation, filter
          accept is what allows traffic through).
        - Add code comment explaining why enable-firewall needs the host
          marker check (whonix_firewall wrapper handles host, but enable-firewall
          would lock down without it).

        https://claude.ai/code/session_012mEmFr2YCscBvPKLoxz4eu

    commit 430fb47ea8269f6a61fc5083e413a3d846588662
    Author: Claude <noreply@anthropic.com>
    Date:   Thu Apr 9 19:35:21 2026 +0000

        Fix host firewall support gaps in AppArmor, config, and desktop helper

        - Add whonix-host-firewall to AppArmor abstraction's allowed executables.
          The pattern only matched {gateway,workstation}-firewall, so when complain
          mode is eventually disabled (per the existing TODO), the host firewall
          would be denied execution by AppArmor.
        - Add host marker file check to firewall30default desktop helper so it
          opens 30_whonix_host_default.conf on host systems instead of falling
          through to the workstation config.
        - Add firewall_mode=full to host default config. Unlike gateway and
          workstation which both set this, the host config was missing it, causing
          the host to start in timesync-fail-closed mode on first boot. The host
          does not use sdwdate, so timesync-fail-closed is not applicable.

        https://claude.ai/code/session_012mEmFr2YCscBvPKLoxz4eu

    commit 6eb6a2410d24f9bc88f5e6cf9601eea95c0dec2c
    Author: Claude <noreply@anthropic.com>
    Date:   Thu Apr 9 19:31:41 2026 +0000

        Fix gateway early return and workstation tunnel mode reject bugs

        - Remove erroneous 'return 0' from gateway variables_defaults() when
          WORKSTATION_ALLOW_SOCKSIFIED != 1. The early return prevented
          initialization of critical variables (INT_IF, INT_TIF, NON_TOR_GATEWAY,
          LOCAL_NET, WORKSTATION_DEST_SOCKSIFIED, NO_NAT_USERS, etc.), causing
          the firewall to crash under set -u when any of these were later accessed.
          The WORKSTATION_ALLOW_SOCKSIFIED checks in nft_input_rules_gateway()
          already handle skipping SOCKS port rules conditionally.
        - Move final reject rule in workstation nft_output() outside the
          TUNNEL_FIREWALL_ENABLE if/else block so it applies unconditionally.
          Previously, when tunnel mode was enabled, no final reject was emitted
          and non-matching traffic was silently dropped by chain policy instead
          of being explicitly rejected.

        https://claude.ai/code/session_012mEmFr2YCscBvPKLoxz4eu

    commit bd8bd8c383870b5e617603e486c722d2e426c42e
    Author: Claude <noreply@anthropic.com>
    Date:   Thu Apr 9 19:24:26 2026 +0000

        Fix 5 more bugs in host firewall and enable-firewall

        - Add missing host marker file check (/usr/share/libvirt-dist/marker) in
          enable-firewall, which caused host systems to get locked down instead of
          loading the host firewall via the whonix_firewall wrapper
        - Add missing loopback output rule in host firewall _ localhost was completely
          blocked when VPN_FIREWALL was enabled, breaking local applications
        - Add missing ICMPv6 neighbor discovery output rule in host firewall, matching
          the gateway and workstation scripts, to avoid breaking IPv6 connectivity
        - Make the final reject rule unconditional in host firewall output chain _
          previously it was only added when VPN_FIREWALL=1, causing silent drops
          (from chain policy) instead of explicit rejects when VPN was off
        - Change host firewall nft_defaults to use delete+add instead of flush,
          matching the gateway and workstation pattern, ensuring stale chains from
          previous configurations are properly cleaned up

        https://claude.ai/code/session_012mEmFr2YCscBvPKLoxz4eu

    commit 593edff88b10cda17cbdf2ef535fef44bbe3ec4c
    Author: Claude <noreply@anthropic.com>
    Date:   Thu Apr 9 18:42:12 2026 +0000

        Fix 5 bugs across firewall scripts

        - Fix IPv6 typo in gateway WORKSTATION_DEST_SOCKSIFIED_IPV6: ::ffff:10.139.0.0
          should be ::ffff:10.138.0.0 to match the DispVM Qubes IP range used elsewhere
        - Fix host firewall clearnet user rule using wrong nftables table (inet nat
          instead of inet filter), causing clearnet traffic to be silently dropped
        - Add missing variable_list to host firewall, preventing a crash from set -u
          when the -i (info) flag is used
        - Fix workstation debug log printing entire outgoing_allow_ip_list instead of
          current outgoing_allow_ip_item in the loop
        - Fix workstation NAT chains created as regular chains instead of base chains
          with proper hook types, matching the gateway firewall pattern

        https://claude.ai/code/session_012mEmFr2YCscBvPKLoxz4eu

commit d958ede311bcffff96e5befd0591707668ae1a83
Author: Patrick Schleizer <adrelanos@whonix.org>
Date:   Sat Apr 11 10:19:06 2026 +0000

    bumped changelog version

commit a83076a72098487b5420e0e728956289373fe1b2
Merge: 49ceb53 cc2c4fa
Author: Patrick Schleizer <adrelanos@whonix.org>
Date:   Sat Apr 11 05:54:06 2026 -0400

    Merge remote-tracking branch 'github-whonix/master'

commit 49ceb5390e17194396b7ba92a6b41e20f235fe80
Author: Patrick Schleizer <adrelanos@whonix.org>
Date:   Sat Apr 11 08:41:15 2026 +0000

    bumped changelog version

commit a26ea0691431b46a094ed44a63cd9f83e3af5bf2
Merge: 4ba0df4 ccde665
Author: Patrick Schleizer <adrelanos@whonix.org>
Date:   Sat Apr 11 04:29:16 2026 -0400

    Merge remote-tracking branch 'ArrayBolt3/arraybolt3/trixie'

commit ccde6651846077c19b4a8eff5927139ece293512
Author: Aaron Rainbolt <arraybolt3@gmail.com>
Date:   Fri Apr 10 18:08:22 2026 -0400

    Remove Vim modelines

commit cc2c4fa85b5aa1314da1917e2e46d33f2045a4f7
Merge: 4ba0df4 7edc2eb
Author: Patrick Schleizer <adrelanos@whonix.org>
Date:   Thu Apr 9 14:58:26 2026 -0400

    Merge pull request #17 from assisted-by-ai/claude/fix-inotifywait-firewall-uJmyG

    Add clarifying comments to firewall restart logic

commit 7edc2eb1e207111878ad16175db28eac9ec9714f
Author: Claude <noreply@anthropic.com>
Date:   Thu Apr 9 18:57:41 2026 +0000

    Document intentional systemctl status check in firewall-restarter

    Clarify that the systemctl status gate before restarting whonix-firewall
    is intentional: the firewall should only be restarted if it is currently
    active, not if it is in a failed or inactive state.

    https://claude.ai/code/session_017by8Udk9uMM21QgxeibA5S

commit 4ba0df427fe036a66770323dd3be5405dfb4c5d1
Author: Patrick Schleizer <adrelanos@whonix.org>
Date:   Sat Mar 28 10:00:25 2026 +0000

    bumped changelog version

commit c34954f290f2cfea7c28ac7e2cd8a9b5dd59dd18
Author: Patrick Schleizer <adrelanos@whonix.org>
Date:   Sat Mar 28 05:31:37 2026 -0400

    readme

commit 350c25369996cdca2be035a593f039ba39a2afc3
Author: Patrick Schleizer <adrelanos@whonix.org>
Date:   Sat Mar 28 05:27:13 2026 -0400

    signed commit

commit b57ff1e845bab46c49e2f099b02a7c367f550c66
Author: Patrick Schleizer <adrelanos@whonix.org>
Date:   Sun Jan 11 16:46:41 2026 +0000

    bumped changelog version

commit 3ba0407352abfd4ed657a3c9839c2a11c805326a
Author: Patrick Schleizer <adrelanos@whonix.org>
Date:   Sun Jan 11 10:59:21 2026 -0500

    typo

commit 78c2e53ee23b1544a531e6a33d4b724c512b6bd9
Author: Patrick Schleizer <adrelanos@whonix.org>
Date:   Mon Jan 5 11:06:17 2026 +0000

    bumped changelog version

commit 97896751d8aec9740820873e65c847e758c78b75
Merge: 1ec8d81 558aad7
Author: Patrick Schleizer <adrelanos@whonix.org>
Date:   Mon Jan 5 03:45:20 2026 -0500

    Merge remote-tracking branch 'github-whonix/master'

commit 558aad76bef8ed9084e450b632ab91e38960bcb5
Merge: c6f5101 ab54022
Author: Patrick Schleizer <adrelanos@whonix.org>
Date:   Mon Jan 5 03:32:27 2026 -0500

    Merge pull request #16 from Nurmagoz/patch-5

    Update whonix-firewall.postinst link

commit c6f51014da653e08ed4359a37fda74f31d1c64ae
Merge: 0641d13 4ae97d5
Author: Patrick Schleizer <adrelanos@whonix.org>
Date:   Mon Jan 5 03:31:12 2026 -0500

    Merge pull request #15 from Nurmagoz/patch-4

    Update 30_whonix_gateway_default.conf links

commit 0641d13ec85a9af4121823558fdd395245731dcf
Merge: f0a7299 ab0e1bf
Author: Patrick Schleizer <adrelanos@whonix.org>
Date:   Mon Jan 5 03:30:45 2026 -0500

    Merge pull request #14 from Nurmagoz/patch-3

    Update whonix-firewall.service Link

commit f0a7299c68ff98ee6c60fae21c7e612a93a71966
Merge: c1c8595 94e8147
Author: Patrick Schleizer <adrelanos@whonix.org>
Date:   Mon Jan 5 03:30:23 2026 -0500

    Merge pull request #13 from Nurmagoz/patch-2

    Update whonix-workstation-firewall link

commit c1c8595f811d749aeb6a7ef08da1999ec0c9cea9
Merge: 1ec8d81 2e03fc7
Author: Patrick Schleizer <adrelanos@whonix.org>
Date:   Mon Jan 5 03:30:01 2026 -0500

    Merge pull request #12 from Nurmagoz/patch-1

    Update enable-firewall Link

commit 1ec8d81f11007fafd7e526a608ec26b115be007f
Author: Patrick Schleizer <adrelanos@whonix.org>
Date:   Sat Jan 3 13:09:31 2026 +0000

    bumped changelog version

commit 0b3e1a6d4252c2ae9900a03ade6f7ef82e4b03d7
Merge: 36a292d bdddd68
Author: Patrick Schleizer <adrelanos@whonix.org>
Date:   Sat Jan 3 08:04:42 2026 -0500

    Merge remote-tracking branch 'ArrayBolt3/arraybolt3/trixie'

commit bdddd68033b976ae2dadeb882fe080a856dd4df9
Author: Aaron Rainbolt <arraybolt3@ubuntu.com>
Date:   Fri Jan 2 12:59:59 2026 -0600

    Revert "Disable IPv6 rules when IPv6 is disabled"

    This reverts commit 3ff941cf04a8d271ccf0d0bc69ca86eb69bd901d.

commit ab54022d042c3567db05abd5e41313d9e9304d6b
Author: Nurmagoz <11895339+Nurmagoz@users.noreply.github.com>
Date:   Thu Jan 1 21:24:01 2026 +0000

    Update whonix-firewall.postinst link

commit 4ae97d5ad29eecc8f93680c4fff3eed738b3b176
Author: Nurmagoz <11895339+Nurmagoz@users.noreply.github.com>
Date:   Thu Jan 1 21:19:03 2026 +0000

    Update 30_whonix_gateway_default.conf links

commit ab0e1bfc4e24a3e1e74943fbfc2fe96ceba7fc5d
Author: Nurmagoz <11895339+Nurmagoz@users.noreply.github.com>
Date:   Thu Jan 1 21:04:43 2026 +0000

    Update whonix-firewall.service Link

commit 94e8147c5e3facdb67f324711bc543925496fcaf
Author: Nurmagoz <11895339+Nurmagoz@users.noreply.github.com>
Date:   Thu Jan 1 20:50:43 2026 +0000

    Update whonix-workstation-firewall link

commit 2e03fc79bcfec404df35a3bca4437b258f2d82ab
Author: Nurmagoz <11895339+Nurmagoz@users.noreply.github.com>
Date:   Thu Jan 1 20:46:57 2026 +0000

    Update enable-firewall Link

commit 36a292d52bc3c5f650cf43bf37c53a831b330dea
Author: Patrick Schleizer <adrelanos@whonix.org>
Date:   Thu Jan 1 17:30:10 2026 +0000

    bumped changelog version

commit 2baff674c2d0b48953346ef5f88e642635cf7159
Merge: 099f26d 3ff941c
Author: Patrick Schleizer <adrelanos@whonix.org>
Date:   Thu Jan 1 12:09:53 2026 -0500

    Merge remote-tracking branch 'ArrayBolt3/arraybolt3/trixie'

commit 3ff941cf04a8d271ccf0d0bc69ca86eb69bd901d
Author: Aaron Rainbolt <arraybolt3@ubuntu.com>
Date:   Wed Dec 31 22:44:14 2025 -0600

    Disable IPv6 rules when IPv6 is disabled

commit 099f26daa344841a3d26558f02bd31decbbab00e
Author: Patrick Schleizer <adrelanos@whonix.org>
Date:   Thu Dec 4 07:55:43 2025 +0000

    bumped changelog version

commit 7e2fcf22c9cd26792b42842524649559be593e2e
Author: Patrick Schleizer <adrelanos@whonix.org>
Date:   Thu Dec 4 02:53:54 2025 -0500

    comments

commit 2abbd78810c2a4c4503c901ed8598b42475b2985
Merge: 8190f71 6881bda
Author: Patrick Schleizer <adrelanos@whonix.org>
Date:   Thu Dec 4 02:51:12 2025 -0500

    Merge remote-tracking branch 'ArrayBolt3/arraybolt3/trixie'

commit 6881bdabf340394ea937fb3e5ef0ddd574900d61
Author: Aaron Rainbolt <arraybolt3@ubuntu.com>
Date:   Wed Dec 3 20:58:49 2025 -0600

    Revert overcomplicated firewall-restarter code, rely on systemd to clean up during a restart

commit 8190f71942cd7a315b0aee1477eb201d10a86b88
Author: Patrick Schleizer <adrelanos@whonix.org>
Date:   Wed Dec 3 08:37:24 2025 +0000

    bumped changelog version

commit 4e09b1e4191b53cc6d7543ad9d531add894185c2
Merge: 0e4e2ea e1cb601
Author: Patrick Schleizer <adrelanos@whonix.org>
Date:   Tue Dec 2 07:10:55 2025 -0500

    Merge remote-tracking branch 'ArrayBolt3/arraybolt3/trixie'

commit e1cb6017002bc1c7b7a6c48dc67e801e9a37e746
Author: Aaron Rainbolt <arraybolt3@ubuntu.com>
Date:   Mon Nov 24 20:27:43 2025 -0600

    Integrate suggested fixes and enhancements from ChatGPT Codex

commit 0e4e2ea3924a815cf082822e5b74f10549f98734
Author: Patrick Schleizer <adrelanos@whonix.org>
Date:   Mon Nov 24 12:00:51 2025 +0000

    bumped changelog version

commit 9ffc092c351b98662c4c02fb78144f54499e951a
Author: Patrick Schleizer <adrelanos@whonix.org>
Date:   Mon Nov 24 06:20:08 2025 -0500

    comment

commit 5d250d239f063138e57f286f36e994450206da89
Author: Patrick Schleizer <adrelanos@whonix.org>
Date:   Mon Nov 24 06:19:06 2025 -0500

    comment

commit 2f9995da50bf7844468fea3ad0a136b4086672af
Author: Patrick Schleizer <adrelanos@whonix.org>
Date:   Mon Nov 24 06:17:58 2025 -0500

    comments

commit af8e1a35343600752c0bb1923173972c1b7fec7a
Author: Patrick Schleizer <adrelanos@whonix.org>
Date:   Mon Nov 24 05:43:38 2025 -0500

    fix

commit a34879a91e01964fa19b6118f12cda45e85d96ce
Author: Patrick Schleizer <adrelanos@whonix.org>
Date:   Sun Nov 9 08:19:42 2025 +0000

    bumped changelog version

commit b49fb7a51d3ec25fe5c3087fb9db45b2e7790f1b
Author: Patrick Schleizer <adrelanos@whonix.org>
Date:   Sun Nov 9 01:43:45 2025 -0500

    apparmor

commit 485e0ab8e19754b09f2375d99834af36ac77afda
Author: Patrick Schleizer <adrelanos@whonix.org>
Date:   Sat Nov 1 09:47:06 2025 +0000

    bumped changelog version

commit 901914bde6feb18e4398f5ee5f4d87a07f8ba561
Author: Patrick Schleizer <adrelanos@whonix.org>
Date:   Sat Nov 1 03:36:15 2025 -0400

    no longer depend on sudo

commit 0e1dbe205667b596003809815246ef47397eeff1
Author: Patrick Schleizer <adrelanos@whonix.org>
Date:   Sun Oct 26 11:32:16 2025 +0000

    bumped changelog version

commit caa25c2f93436d64c3b464afdf23aa34f2c82817
Author: Patrick Schleizer <adrelanos@whonix.org>
Date:   Sun Oct 26 07:29:40 2025 -0400

    user-sysmaint-split

commit cc62fc5f71a118cdfaa64143876088b51267136b
Author: Patrick Schleizer <adrelanos@whonix.org>
Date:   Fri Sep 19 18:17:58 2025 +0000

    bumped changelog version

commit ead5488e28a8cabb79eddff77099d78d1db25c48
Author: Patrick Schleizer <adrelanos@whonix.org>
Date:   Fri Sep 19 14:01:40 2025 -0400

    comment

commit db05bafc439705ef8f41809dc06acf8875d17c9f
Author: Patrick Schleizer <adrelanos@whonix.org>
Date:   Fri Sep 19 16:29:05 2025 +0000

    bumped changelog version

commit 48731a6f048f2404d0c8874a6ca304b2d46ebf9d
Author: Patrick Schleizer <adrelanos@whonix.org>
Date:   Thu Sep 18 10:09:09 2025 -0400

    fix

commit 5fab9053ec9481f2203aa6cbbcb101f912064f99
Author: Patrick Schleizer <adrelanos@whonix.org>
Date:   Tue Sep 16 05:16:43 2025 +0000

    bumped changelog version

commit b9760efb7ee223bc3538123e84670a7ff5fb2a08
Merge: e5ee9f3 1ac9f77
Author: Patrick Schleizer <adrelanos@whonix.org>
Date:   Tue Sep 16 01:01:13 2025 -0400

    Merge remote-tracking branch 'ArrayBolt3/arraybolt3/trixie'

commit 1ac9f77507f5bf38b27e273d80f74db3f3aad62f
Author: Aaron Rainbolt <arraybolt3@ubuntu.com>
Date:   Mon Sep 15 22:14:23 2025 -0500

    Fix Qubes IPv6 addresses

commit e5ee9f3a037fdc2828f13a4cc125d8dbe7c08b71
Author: Patrick Schleizer <adrelanos@whonix.org>
Date:   Mon Sep 15 11:51:58 2025 +0000

    bumped changelog version

commit 92cc542b6e8e0cb44b72b4f6ee01147f384661cd
Merge: f9015b9 3cbc053
Author: Patrick Schleizer <adrelanos@whonix.org>
Date:   Mon Sep 15 05:13:28 2025 -0400

    Merge remote-tracking branch 'ArrayBolt3/arraybolt3/trixie'

commit 3cbc0536a7f56277cef4e7d1e20d2e3a07eb8a15
Author: Aaron Rainbolt <arraybolt3@ubuntu.com>
Date:   Sun Sep 14 18:30:47 2025 -0500

    Fix IPv6 autoconfiguration

commit f9015b99664d99220f761bb5d68798093a294973
Merge: 235c37a db568ea
Author: Patrick Schleizer <adrelanos@whonix.org>
Date:   Sun Sep 14 03:15:55 2025 -0400

    Merge remote-tracking branch 'ArrayBolt3/arraybolt3/trixie'

commit db568ea70cecf140486ab60b852a8b244c0f8af2
Author: Aaron Rainbolt <arraybolt3@ubuntu.com>
Date:   Sat Sep 13 23:34:21 2025 -0500

    IPv6 fixes

commit 235c37ad9b27fc5bb66a39526541ab91085e84ef
Author: Patrick Schleizer <adrelanos@whonix.org>
Date:   Sat Sep 13 10:51:50 2025 +0000

    bumped changelog version

commit 06392272710e1d81fa96bc8ccdd4436628afb5af
Merge: f298042 1c92145
Author: Patrick Schleizer <adrelanos@whonix.org>
Date:   Sat Sep 13 06:45:36 2025 -0400

    Merge remote-tracking branch 'github-whonix/master'

commit 1c92145b6041cae6a0364c156442f50138e51d10
Merge: f298042 b74c956
Author: Patrick Schleizer <adrelanos@whonix.org>
Date:   Sat Sep 13 05:04:15 2025 -0400

    Merge pull request #10 from DanWin/ip6

    Add IPv6 support

commit f298042481b44d9d1a3723df980ab552c8860865
Author: Patrick Schleizer <adrelanos@whonix.org>
Date:   Tue Sep 9 15:59:57 2025 +0000

    bumped changelog version

commit faf0e511e578b2f79c7e2321db260708f16e1a1a
Merge: ac6c0eb a694cfe
Author: Patrick Schleizer <adrelanos@whonix.org>
Date:   Tue Sep 9 11:52:04 2025 -0400

    Merge remote-tracking branch 'ArrayBolt3/arraybolt3/trixie'

commit a694cfebdaefd9aba88025f9a53d20c660f439fd
Author: Aaron Rainbolt <arraybolt3@ubuntu.com>
Date:   Sun Sep 7 10:08:09 2025 -0500

    Avoid either/or dependency bug

commit ac6c0ebafafa7694baf34f847c988173aa108e4e
Author: Patrick Schleizer <adrelanos@whonix.org>
Date:   Tue Sep 2 15:38:26 2025 +0000

    bumped changelog version

commit dbf95851f7f5a06972f5aca469a3b15f99f66354
Author: Patrick Schleizer <adrelanos@whonix.org>
Date:   Tue Aug 26 09:45:51 2025 +0000

    bumped changelog version

commit 24cb2d3d12c0db2888e26bf9c7e0232caa5fc7f5
Author: Patrick Schleizer <adrelanos@whonix.org>
Date:   Tue Aug 26 05:45:50 2025 -0400

    re-generate man pages (generated using "genmkfile manpages")

commit 7d795edcfe5c3282dc6a690c42d6bd388a1c840d
Author: Patrick Schleizer <adrelanos@whonix.org>
Date:   Wed Aug 20 06:57:34 2025 -0400

    bumped Standards-Version

commit 0c35413e4a1318b3ae867850506966947889130b
Author: Patrick Schleizer <adrelanos@whonix.org>
Date:   Wed Aug 20 06:25:40 2025 -0400

    readme

commit 881b0eadbc15dfcae2f8de64dc36dcb8e4c36b5c
Author: Patrick Schleizer <adrelanos@whonix.org>
Date:   Thu Apr 17 14:13:28 2025 +0000

    bumped changelog version

commit a0bfbe539bb6b46190a8d6f8e16e87261369cb71
Author: Patrick Schleizer <adrelanos@whonix.org>
Date:   Thu Apr 17 08:08:57 2025 -0400

    deleted symlinks:

    * `man/whonix-gateway-firewall.8.ronn`
    * `man/whonix-host-firewall.8.ronn`
    * `man/whonix-workstation-firewall.8.ronn`

commit af13bb1600c0dae662e29fc9f88442daf44f0716
Author: Patrick Schleizer <adrelanos@whonix.org>
Date:   Tue Apr 8 14:09:47 2025 +0000

    bumped changelog version

commit cf1fc8dc2f6cc415858f6d878bcff56a0fb5646e
Merge: ffce315 d7d4faf
Author: Patrick Schleizer <adrelanos@whonix.org>
Date:   Fri Apr 4 09:53:51 2025 -0400

    Merge remote-tracking branch 'github-whonix/master'

commit d7d4faff6aa1dfe58b5b136aef6cd8439a0cd771
Merge: ffce315 12d34f2
Author: Patrick Schleizer <adrelanos@whonix.org>
Date:   Fri Apr 4 09:52:41 2025 -0400

    Merge pull request #11 from douglasrdv/patch-1

    Update 30_whonix_gateway_default.conf

commit 12d34f285c947669c4e7085383e02c0f30ca0518
Author: Douglas <142635021+douglasrdv@users.noreply.github.com>
Date:   Thu Apr 3 14:14:10 2025 -0300

    Update 30_whonix_gateway_default.conf

    Correct the word "DISABELD" to "DISABLED"

commit ffce31581531530d935ac7f29ecd20f1237a4ec3
Author: Patrick Schleizer <adrelanos@whonix.org>
Date:   Sat Mar 22 12:49:19 2025 +0000

    bumped changelog version

commit 7643b69b87a11bcc0ca01f9b112e10b22ea2a0a8
Author: Patrick Schleizer <adrelanos@whonix.org>
Date:   Sat Mar 22 08:46:15 2025 -0400

    OCSP is deprecated upstream

commit c552a2ec2762abb0ed4f759ba422c554de6a9312
Author: Patrick Schleizer <adrelanos@whonix.org>
Date:   Mon Jan 6 13:15:35 2025 +0000

    bumped changelog version

commit 1accebc73c426cb13235bcd890df18269d1727c3
Author: Patrick Schleizer <adrelanos@whonix.org>
Date:   Mon Jan 6 08:07:28 2025 -0500

    readme

commit 78d5418ce8665734e8ec29024d3e9a7b3f9943e0
Author: Patrick Schleizer <adrelanos@whonix.org>
Date:   Tue Dec 31 19:28:35 2024 +0000

    bumped changelog version

commit b2d29416245b765e8183da475b473c7d95421e01
Author: Patrick Schleizer <adrelanos@whonix.org>
Date:   Tue Dec 31 13:26:26 2024 -0500

    copyright

commit b74c956d994b3cced6497ab09a62e88692d36518
Author: Daniel Winzen <daniel@danwin1210.de>
Date:   Sun Dec 8 18:16:02 2024 +0100

    Fix systemcheck_user rule

commit 1183916aed8295d73143dbec1f5694ee0e82cff7
Author: Daniel Winzen <daniel@danwin1210.de>
Date:   Sun Dec 8 18:07:02 2024 +0100

    Add missing network to LOCAL_NET_IP6

commit 2d7f21f6a00246862f889e9fcd363a8214daf105
Author: Daniel Winzen <daniel@danwin1210.de>
Date:   Sun Dec 8 18:03:08 2024 +0100

    Add Non-Qubes-Whonix-Gateway IP to qubes destinations

commit aa02720167a9aac367313c6a475da5f5111255db
Author: Daniel Winzen <daniel@danwin1210.de>
Date:   Sun Dec 8 17:51:29 2024 +0100

    Switch 127.0.0.0/24 to 127.0.0.0/8

commit 4e202b11e84168d3415a4637768df6a692de6841
Author: Daniel Winzen <daniel@danwin1210.de>
Date:   Mon Oct 28 21:47:53 2024 +0100

    Add qubes IPs

commit e7de2a00f00a7e99a7fc9c089edc738434a5ed9d
Author: Daniel Winzen <daniel@danwin1210.de>
Date:   Fri Oct 11 18:56:02 2024 +0200

    Add IPv6 support

commit 1563e2eb5f7ce6739a55a62e9f36c5a0e05c1518
Author: Patrick Schleizer <adrelanos@whonix.org>
Date:   Tue Jun 18 16:11:28 2024 +0000

    bumped changelog version

commit 9a61709b8cebb9023d6a005e8855ee8be482e7bd
Author: Patrick Schleizer <adrelanos@whonix.org>
Date:   Tue Jun 18 12:11:14 2024 -0400

    apparmor

commit d0d2e0890a16ef46258d8e14ebd272392cb62455
Author: Patrick Schleizer <adrelanos@whonix.org>
Date:   Tue Jun 11 12:57:24 2024 +0000

    bumped changelog version

commit 9f83b6578bd69ed12975c97c7c2f6fef896e95e3
Merge: 00fa198 cbbed03
Author: Patrick Schleizer <adrelanos@whonix.org>
Date:   Tue Jun 11 08:56:34 2024 -0400

    Merge remote-tracking branch 'ben/info-trim'

commit cbbed0367ac891b74edb38c08529ae8c2979c9be
Author: Ben Grande <ben.grande.b@gmail.com>
Date:   Tue Jun 11 14:08:18 2024 +0200

    Do not delete chains

    NFTables syntax check fails, it needs to be skipped if editing policy of
    existing chain.

commit 905db632b9bfe1fc203f5d54ac3ffa51db63baa1
Author: Ben Grande <ben.grande.b@gmail.com>
Date:   Mon Jun 10 10:37:14 2024 +0200

    Fix dry-run mode and policy of existing chain

    If adding a policy to an existing chain, it fails on dry-run mode with
    the message that the "File exists", which means that the chain already
    exists.

commit d8eca530f348473597c7502426a68dc9ce9436b6
Author: Ben Grande <ben.grande.b@gmail.com>
Date:   Mon Jun 10 10:23:21 2024 +0200

    Add missing functions to host firewall

commit d425035fff503d324dafa2c1fb4d4cf646da3742
Author: Ben Grande <ben.grande.b@gmail.com>
Date:   Mon Jun 10 10:22:05 2024 +0200

    Add dry-run to test firewall on non-Whonix

    Workstation firewall works, Gateway and Host doesn't.

commit c4b1357667e77530e3318130cc7c1ba0abc07edc
Author: Ben Grande <ben.grande.b@gmail.com>
Date:   Mon Jun 10 09:36:10 2024 +0200

    Prettify informational output

commit 00fa198d780daabcd8894369e61a5d49a6096fa8
Author: Patrick Schleizer <adrelanos@whonix.org>
Date:   Sun Jun 9 13:56:32 2024 -0400

    towards IPv6 support

commit bbf2c07260a1a98389ee74992a14af84524c4eda
Author: Patrick Schleizer <adrelanos@whonix.org>
Date:   Sun Jun 9 13:23:41 2024 -0400

    towards IPv6 support

commit d8efd478a235e8d4ed998a69dd2e6dbe1df2c213
Author: Patrick Schleizer <adrelanos@whonix.org>
Date:   Sun Jun 9 12:40:07 2024 -0400

    towards IPv6

commit ca8e4e9fccc4d8470f682ca74b90d6d778dcf76b
Author: Patrick Schleizer <adrelanos@whonix.org>
Date:   Sun Jun 9 16:00:41 2024 +0000

    bumped changelog version

commit f179db6b20891bb32412a0934ff61ccd029d9bf8
Merge: 97978d4 c952984
Author: Patrick Schleizer <adrelanos@whonix.org>
Date:   Sun Jun 9 11:49:26 2024 -0400

    Merge remote-tracking branch 'ben/descomplicate'

commit c95298419e6eab537db29f4248b8bb2317e29166
Author: Ben Grande <ben.grande.b@gmail.com>
Date:   Wed Jun 5 17:15:02 2024 +0200

    Move duplicated functions to libexec

    Some variables were reordered for clarity.

commit edaf04b8bf53511cf9ee0928c4d4877cca775dd9
Author: Ben Grande <ben.grande.b@gmail.com>
Date:   Wed Jun 5 12:21:20 2024 +0200

    Simplify sequential ports to open

    Maintain comments with port number for easy grepping.

commit d16db2b5434e6b9336373668488972ae086167c9
Author: Ben Grande <ben.grande.b@gmail.com>
Date:   Wed Jun 5 12:02:02 2024 +0200

    Canonical way to detect Qubes VM

    https://www.qubes-os.org/faq/#what-is-the-canonical-way-to-detect-qubes-vm

commit 777428faaa9f97878b1f7d60cfec372621e6b8f3
Author: Ben Grande <ben.grande.b@gmail.com>
Date:   Wed Jun 5 11:58:22 2024 +0200

    Move shared variables to libexec

commit 5e4e248e4cb7dfc3a8412458ae2f3929f743987a
Author: Ben Grande <ben.grande.b@gmail.com>
Date:   Wed Jun 5 10:59:19 2024 +0200

    Styling

commit 4db7a564d992942d7f5c67e03dfdb44d86749d6e
Author: Ben Grande <ben.grande.b@gmail.com>
Date:   Wed Jun 5 10:53:16 2024 +0200

    Translate host firewall to nftables

commit 5c012f89991e67951587d25a6baf1176156a6a49
Author: Ben Grande <ben.grande.b@gmail.com>
Date:   Tue Jun 4 21:56:44 2024 +0200

    Remove unnecessary lines

commit 076ea2cefefc0d6facd9747895aa4d30c0ccba6a
Author: Ben Grande <ben.grande.b@gmail.com>
Date:   Tue Jun 4 21:49:54 2024 +0200

    Deal with shell option errexit

    Use if statements else if the test result is false, it can fail the
    whole script.

commit d0de0a9f46a6dd19f24b8355f63e3692d26fffc2
Author: Ben Grande <ben.grande.b@gmail.com>
Date:   Tue Jun 4 21:47:23 2024 +0200

    Move duplicated function to libexec

commit 7d705f9c84506c662ee1f93603dd0c28b01eb0b8
Author: Ben Grande <ben.grande.b@gmail.com>
Date:   Tue Jun 4 21:37:23 2024 +0200

    Print used variables

    At least the ones I could identify.

commit 0eb6317197e51e2544c8a10d53c3297aa3b1d8a4
Author: Ben Grande <ben.grande.b@gmail.com>
Date:   Tue Jun 4 21:08:38 2024 +0200

    Deal with shell option nounset

commit 1f5392ab98875261864640f0de08f6705edfac97
Author: Ben Grande <ben.grande.b@gmail.com>
Date:   Mon Jun 3 16:56:42 2024 +0200

    Move more duplicated functions to libexec

commit 0ae20686bbaeb6fc6f26e6a8e3d455675446b04f
Author: Ben Grande <ben.grande.b@gmail.com>
Date:   Mon Jun 3 16:33:41 2024 +0200

    Shellcheck firewall

commit fe698d73df60fec969f63d980bdaff9d55b12e3e
Author: Ben Grande <ben.grande.b@gmail.com>
Date:   Mon Jun 3 16:18:47 2024 +0200

    Move duplicated functions to libexec

commit 97978d4006581babfad316c9ba1ec7ad048099bc
Author: Patrick Schleizer <adrelanos@whonix.org>
Date:   Sun Jun 2 17:05:33 2024 +0000

    bumped changelog version

commit 5bf203b69f626c2ec3f35300b99825093922be2c
Author: Patrick Schleizer <adrelanos@whonix.org>
Date:   Sun Jun 2 13:02:45 2024 -0400

    - fix nftables for Non-Qubes-Whonix
    - localize loop variables
    - refactoring

commit 50f0e2e3ee3ff327002ea029c7cff5408377f038
Author: Patrick Schleizer <adrelanos@whonix.org>
Date:   Sun Jun 2 12:26:23 2024 +0000

    bumped changelog version

commit 2bf57895090b6b9a18bf89db723b1d2f7a0994c7
Author: Patrick Schleizer <adrelanos@whonix.org>
Date:   Sun Jun 2 08:25:00 2024 -0400

    aa-logprof

    https://forums.whonix.org/t/consider-nftables-berkeley-packet-filter-bpf-as-a-replacement-for-iptables/18896

commit 5a09deb1d7a9a4e110b14b84a66652f4ec83c2b8
Author: Patrick Schleizer <adrelanos@whonix.org>
Date:   Sun Jun 2 12:07:49 2024 +0000

    bumped changelog version

commit 779b1a47e09bdef2a6c60b8983c5365f973f3b17
Author: Patrick Schleizer <adrelanos@whonix.org>
Date:   Sun Jun 2 08:06:58 2024 -0400

    cleanup

commit 1e9a9b6537817d9fa5e8227af0ae0a33ac0d1f76
Author: Patrick Schleizer <adrelanos@whonix.org>
Date:   Sat Jun 1 20:26:45 2024 +0000

    bumped changelog version

commit d95e6bc2a5b38ec901b0eb39905a767a642d8840
Author: Patrick Schleizer <adrelanos@whonix.org>
Date:   Sat Jun 1 16:25:59 2024 -0400

    cleanup

commit fd16b7bea95e3ba6e94b5332dfd1e612ba281bb4
Author: Patrick Schleizer <adrelanos@whonix.org>
Date:   Sat Jun 1 16:24:17 2024 -0400

    cleanup

commit 874eb93d3b10f68b5221522ad7239f7f533aa0df
Author: Patrick Schleizer <adrelanos@whonix.org>
Date:   Sat Jun 1 16:21:31 2024 -0400

    firewall rules simplification: sys-whonix use Qubes UpdatesProxy tinyproxy with socks instead of transparent torification

    https://github.com/QubesOS/qubes-issues/issues/8398

commit dcde7447aa11763d13966512cdf89885682679b6
Author: Patrick Schleizer <adrelanos@whonix.org>
Date:   Sat Jun 1 17:36:08 2024 +0000

    bumped changelog version

commit e58fe0fddcd54486787c9f5eb5a005e52e0e356e
Author: Patrick Schleizer <adrelanos@whonix.org>
Date:   Sat Jun 1 13:31:23 2024 -0400

    switch dependency from iptables to nftables

    https://forums.whonix.org/t/consider-nftables-berkeley-packet-filter-bpf-as-a-replacement-for-iptables/18896

commit 9169557a9fba5ff1c4aa6ea264b38698ec1ea68f
Author: Patrick Schleizer <adrelanos@whonix.org>
Date:   Tue May 28 18:45:39 2024 +0000

    bumped changelog version

commit 6020ae8fc2506d8dd778a98e738c19244d289a6d
Author: Patrick Schleizer <adrelanos@whonix.org>
Date:   Tue May 28 14:32:03 2024 -0400

    remove iptables equivalent commands comments

commit d580765ea15844a988973b35fa537ba7d6b2b944
Author: Patrick Schleizer <adrelanos@whonix.org>
Date:   Tue May 28 14:25:44 2024 -0400

    towards IPv6 support

commit a87527b68a6db2bd3ddbc255076ad4a12fd8636d
Author: Patrick Schleizer <adrelanos@whonix.org>
Date:   Tue May 28 13:34:02 2024 +0000

    bumped changelog version

commit b99f06a1167ae88e25464b3db26fa36686ec14c0
Author: Patrick Schleizer <adrelanos@whonix.org>
Date:   Tue May 28 09:33:37 2024 -0400

    port to nftables

    https://forums.whonix.org/t/consider-nftables-berkeley-packet-filter-bpf-as-a-replacement-for-iptables/18896

commit f54cc18a489e7a385bc513369c31016b85cd3f7d
Author: Patrick Schleizer <adrelanos@whonix.org>
Date:   Mon May 6 12:51:54 2024 +0000

    bumped changelog version

commit 3f7357472f40778898643ea3c2d123c289292558
Merge: aa0fa45 fbe9b77
Author: Patrick Schleizer <adrelanos@whonix.org>
Date:   Mon May 6 08:51:36 2024 -0400

    Merge remote-tracking branch 'github-whonix/master'

commit fbe9b77c9c8b3b62ee10cc89ce4fa176df8eae77
Merge: aa0fa45 73165d1
Author: Patrick Schleizer <adrelanos@whonix.org>
Date:   Mon May 6 08:50:34 2024 -0400

    Merge pull request #7 from DanWin/qubes-nftables

    Fix nftables firewall version for Qubes

commit 73165d1ed758c9fe9f1b617799138c03d7b06453
Author: Daniel Winzen <daniel@danwin1210.de>
Date:   Mon May 6 11:21:08 2024 +0200

    Add nftables version of enable-firewall

commit 5415522a5f3babb10b1ddeda61157a1f922dc977
Author: Daniel Winzen <daniel@danwin1210.de>
Date:   Mon May 6 11:20:32 2024 +0200

    Flush tables individually and fix table already exists error

commit aa0fa450280cfc282f5d2f081649f91277f6bdd5
Author: Patrick Schleizer <adrelanos@whonix.org>
Date:   Fri Feb 2 12:47:21 2024 +0000

    bumped changelog version

commit 975e90bbf5a83fac35e2e31fd8248b2acf2674eb
Author: Patrick Schleizer <adrelanos@whonix.org>
Date:   Fri Feb 2 07:33:07 2024 -0500

    usrmerge debhelper systemd Debian package maintainer scripts fix

commit b16f8322a30991ae18283beacc8d761eb20ae754
Author: Patrick Schleizer <adrelanos@whonix.org>
Date:   Mon Jan 22 13:26:41 2024 +0000

    bumped changelog version

commit 8dae402570dcdcbf7a47527e968f5ae1c6435422
Author: Patrick Schleizer <adrelanos@whonix.org>
Date:   Mon Jan 22 06:54:34 2024 -0500

    usrmerge

commit 51eb656ecf94a49308634a352dfadf682033d9aa
Author: Patrick Schleizer <adrelanos@whonix.org>
Date:   Sat Nov 11 20:31:42 2023 +0000

    bumped changelog version

commit bdb35859987b63c5e5d0aab7f4abf07001d330ab
Author: Patrick Schleizer <adrelanos@whonix.org>
Date:   Sat Nov 11 13:41:25 2023 -0500

    change license to AGPL-3+

    https://forums.whonix.org/t/license-change-to-agplv3/17455

commit fc300780d0631be0d742d1dae5cee76c207a2d11
Author: Patrick Schleizer <adrelanos@whonix.org>
Date:   Fri Nov 3 08:53:26 2023 -0400

    bumped changelog version

commit fc1bcd65ce2d9ec999d5f7cec45ff84d0900e6a4
Merge: 937660e 462571d
Author: Patrick Schleizer <adrelanos@whonix.org>
Date:   Thu Nov 2 12:58:24 2023 -0400

    Merge remote-tracking branch 'github-whonix/master'

commit 462571d1882f8e48edc70fdc77e649c6446f9572
Merge: 937660e c170d36
Author: Patrick Schleizer <adrelanos@whonix.org>
Date:   Thu Nov 2 12:57:18 2023 -0400

    Merge pull request #6 from 1cho1ce/firewall-accept-HTTPTunnelPort

    Allow input connections to HTTPTunnelPort

commit c170d364c20c4582928fee7be6cfbafbfd3b8bec
Author: 1cho1ce <1choice4u@proton.me>
Date:   Thu Nov 2 06:44:53 2023 +0000

    Allow input connections to HTTPTunnelPort https://github.com/Whonix/anon-gw-anonymizer-config/commit/68daef8443eb4845ba07dc33b983df3592d5bccd

commit 937660e60fe6e9f39901e99883fbf41cd5a1032b
Author: Patrick Schleizer <adrelanos@whonix.org>
Date:   Sun Oct 8 06:32:49 2023 -0400

    bumped changelog version

commit 8ffea53ada36c05bd5c61fd5f309301b8f02131a
Author: Patrick Schleizer <adrelanos@whonix.org>
Date:   Sun Oct 8 04:38:16 2023 -0400

    wayland

commit 30b8b761649ed618befd7ce78b8a8ae4f1abf0b2
Author: Patrick Schleizer <adrelanos@whonix.org>
Date:   Tue Oct 3 06:11:34 2023 -0400

    bumped changelog version

commit 712e175b5d8816e9773d63be1b5ce1152819548f
Author: Patrick Schleizer <adrelanos@whonix.org>
Date:   Tue Oct 3 05:26:57 2023 -0400

    towards IPv6 support

commit 786ddc742713e54995cd98a38968fa262cb13f85
Author: Patrick Schleizer <adrelanos@whonix.org>
Date:   Tue Oct 3 05:22:10 2023 -0400

    towards IPv6 support

commit da33a0f2b6d704b4f45efc75e39c6627e6fd53f6
Author: Patrick Schleizer <adrelanos@whonix.org>
Date:   Tue Oct 3 05:11:46 2023 -0400

    minor

commit 9d90442dc97d169a48cf0273a6cec8e490fd7771
Author: Patrick Schleizer <adrelanos@whonix.org>
Date:   Tue Oct 3 05:11:09 2023 -0400

    comment

commit 66f438653ea3d910ecdb6bddfb7c21ba0584d32a
Author: Patrick Schleizer <adrelanos@whonix.org>
Date:   Tue Oct 3 04:57:04 2023 -0400

    towards IPv6 support

commit 75b352b1ded47aaa3d48b255bd573bce434d4ff8
Author: Patrick Schleizer <adrelanos@whonix.org>
Date:   Tue Oct 3 04:40:10 2023 -0400

    towards IPv6 support

commit 72218e51d8c30e97a8ad4a9aa92520e0b04fdd8b
Author: Patrick Schleizer <adrelanos@whonix.org>
Date:   Tue Oct 3 03:59:18 2023 -0400

    bumped changelog version

commit fa5a98ecda65ed5619ca16c8e04fc100359dd036
Author: Patrick Schleizer <adrelanos@whonix.org>
Date:   Tue Oct 3 03:58:29 2023 -0400

    fix, source config folder first before setting built-in default variables

commit 4699890a7911a44798d3d7120e8d5a11cfcc5361
Author: Patrick Schleizer <adrelanos@whonix.org>
Date:   Tue Oct 3 03:22:12 2023 -0400

    bumped changelog version

commit 518475aee6cc2683fde138eb29f9714b759cadfa
Author: Patrick Schleizer <adrelanos@whonix.org>
Date:   Tue Oct 3 03:11:58 2023 -0400

    nftabels

commit 62c5acb23e74c8c11c180c5d2f05952605f2af08
Author: Patrick Schleizer <adrelanos@whonix.org>
Date:   Tue Oct 3 03:00:27 2023 -0400

    nftabels

commit b392610ed125cf127d4ebc8ffb7b8cda4d98d767
Author: Patrick Schleizer <adrelanos@whonix.org>
Date:   Mon Oct 2 23:50:41 2023 -0400

    nftabels

commit 8be1049a93e6902e66fa1d9efcf9fa645c26b961
Author: Patrick Schleizer <adrelanos@whonix.org>
Date:   Mon Oct 2 21:33:26 2023 -0400

    bumped changelog version

commit 61a58da8d96984255f4d0e9e02348cc472b6a020
Author: Patrick Schleizer <adrelanos@whonix.org>
Date:   Mon Oct 2 21:29:58 2023 -0400

    minor

commit 7438dd4e9d95a9e81b887489e09b34461741b1d1
Author: Patrick Schleizer <adrelanos@whonix.org>
Date:   Mon Oct 2 20:59:19 2023 -0400

    nftables

commit df73ae2792acf125d2adebd3dbf1b534910c1023
Author: Patrick Schleizer <adrelanos@whonix.org>
Date:   Mon Oct 2 20:55:09 2023 -0400

    fix

commit b803243b43da8318f1121c25c7d4673f70e64b98
Author: Patrick Schleizer <adrelanos@whonix.org>
Date:   Mon Oct 2 19:36:13 2023 -0400

    .

commit f87840dde4bd0734ef58ca1e6b2ab5397f7cd410
Author: Patrick Schleizer <adrelanos@whonix.org>
Date:   Tue Aug 29 08:30:32 2023 -0400

    bumped changelog version

commit 5f1e0ef0fce2dfc991547a16a5b23637bb27f57c
Author: Patrick Schleizer <adrelanos@whonix.org>
Date:   Tue Aug 29 08:26:21 2023 -0400

    Fix MTU problem by allowing RELATED fragmentation-needed ICMP by

    enabling `GATEWAY_ALLOW_INCOMING_ICMP_FRAG_NEEDED=1` by default.

    Run
    `iptables -A INPUT -p icmp --icmp-type fragmentation-needed -m state --state RELATED -j ACCEPT`
    on Whonix-Gateway.

commit 8e3b045fc2b93012e0d4a60017a870b7676d8a1a
Author: Patrick Schleizer <adrelanos@whonix.org>
Date:   Sun Jul 9 06:33:49 2023 -0400

    bumped changelog version

commit 0467e3a1430eefc57b8fbd84e7d704de6ec7e8fb
Author: Patrick Schleizer <adrelanos@whonix.org>
Date:   Sun Jul 9 06:15:12 2023 -0400

    readme

commit efbffb87420f4083ac7590e2204cf6d991e2e57e
Author: Patrick Schleizer <adrelanos@whonix.org>
Date:   Fri Jun 23 08:18:55 2023 +0000

    bumped changelog version

commit 4ed72a14948d050715178f9197e4df52d8154050
Author: Patrick Schleizer <adrelanos@whonix.org>
Date:   Thu Jun 22 16:17:17 2023 +0000

    comment

commit 3b286f17c29524091d9a2ebb3d8bbfc6ea6ad772
Author: Patrick Schleizer <adrelanos@whonix.org>
Date:   Wed Jun 21 09:44:48 2023 +0000

    bumped changelog version

commit 871c01c6bdb159a6a657f1c333e37c426f65ff53
Author: Patrick Schleizer <adrelanos@whonix.org>
Date:   Wed Jun 21 09:11:35 2023 +0000

    bookworm

commit e2b1acddd5f6b924d441e94915373984bd2310fe
Author: Patrick Schleizer <adrelanos@whonix.org>
Date:   Sat Jun 17 13:51:30 2023 +0000

    bumped changelog version

commit b575a208b8cc590b03dc47de39ab808fa0fdec52
Author: Patrick Schleizer <adrelanos@whonix.org>
Date:   Sat Jun 17 13:50:57 2023 +0000

    bookworm aa-logprof

commit 3fe3f3a3fbcb5bfa6556e1dc7a92ac39bab283fb
Author: Patrick Schleizer <adrelanos@whonix.org>
Date:   Fri Jun 16 11:29:58 2023 +0000

    bumped changelog version

commit 02279651937be5d4d19fb328987904df432a75d0
Author: Patrick Schleizer <adrelanos@whonix.org>
Date:   Fri Jun 16 10:49:09 2023 +0000

    readme

commit 5ec9c02135a42bc7535ae60a0176ecb035decbef
Author: Patrick Schleizer <adrelanos@whonix.org>
Date:   Thu Jun 15 17:09:35 2023 +0000

    bumped changelog version

commit 2a34fac3bb40af42ce50c11de543dffe787f540d
Author: Patrick Schleizer <adrelanos@whonix.org>
Date:   Wed Jun 14 13:14:50 2023 +0000

    copyright

commit 5aafd9183187fa7528e958ebb5577621f28774d9
Author: Patrick Schleizer <adrelanos@whonix.org>
Date:   Wed Jun 14 10:09:56 2023 +0000

    bumped changelog version

commit 064dfe7d675f19c63bcfd046ffaab40cfd66f795
Author: Patrick Schleizer <adrelanos@whonix.org>
Date:   Wed Jun 14 09:41:48 2023 +0000

    bookworm

commit 65eb03a7e2a2ee8f601cbc52af226f285f94e933
Author: Patrick Schleizer <adrelanos@whonix.org>
Date:   Mon Jun 12 18:18:22 2023 +0000

    bumped changelog version

commit 0e4eed789c1cebadaed659a5dee776e82c94eb34
Author: Patrick Schleizer <adrelanos@whonix.org>
Date:   Mon Jun 12 16:22:36 2023 +0000

    Standards-Version: 4.6.1.0

commit 482bb1fda752d407ce4d54ef46df1133989a902e
Author: Patrick Schleizer <adrelanos@whonix.org>
Date:   Mon Jun 12 15:39:30 2023 +0000

    bumped changelog version

commit 6e37ce0bfd96aa20da4a5f129901da8f91de7628
Author: Patrick Schleizer <adrelanos@whonix.org>
Date:   Mon Jun 12 14:52:05 2023 +0000

    update copyright year

commit 57cb4ca939ebe05c146efafa703aa49ca239a437
Author: Patrick Schleizer <adrelanos@whonix.org>
Date:   Mon Jun 12 14:48:04 2023 +0000

    abolish /rw/config parsing
    (Does not influence Qubes specific /rw/config parsing.)

commit d1822092578006e3a1948def8abeadddcd6299dd
Author: Patrick Schleizer <adrelanos@whonix.org>
Date:   Fri Jun 2 13:36:53 2023 +0000

    bumped changelog version

commit d42542555519ea3a39fc905ba1900e4843eaae2c
Author: Patrick Schleizer <adrelanos@whonix.org>
Date:   Fri Jun 2 11:17:47 2023 +0000

    remove trailing spaces

commit b1d5824da11ca61354f7fd639bf90ecf1454bde2
Author: Patrick Schleizer <adrelanos@whonix.org>
Date:   Fri Jun 2 11:16:27 2023 +0000

    comment

commit 462775d480ae9bb0d79442a7c77e00d736368b8d
Merge: 6ff9edb cf99266
Author: Patrick Schleizer <adrelanos@whonix.org>
Date:   Fri Jun 2 11:15:34 2023 +0000

    Merge remote-tracking branch 'github-whonix/master'

commit cf99266c64c447b86a1af87da5f6f5c813ba348a
Merge: 6ff9edb bf26fc7
Author: Patrick Schleizer <adrelanos@whonix.org>
Date:   Fri Jun 2 11:13:16 2023 +0000

    Merge pull request #5 from 1cho1ce/allow-icmp-frag-needed

    Fix MTU problem by allowing RELATED fragmentation-needed ICMP

commit bf26fc743af48d68e0b1bd97484ba46228e1591b
Author: 1cho1ce <1choice4u@proton.me>
Date:   Thu May 25 18:13:36 2023 +0000

    Fix MTU problem by allowing RELATED fragmentation-needed ICMP

commit 6ff9edb04d746d59e3d669fc98c2f9507d36b1f6
Author: Patrick Schleizer <adrelanos@whonix.org>
Date:   Tue May 16 13:28:28 2023 +0000

    bumped changelog version

commit 3b4d13cebc68467d7d0824055d3d4d23cb382b29
Author: Patrick Schleizer <adrelanos@whonix.org>
Date:   Tue May 16 13:28:17 2023 +0000

    nftables WIP

commit ba6e974b91eb275232fb83fd3b604f83e2efa44c
Author: Patrick Schleizer <adrelanos@whonix.org>
Date:   Tue May 16 13:05:08 2023 +0000

    nftables WIP

commit f5a1131d7466cd9017a908bb64804ecbe181ef06
Author: Patrick Schleizer <adrelanos@whonix.org>
Date:   Tue May 16 12:55:15 2023 +0000

    nftables WIP

commit 341b6ebabcbd41362e7c5de16b1e3a65918456b0
Author: Patrick Schleizer <adrelanos@whonix.org>
Date:   Tue May 16 12:51:30 2023 +0000

    nftables WIP

commit 6f6f8a3b3189b4ea6a630ae3e74365be15d403ba
Author: Patrick Schleizer <adrelanos@whonix.org>
Date:   Tue May 16 12:31:55 2023 +0000

    chmod +x

commit a893e7fd1a5cb66d92dee5919ef895240f9ad9a0
Author: Patrick Schleizer <adrelanos@whonix.org>
Date:   Tue May 16 12:30:50 2023 +0000

    nftables WIP

commit cc61b7f6d092093918c51fa578c5cfa526e8e46d
Author: Patrick Schleizer <adrelanos@whonix.org>
Date:   Tue May 16 12:13:19 2023 +0000

    bumped changelog version

commit a0f016e6777473fc01d7c0f6e3f9e5c3d398e3e0
Author: Patrick Schleizer <adrelanos@whonix.org>
Date:   Tue May 16 12:09:55 2023 +0000

    nftables WIP

commit 2dfc3986aff1fb9936eedfbd3d8d2737efa4c77e
Author: Patrick Schleizer <adrelanos@whonix.org>
Date:   Tue May 16 12:09:02 2023 +0000

    nftables WIP

commit f38123c26fcee9b9c4903011daf528210e5fee78
Author: Patrick Schleizer <adrelanos@whonix.org>
Date:   Tue May 16 12:00:27 2023 +0000

    bumped changelog version

commit 65ead9f90c13cb74f6790ed1e3ee008d9e83cc66
Author: Patrick Schleizer <adrelanos@whonix.org>
Date:   Tue May 16 11:58:39 2023 +0000

    nftables WIP

commit 0fa97fc0315b3a68611c001732da8799ce94cd4f
Author: Patrick Schleizer <adrelanos@whonix.org>
Date:   Tue May 16 11:52:54 2023 +0000

    nftables WIP

commit 8b35e09f4ab7fb60021834222485dae36f267eb1
Author: Patrick Schleizer <adrelanos@whonix.org>
Date:   Tue May 16 11:16:12 2023 +0000

    nftables WIP

commit 54da617d8ebcabca71032ffcda6cfef0468b27de
Author: Patrick Schleizer <adrelanos@whonix.org>
Date:   Mon May 15 18:26:30 2023 +0000

    nftables WIP

commit 340d9189b3ad722dde4a6a15aafa22d101e2d3b3
Author: Patrick Schleizer <adrelanos@whonix.org>
Date:   Mon May 15 17:57:49 2023 +0000

    nftables WIP

commit 6c4d424e6f65d18f09105cae5c5a9b162fa2d6a0
Author: Patrick Schleizer <adrelanos@whonix.org>
Date:   Mon May 15 17:55:01 2023 +0000

    nftables WIP

commit 393e45f631ee7a26cb26434470203fdc4c53ed89
Author: Patrick Schleizer <adrelanos@whonix.org>
Date:   Mon May 15 17:52:30 2023 +0000

    nftables WIP

commit 76692d0b005d1bfea8834aa777e10ba2414ab7bf
Author: Patrick Schleizer <adrelanos@whonix.org>
Date:   Mon May 15 17:50:37 2023 +0000

    nftables WIP

commit 9037cd9b516ad1ae6727e671ab3e45b7be9460a9
Author: Patrick Schleizer <adrelanos@whonix.org>
Date:   Mon May 15 17:49:17 2023 +0000

    nftables WIP

commit 0413ccd9cb838c7794f2995e27301c2e3c8b1993
Author: Patrick Schleizer <adrelanos@whonix.org>
Date:   Mon May 15 17:32:13 2023 +0000

    bumped changelog version

commit 6b5b04c4b69c0804e0f95339dd06a0f6217775da
Author: Patrick Schleizer <adrelanos@whonix.org>
Date:   Mon May 15 17:12:43 2023 +0000

    add nftabels-save-deterministic-old-vpn

commit ff78a2ff4e75208d15f0931ee0d4d7f9d6252dd7
Author: Patrick Schleizer <adrelanos@whonix.org>
Date:   Mon May 15 17:09:48 2023 +0000

    add nftabels-save-deterministic-old-normal

commit 374f6ca8c06ebbf08112cbdf060c22f11026099a
Author: Patrick Schleizer <adrelanos@whonix.org>
Date:   Mon May 15 17:02:23 2023 +0000

    rename

commit f6b70301e18f9b5a2fdf0a9ea5c4497de6c97876
Author: Patrick Schleizer <adrelanos@whonix.org>
Date:   Mon May 15 17:01:34 2023 +0000

    add doc nftabels-save-deterministic-old-normal

commit c70d09cc72db49899cf0e9a069586b8abbb7ff46
Author: Patrick Schleizer <adrelanos@whonix.org>
Date:   Mon May 15 16:59:57 2023 +0000

    move

commit 6103187ae1b0757348e366f23a52946630ece193
Author: Patrick Schleizer <adrelanos@whonix.org>
Date:   Mon May 15 16:55:14 2023 +0000

    nftables WIP

commit 1229576ea8536a9763780c0b41fbde546e8ca2b2
Author: Patrick Schleizer <adrelanos@whonix.org>
Date:   Mon May 15 16:45:50 2023 +0000

    nftables WIP

commit cc6eadebd8945c90f84005783b052ed74daaa58f
Author: Patrick Schleizer <adrelanos@whonix.org>
Date:   Mon May 15 16:44:19 2023 +0000

    nftables WIP

commit 06f550ec5d87981302a1281099a896370bf4ec6e
Author: Patrick Schleizer <adrelanos@whonix.org>
Date:   Mon May 15 15:33:33 2023 +0000

    nftables WIP

commit f4e2ccd5d91f529d168eba2fd72547e0582d7164
Author: Patrick Schleizer <adrelanos@whonix.org>
Date:   Mon May 15 15:29:06 2023 +0000

    nftables WIP

commit 7e584e268ca9334ac6603d036b1326095971b24d
Author: Patrick Schleizer <adrelanos@whonix.org>
Date:   Mon May 15 15:27:51 2023 +0000

    add `translate-remove-iptables-comments`

commit c621fd2841f20eb72cf680aaf54b0b20684d8277
Author: Patrick Schleizer <adrelanos@whonix.org>
Date:   Mon May 15 15:09:12 2023 +0000

    nftables WIP

commit 3fd2f34307b7750c98d390f5658b9368f7e1ce1f
Author: Patrick Schleizer <adrelanos@whonix.org>
Date:   Mon May 15 15:08:30 2023 +0000

    nftables WIP

commit 7853ad1c2427028d3904a50587b3ce9d16f6b6f6
Author: Patrick Schleizer <adrelanos@whonix.org>
Date:   Mon May 15 14:32:52 2023 +0000

    nftables WIP

commit d990036cab16ccc9538a1f790617817136473888
Author: Patrick Schleizer <adrelanos@whonix.org>
Date:   Mon May 15 14:29:31 2023 +0000

    nftables WIP

commit afbea6d5656996bba04b1e7df1f0d21ee48696ed
Author: Patrick Schleizer <adrelanos@whonix.org>
Date:   Mon May 15 14:28:18 2023 +0000

    nftables WIP

commit 781f4df096e8438273fd1b90a4e2d0f908bb8d64
Author: Patrick Schleizer <adrelanos@whonix.org>
Date:   Mon May 15 14:26:47 2023 +0000

    nftables WIP

commit 5ab59728ba3ab89de2066c8593210081974136d9
Author: Patrick Schleizer <adrelanos@whonix.org>
Date:   Mon May 15 14:23:45 2023 +0000

    nftables WIP

commit bfda76f7509206281163a5ab46457d9429771d45
Author: Patrick Schleizer <adrelanos@whonix.org>
Date:   Mon May 15 14:21:52 2023 +0000

    nftables WIP

commit 228e2c2a4eae61cf3dac1ff7ed42e76d2e9dad81
Author: Patrick Schleizer <adrelanos@whonix.org>
Date:   Mon May 15 14:18:27 2023 +0000

    port to `nftables` work in progress:

    - `whonix-gateway-firewall.nftables`
    - `whonix-workstation-firewall.nftables`

    translated using `translate-iptables-to-nftables`
    (Which uses `iptables-translate`.)

commit a35e3bfdd7cf55747e3931aa5f518d9c9b2dccf2
Author: Patrick Schleizer <adrelanos@whonix.org>
Date:   Mon May 15 14:15:55 2023 +0000

    add translate-iptables-to-nftables

commit 99874541b2d131019f724f662cfed1dbd8a39397
Author: Patrick Schleizer <adrelanos@whonix.org>
Date:   Mon May 15 13:20:03 2023 +0000

    make firewall scripts easier to translate to nftables

commit 2f8bac88817940adb5143739bc099c1c37fcb0b9
Author: Patrick Schleizer <adrelanos@whonix.org>
Date:   Mon May 15 13:12:31 2023 +0000

    make firewall scripts easier to translate to nftables

commit ad68f98c74a43bb8102bac1c552622496dc337e7
Author: Patrick Schleizer <adrelanos@whonix.org>
Date:   Mon May 15 11:56:45 2023 +0000

    bumped changelog version

commit 59c45277be8c88a1e261cbc32d9771e8bbf436bf
Author: Patrick Schleizer <adrelanos@whonix.org>
Date:   Mon May 15 11:56:20 2023 +0000

    remove unicode

commit 6fc473dd989a6ca7cca4861cd40c610a93ca378e
Author: Patrick Schleizer <adrelanos@whonix.org>
Date:   Mon May 15 11:53:10 2023 +0000

    comment

commit 69833fc1612da1beb096a681397798e1263856a1
Author: Patrick Schleizer <adrelanos@whonix.org>
Date:   Mon May 15 11:52:09 2023 +0000

    support new setting `GATEWAY_ALLOW_INCOMING_RELATED_STATE=1`

    disabled by default

    if enabled:

    Allow ESTABLISHED,RELATED instead of only ESTABLISHED.

    Reported to be required sometimes for Whonix KVM.

    https://forums.whonix.org/t/tor-is-not-yet-fully-bootstrapped-30-done/8792/3
    https://forums.whonix.org/t/have-firewall-accept-icmp-fragmentation-needed/10233
    https://phabricator.whonix.org/T28

commit 33bf8ac8c599dc744fcf005e52c8b4c3e82c655e
Merge: b2ff0e3 810b740
Author: Patrick Schleizer <adrelanos@whonix.org>
Date:   Mon May 15 11:38:35 2023 +0000

    Merge remote-tracking branch 'github-whonix/master'

commit 810b740fd144294d85670a8d5d04e3d067f0de3d
Merge: b2ff0e3 f604259
Author: Patrick Schleizer <adrelanos@whonix.org>
Date:   Mon May 15 07:37:57 2023 -0400

    Merge pull request #3 from IainKay/allow-incoming-related-state

    add opt-in configuration for incoming Related connections through 'gateway_allow_incoming_related_state'

commit b2ff0e370d42fa8bf3e935c2bcb5b7a8ecdb1ea4
Author: Patrick Schleizer <adrelanos@whonix.org>
Date:   Wed May 10 23:16:43 2023 +0000

    bumped changelog version

commit 2b01fe561435cdd86d76971dedab464b85913e3d
Author: Patrick Schleizer <adrelanos@whonix.org>
Date:   Wed May 10 12:13:19 2023 +0000

    add deterministic tabels dumps for later comparison

    after port to nftables

commit f604259dd55e5dde4765ac7e2ad095d95258caa0
Author: Iain Kay <github@iain.it>
Date:   Mon May 8 20:05:52 2023 +0100

    add opt-in configuration for incoming Related connections through 'gateway_allow_incoming_related_state'

    When running a freshly installed Whonix-Gateway (confirmed that at least 16.0.9.8 and 16.0.9.0 are affected) on a KVM host (note: with Kicksecure installed on the host), Tor gets stuck at 30% when attempting to bootstrap.

    When I enable the new configuration option "GATEWAY_ALLOW_INCOMING_RELATED_STATE" in file "/usr/local/etc/whonix_firewall.d/50_user.conf", this allows the connection to complete successfully every time.

    When I disable the "GATEWAY_ALLOW_INCOMING_RELATED_STATE" option I observe that the issue returns.

    I saw a suggestion on the Whonix forums (I believe from Patrick Schleizer) that this could be made into a configuration option. Rather than wasting time replying saying: "yes please I would love this", I've gone ahead and made the necessary changes myself.

    Tested on my end and confirmed that this is working as expected.

commit efc9844a78b35ff295b9d224b620e471e79d3bd7
Author: Patrick Schleizer <adrelanos@whonix.org>
Date:   Mon Sep 26 16:19:15 2022 -0400

    bumped changelog version

commit 48eb9e019551ea714fb6b1ee8de54c3b7c168571
Author: Patrick Schleizer <adrelanos@whonix.org>
Date:   Mon Sep 26 16:16:24 2022 -0400

    shfmt

commit 029a6048148786fa1ccc98b5ca1f1552dcd64226
Author: Patrick Schleizer <adrelanos@whonix.org>
Date:   Mon Sep 26 16:07:45 2022 -0400

    bumped changelog version

commit ebc69f2718c9edb8ae6cbb6dc9070108b9a902d1
Author: Patrick Schleizer <adrelanos@whonix.org>
Date:   Mon Sep 26 16:07:24 2022 -0400

    shfmt

commit 9d364febd84cdb739f3703975ee39324f21e4d87
Author: Patrick Schleizer <adrelanos@whonix.org>
Date:   Mon Sep 26 16:04:57 2022 -0400

    shfmt

commit 4d036535a3ef0faeb7b27d0f5cc4d7e76ca5761c
Author: Patrick Schleizer <adrelanos@whonix.org>
Date:   Mon Sep 26 16:03:08 2022 -0400

    shfmt

commit 0184644af7ed966b478450abaef4800ba27877d6
Author: Patrick Schleizer <adrelanos@whonix.org>
Date:   Mon Sep 26 15:32:23 2022 -0400

    bumped changelog version

commit 058c03186f9474ba7223a4766d4ed92e89a750ba
Author: Patrick Schleizer <adrelanos@whonix.org>
Date:   Mon Sep 26 15:31:42 2022 -0400

    verbosity

commit 6b89523b06aa3886d2291421e2a299b663f1bac3
Author: Patrick Schleizer <adrelanos@whonix.org>
Date:   Mon Sep 26 15:28:25 2022 -0400

    refactoring

commit cdf359736aa6e81e0c7200723849afd0b2ba9277
Author: Patrick Schleizer <adrelanos@whonix.org>
Date:   Mon Sep 26 15:23:46 2022 -0400

    set all defaults first before parsing config folder

    Thanks to @nyxnor for the report!

    https://forums.whonix.org/t/how-to-unset-firewall-array/15604

commit 4a8faa6cce08f31f6b6dcb77556f900013b4bf34
Merge: 9da705e 67760a6
Author: Patrick Schleizer <adrelanos@whonix.org>
Date:   Mon Sep 26 15:21:08 2022 -0400

    Merge remote-tracking branch 'github-whonix/master'

commit 67760a66e95b41fd2bb85ff3a63fd2279fff1a37
Merge: 9da705e 5ec6e1f
Author: Patrick Schleizer <adrelanos@whonix.org>
Date:   Mon Sep 26 15:15:37 2022 -0400

    Merge pull request #1 from nyxnor/master

    info messages to firewall

commit 5ec6e1fac57c5dd6d5f6a80170c61476e95141b3
Author: nyxnor <nyxnor@protonmail.com>
Date:   Mon Sep 26 15:58:16 2022 +0000

    not opening ports instead of closing, wording

commit 3c5fd6b4eb446cd997384818bee35d2baf0629bc
Author: nyxnor <nyxnor@protonmail.com>
Date:   Mon Sep 26 15:49:08 2022 +0000

    be verbose no port is being opened

commit 682be4c3c74668f21aa873bfe92c3a52d8caf81b
Author: nyxnor <nyxnor@protonmail.com>
Date:   Mon Sep 26 15:41:25 2022 +0000

    double quote "$@"

commit b303e37017a25fe6893cc739cde430755f3c1f92
Author: nyxnor <nyxnor@protonmail.com>
Date:   Mon Sep 26 15:32:33 2022 +0000

    always inform SOCKSIFIED if set to '0'

commit 950cdaf1a721aa3e5230ab83d1fe678b84a64a56
Author: nyxnor <nyxnor@protonmail.com>
Date:   Mon Sep 26 14:29:00 2022 +0000

    print informational messages

    https://forums.whonix.org/t/print-ports-opened-in-the-firewall/15469

commit 6e0dd7bed6138f2121938399b6d30bc9f2016ce1
Author: nyxnor <nyxnor@protonmail.com>
Date:   Mon Sep 26 14:28:23 2022 +0000

    make the main script pass arguments to child

    also make the script be called by path, so easier to test by placing script at /usr/local/bin

commit 9da705ed2ce94994c952df4c8cd57631a1b83b7a
Author: Patrick Schleizer <adrelanos@whonix.org>
Date:   Wed Jun 8 11:13:16 2022 -0400

    bumped changelog version

commit 1ce2cbaf1243145b5c3b1b0eccf7b8c5173b3a54
Author: Patrick Schleizer <adrelanos@whonix.org>
Date:   Wed Jun 8 09:40:16 2022 -0400

    copyright

commit 4b1fa46f649a4545b7e761b9727867ca64e1dda3
Author: Patrick Schleizer <adrelanos@whonix.org>
Date:   Tue Mar 22 09:40:44 2022 -0400

    rename

commit a965dcb3b078d79888b8931a0d31664a20242259
Author: Patrick Schleizer <adrelanos@whonix.org>
Date:   Tue Mar 22 09:18:13 2022 -0400

    rename

commit 770bb49ac60eb9278f47ca2c545245f18858ced0
Author: Patrick Schleizer <adrelanos@whonix.org>
Date:   Sun Mar 13 08:05:39 2022 -0400

    bumped changelog version

commit 8c682cc28ad2fe0537672c94ebe6e6a232de9356
Author: Patrick Schleizer <adrelanos@whonix.org>
Date:   Sun Mar 13 07:52:37 2022 -0400

    lower debugging

commit d48fe59fc780a2721219c285a60933281d2774c7
Author: Patrick Schleizer <adrelanos@whonix.org>
Date:   Thu Dec 9 03:42:41 2021 -0500

    bumped changelog version

commit 8b24141b046785edc94b1d4584b01c9e65663f68
Author: Patrick Schleizer <adrelanos@whonix.org>
Date:   Sat Dec 4 16:08:58 2021 -0500

    output

commit 61e95c4c9908856abf5ba60efbc6c7f0f90cb140
Author: Patrick Schleizer <adrelanos@whonix.org>
Date:   Sat Dec 4 16:07:46 2021 -0500

    refactoring

commit 9cb99610d5193dda547457ae2f864f5e1de427cd
Author: Patrick Schleizer <adrelanos@whonix.org>
Date:   Sat Dec 4 16:06:41 2021 -0500

    refactoring

commit 79b0ded43249414570b614b01d0a5710b227690c
Author: Patrick Schleizer <adrelanos@whonix.org>
Date:   Sat Dec 4 16:04:56 2021 -0500

    refactoring

commit cda126ad2bdde60c42a3fc3349845ad3afc5ebf4
Author: Patrick Schleizer <adrelanos@whonix.org>
Date:   Sat Dec 4 16:03:48 2021 -0500

    use `curl` with `--cert-status`

    Thanks for @yodawins for the suggestion!

    https://forums.whonix.org/t/scurl-secure-curl-wrapper/7125/8

commit 7cc5b0d978bd74c338718c208d70ea861e8afb3d
Author: Patrick Schleizer <adrelanos@whonix.org>
Date:   Tue Nov 9 14:32:36 2021 -0500

    readme

commit 9d29605a8ae1fc6ce1b4828cc824e11b764596a6
Author: Patrick Schleizer <adrelanos@whonix.org>
Date:   Mon Nov 1 05:42:41 2021 -0400

    bumped changelog version

commit 3084000a7a828c6c76d883f2823c02b886a25eff
Author: Patrick Schleizer <adrelanos@whonix.org>
Date:   Mon Nov 1 05:03:53 2021 -0400

    apparmor

commit a4924da6f63ccbe4608d2d8a84f897a5646f5830
Author: Patrick Schleizer <adrelanos@whonix.org>
Date:   Sun Oct 31 19:30:47 2021 -0400

    bumped changelog version

commit 3ef7c83325a1ae46fcf8633d2aed9c7ff5856481
Author: Patrick Schleizer <adrelanos@whonix.org>
Date:   Sun Oct 31 19:29:50 2021 -0400

    apparmor

commit 89d4750b7e0af974d6a9b59efa9b0c2e2133f5ed
Author: Patrick Schleizer <adrelanos@whonix.org>
Date:   Sun Oct 24 15:28:35 2021 -0400

    bumped changelog version

commit 0dcdd8d318f895aee862d618778edbdb27647443
Author: Patrick Schleizer <adrelanos@whonix.org>
Date:   Sun Oct 24 14:03:58 2021 -0400

    add opt-in configuration for outgoing IP filtering through `outgoing_allow_ip_list`

commit 03906e21a2e7b7336719aaf6ca39e6f1a04dab60
Author: Patrick Schleizer <adrelanos@whonix.org>
Date:   Tue Sep 21 06:27:32 2021 -0400

    bumped changelog version

commit 81c92bcb6e49364bf78482b0015f4d75b1868f71
Author: Patrick Schleizer <adrelanos@whonix.org>
Date:   Tue Sep 21 06:27:21 2021 -0400

    apparmor

commit 200ec7b2521c2877baafc5c45ccea28e867e93b9
Author: Patrick Schleizer <adrelanos@whonix.org>
Date:   Sun Sep 12 12:05:43 2021 -0400

    bumped changelog version

commit 1395a11ddbff511a1ab3c312891dd50c8da9ea87
Author: Patrick Schleizer <adrelanos@whonix.org>
Date:   Sat Sep 11 16:31:47 2021 -0400

    readme

commit 6a209b045c97e9d80db732f442d59ba6a29fb8a5
Author: Patrick Schleizer <adrelanos@whonix.org>
Date:   Sun Aug 22 06:41:28 2021 -0400

    bumped changelog version

commit 69e89b344c3cffaa9553b83b77858d60f040fba8
Author: Patrick Schleizer <adrelanos@whonix.org>
Date:   Sun Aug 22 06:40:42 2021 -0400

    TODO: /{,usr/}bin/qubesdb-cmd rUx,

commit d6cf54fd54ad5c35454b0a1d820d307d335c0874
Author: Patrick Schleizer <adrelanos@whonix.org>
Date:   Sun Aug 22 06:31:41 2021 -0400

    bumped changelog version

commit 3f49f174091e5e84a801c81fc36082c7ad135e5a
Author: Patrick Schleizer <adrelanos@whonix.org>
Date:   Sun Aug 22 06:31:24 2021 -0400

    owner /run/updatesproxycheck/** rw,

commit 21317957712f70582e4c563466f777f32ba93d27
Author: Patrick Schleizer <adrelanos@whonix.org>
Date:   Sun Aug 22 05:52:50 2021 -0400

    bumped changelog version

commit c9356e1e34b50fbc2de0a3d73e0f0c50cd486f92
Author: Patrick Schleizer <adrelanos@whonix.org>
Date:   Sun Aug 22 05:52:22 2021 -0400

    TODO: /{,usr/}bin/qubesdb-read rUx

commit e4f01a898909f9511bf5c8f7458299b518cf8a07
Author: Patrick Schleizer <adrelanos@whonix.org>
Date:   Tue Aug 17 14:01:45 2021 -0400

    bumped changelog version

commit 9638692ebb014a99d6b064f258f2fa340ac7a731
Author: Patrick Schleizer <adrelanos@whonix.org>
Date:   Tue Aug 17 14:01:32 2021 -0400

    apparmor

commit 98a0b91a53d115cd042bb3c7663a4470be02aece
Author: Patrick Schleizer <adrelanos@whonix.org>
Date:   Tue Aug 17 13:59:41 2021 -0400

    After=systemd-modules-load.service

    required for LKRG
    otherwise iptables modules cannot be auto load

commit 24752511bd56ad01251cb329e4d4bd7599581284
Author: Patrick Schleizer <adrelanos@whonix.org>
Date:   Mon Aug 16 16:22:47 2021 -0400

    bumped changelog version

commit a64c6bd19810df3fdb36d68f29d5acfb27ab43e4
Author: Patrick Schleizer <adrelanos@whonix.org>
Date:   Mon Aug 16 16:08:27 2021 -0400

    update path

commit fa732e9634a44fa5a5952eebef953d735be64106
Author: Patrick Schleizer <adrelanos@whonix.org>
Date:   Mon Aug 16 16:07:27 2021 -0400

    /var/log/journal/{,**} r,

commit 24e81cc806237596c35b50263dd180e7026e43ad
Author: Patrick Schleizer <adrelanos@whonix.org>
Date:   Thu Aug 5 17:13:33 2021 -0400

    bumped changelog version

commit b935b29546023ef926c805dc7f3f325365a56634
Author: Patrick Schleizer <adrelanos@whonix.org>
Date:   Wed Aug 4 15:02:22 2021 -0400

    lintian FHS

commit 93bc0e23dfbc24dabd37c3f158e17e137452ec01
Author: Patrick Schleizer <adrelanos@whonix.org>
Date:   Wed Aug 4 15:01:44 2021 -0400

    lintian FHS

commit d0a9e1aac50c471a33cd24d14a958e3f2b1b279a
Author: Patrick Schleizer <adrelanos@whonix.org>
Date:   Tue Aug 3 12:49:00 2021 -0400

    move /usr/lib/helper-scripts and /usr/lib/curl-scripts to /usr/libexec/helper-scripts as per lintian FHS

commit 1e0a642369bfde96ca10c442d294ac5f9f98662c
Author: Patrick Schleizer <adrelanos@whonix.org>
Date:   Tue Aug 3 11:47:37 2021 -0400

    re-generate man pages (generated using "genmkfile manpages")

commit 7fb26cd51d7c7125ad0737af57fc811db2f60cc9
Author: Patrick Schleizer <adrelanos@whonix.org>
Date:   Tue Aug 3 11:45:18 2021 -0400

    man page

commit 1d81c9e66367a86debf38fc73e40d882d4e317e5
Author: Patrick Schleizer <adrelanos@whonix.org>
Date:   Tue Aug 3 05:48:29 2021 -0400

    bullseye

commit e3542b651230686ccb463e216884e64714b7dbb6
Author: Patrick Schleizer <adrelanos@whonix.org>
Date:   Sun Aug 1 16:24:51 2021 -0400

    readme

commit ca86e40053c7226751765a298421746a72967342
Author: Patrick Schleizer <adrelanos@whonix.org>
Date:   Wed Jun 9 11:03:55 2021 -0400

    bumped changelog version

commit ff3e83a1ef0427d1854fa51bed4cd56fd77fa339
Merge: f7544f3 3e0967a
Author: Patrick Schleizer <adrelanos@whonix.org>
Date:   Wed Jun 9 10:46:17 2021 -0400

    Merge remote-tracking branch 'github-whonix/master'

commit 3e0967a041c0b62a28bdf6b4c37802af267a0a7a
Merge: f7544f3 b5e89fb
Author: Patrick Schleizer <adrelanos@whonix.org>
Date:   Wed Jun 9 10:45:27 2021 -0400

    Merge pull request #9 from madaidan/denials

    Fix denial errors

commit b5e89fb8e13e8b64006aa65cd39baa2c50abe823
Author: madaidan <50278627+madaidan@users.noreply.github.com>
Date:   Tue Jun 8 20:04:31 2021 +0000

    Fix denial errors

commit f7544f3792e98c9382107ec5f23ce3c87e5c15d8
Author: Patrick Schleizer <adrelanos@whonix.org>
Date:   Sun Apr 18 04:21:08 2021 -0400

    bumped changelog version

commit 65c3ca57e2ba26b1a270c6e32867bd6457530d90
Author: Patrick Schleizer <adrelanos@whonix.org>
Date:   Sun Apr 18 04:20:24 2021 -0400

    fix

    https://forums.whonix.org/t/internal-open-ports-setting/11404

commit 96043b135d40996f876925d85010c37ff3fa4699
Author: Patrick Schleizer <adrelanos@whonix.org>
Date:   Sun Apr 18 04:00:21 2021 -0400

    bumped changelog version

commit 3454cc6babcfe3fa182f834eabd865207092a287
Author: Patrick Schleizer <adrelanos@whonix.org>
Date:   Sun Apr 18 03:56:26 2021 -0400

    comment

commit 05a3701c37bfb4e4fa769129dd8d4ff65765e95b
Author: Patrick Schleizer <adrelanos@whonix.org>
Date:   Sun Apr 18 03:54:00 2021 -0400

    fix

    https://forums.whonix.org/t/internal-open-ports-setting/11404

commit 786da8da790da66ff6b3e807da06a6947a61a39d
Author: Patrick Schleizer <adrelanos@whonix.org>
Date:   Sun Apr 18 03:52:26 2021 -0400

    minor

commit 00d561c3ee2e6de7de58e237c1eea93c43bccd84
Author: Patrick Schleizer <adrelanos@whonix.org>
Date:   Sun Apr 18 03:51:53 2021 -0400

    minor

commit ad16784531fa81384a1fa70208f2ec3cfedced5c
Author: Patrick Schleizer <adrelanos@whonix.org>
Date:   Sun Apr 18 03:50:10 2021 -0400

    minor

commit 325c9ef2db7b24c1ce059c2528980c8674009e80
Author: Patrick Schleizer <adrelanos@whonix.org>
Date:   Sat Apr 17 08:23:24 2021 -0400

    bumped changelog version

commit 490e3409e1c86c10f17fc35ebecf95093bef3d7d
Author: Patrick Schleizer <adrelanos@whonix.org>
Date:   Sat Apr 10 19:20:55 2021 -0400

    fix

commit 24dd32c992a426c43d08e972fb8004614a314f75
Author: Patrick Schleizer <adrelanos@whonix.org>
Date:   Sat Apr 10 19:19:25 2021 -0400

    remove deprecated variable SOCKS_PORT_TBB_GPG

commit 4949f4e8721b5ec219fd3e2dd8fe9763f3980683
Author: Patrick Schleizer <adrelanos@whonix.org>
Date:   Sat Apr 10 19:16:44 2021 -0400

    comment

commit 674e313906b59087cd1f6dcb8a574192c24e3a2f
Author: Patrick Schleizer <adrelanos@whonix.org>
Date:   Sat Apr 10 19:14:31 2021 -0400

    fix

commit ce798b56e00d6969124d414477d2f6a7af2e588c
Author: Patrick Schleizer <adrelanos@whonix.org>
Date:   Sat Apr 10 19:12:12 2021 -0400

    refactoring

    https://forums.whonix.org/t/internal-open-ports-setting/11404

commit d10be32db0e745a9b439e9e8a3d398dd6c278e33
Author: Patrick Schleizer <adrelanos@whonix.org>
Date:   Sat Apr 10 18:51:38 2021 -0400

    comment

commit 810e08f2b21a65387208926d72a3379008af8ae2
Author: Patrick Schleizer <adrelanos@whonix.org>
Date:   Sat Apr 10 18:49:47 2021 -0400

    refactoring

commit f8fce1133fbb1408b281dd9175b781f657fa3d5e
Author: Patrick Schleizer <adrelanos@whonix.org>
Date:   Sat Apr 10 18:46:18 2021 -0400

    Whonix-Gateway firewall: implement INTERNAL_OPEN_PORTS

    Deprecate support for `SOCKS_PORT_CUSTOM=" 9230 "` syntax,
    use INTERNAL_OPEN_PORTS+=" 9230 " instead.

    refactoring / code simplification

    https://forums.whonix.org/t/internal-open-ports-setting/11404

commit 3f39be5fe4b5d8b2ac335313631b0e6f896ae580
Author: Patrick Schleizer <adrelanos@whonix.org>
Date:   Thu Mar 18 09:16:29 2021 -0400

    bumped changelog version

commit 8b1f94d6947561085fff036af118b9a767e260bd
Author: Patrick Schleizer <adrelanos@whonix.org>
Date:   Thu Mar 18 08:57:25 2021 -0400

    copyright

commit c8492a1627a8c960af28917d4f03d20081d8acb9
Author: Patrick Schleizer <adrelanos@whonix.org>
Date:   Wed Mar 17 12:48:02 2021 -0400

    bumped changelog version

commit 6ba4e4bcbbcaea78b674e0d7df846034836c5057
Author: Patrick Schleizer <adrelanos@whonix.org>
Date:   Wed Mar 17 09:45:25 2021 -0400

    copyright

commit d020d387d56c8ca80251cbbc7c2ff306156d9bb5
Author: Patrick Schleizer <adrelanos@whonix.org>
Date:   Mon Feb 15 09:25:44 2021 -0500

    bumped changelog version

commit 179bfa820381cace9659a9b4755cc5c4ebd85d48
Author: Patrick Schleizer <adrelanos@whonix.org>
Date:   Mon Feb 15 09:25:43 2021 -0500

    readme

commit 21b467cb71400da373aa3b96bf76d8b22c9ff65b
Author: Patrick Schleizer <adrelanos@whonix.org>
Date:   Fri Feb 12 03:30:55 2021 -0500

    disable the following Tor stream isolation ports

    - privoxy 9112
    - polipo 9113
    - Tor Browser Updater by Whonix Developers gpg 9116
    - TorChat 9119
    - mixmaster update 9120
    - mixmaster 9121

    since deprecated applications in Whonix and no longer in use

commit 18599d0a9e3382280d8028a7283cc1fbefe25bb5
Author: Patrick Schleizer <adrelanos@riseup.net>
Date:   Tue Jan 26 09:54:41 2021 -0500

    bumped changelog version

commit 2a58d628f23e3e74d50bdf58928e8c211a71b26a
Author: Patrick Schleizer <adrelanos@riseup.net>
Date:   Tue Jan 26 07:08:36 2021 -0500

    whonixcheck -> systemcheck migration

commit 1459c4bc9a1b08228e44a93a582045eb86d23500
Author: Patrick Schleizer <adrelanos@riseup.net>
Date:   Sat Jan 9 01:43:17 2021 -0500

    bumped changelog version

commit 3321bfd14f3b4f50f1699aba1a9193f555688e9a
Author: Patrick Schleizer <adrelanos@riseup.net>
Date:   Sat Jan 9 00:54:46 2021 -0500

    update path

    https://phabricator.whonix.org/T1001

commit c43b1fb954d30a1e87ac49a09261a6f2bb886b3e
Author: Patrick Schleizer <adrelanos@riseup.net>
Date:   Sat Nov 14 11:58:18 2020 -0500

    bumped changelog version

commit 111c24d3b7dff86f282bcce26419a1d11a9b4c2a
Author: Patrick Schleizer <adrelanos@riseup.net>
Date:   Sat Nov 14 08:01:10 2020 -0500

    IP HARDCODED

commit 425e7db90040c894e94b6b0a8faf03eac11d0e7f
Author: Patrick Schleizer <adrelanos@riseup.net>
Date:   Thu Oct 29 16:21:23 2020 -0400

    bumped changelog version

commit 6be33c51a4a35e7340032470356a2f0a25c90f1e
Author: Patrick Schleizer <adrelanos@riseup.net>
Date:   Thu Oct 29 16:14:17 2020 -0400

    --tlsv1.3

commit 863e3b4604bd4b26216d65baca3f67de41ff3699
Author: Patrick Schleizer <adrelanos@riseup.net>
Date:   Tue Oct 13 12:35:08 2020 -0400

    bumped changelog version

commit 4825aca0b34438a2e4a392bad174674d53fdb33f
Author: Patrick Schleizer <adrelanos@riseup.net>
Date:   Tue Oct 13 12:35:07 2020 -0400

    readme

commit f5487cb0eeea7202dc916f83b63e38b6fb44adfd
Merge: 81d39af 016a01a
Author: Patrick Schleizer <adrelanos@riseup.net>
Date:   Fri Oct 9 10:42:53 2020 -0400

    Merge remote-tracking branch 'github/master'

commit 016a01a78bf620947372b884e842f219844aca8d
Merge: 81d39af f91ee6b
Author: Patrick Schleizer <adrelanos@riseup.net>
Date:   Fri Oct 9 14:42:24 2020 +0000

    Merge pull request #8 from madaidan/apparmor

    AppArmor fix

commit f91ee6ba5aa65fcd11efaa6b7275de4db431bd21
Author: madaidan <50278627+madaidan@users.noreply.github.com>
Date:   Fri Oct 9 14:37:11 2020 +0000

    Fix

commit 81d39af305b29b6ed5271a6017f19c13eac8c283
Author: Patrick Schleizer <adrelanos@riseup.net>
Date:   Mon Sep 14 06:45:42 2020 -0400

    bumped changelog version

commit 0964ee8ce4d40b0c50c81588d820441e66a07beb
Author: Patrick Schleizer <adrelanos@riseup.net>
Date:   Mon Sep 14 06:41:51 2020 -0400

    add configuration option `firewall_allow_udp=true` to allow outgoing UDP

commit 8a78037bbf978c6d707c40d9eb7c218fc2828a93
Author: Patrick Schleizer <adrelanos@riseup.net>
Date:   Sat Sep 5 05:25:55 2020 -0400

    bumped changelog version

commit ac6e7a8fcf195747b69428dc5d4847435dbf03c8
Merge: 2fcafcc 7bac90a
Author: Patrick Schleizer <adrelanos@riseup.net>
Date:   Sat Sep 5 05:24:47 2020 -0400

    Merge remote-tracking branch 'github/master'

commit 7bac90ad0be19865f9b38fc37fc0989948f2027e
Merge: 2fcafcc 840176c
Author: Patrick Schleizer <adrelanos@riseup.net>
Date:   Sat Sep 5 08:57:51 2020 +0000

    Merge pull request #6 from madaidan/fixes

    Fixes

commit 840176c7c906c475b6bc78e1c8b1d0681713536b
Author: madaidan <50278627+madaidan@users.noreply.github.com>
Date:   Fri Sep 4 19:37:01 2020 +0000

    Fixes

commit 2fcafccaa91d1333689b432e8a9a74bd0c300113
Author: Patrick Schleizer <adrelanos@riseup.net>
Date:   Tue Aug 25 12:17:16 2020 -0400

    bumped changelog version

commit 390a47b68f97336952e6afc092c2c66f4cf948a7
Author: Patrick Schleizer <adrelanos@riseup.net>
Date:   Tue Aug 25 11:01:13 2020 -0400

    remove auto restart feature if networking did not come up

    remove /lib/systemd/system/onion-grater.service.d/30_whonix_cpfpy.conf

    fixes https://forums.whonix.org/t/bug-restart-of-sdwdate-in-whonix-gateway-causes-100-cpu-use-of-tor-browser-in-whonix-workstation/9541/15

    fixes https://github.com/QubesOS/qubes-issues/issues/4969

commit 8434ba010debc74eaca4460b52cc8d658e71f6be
Author: Patrick Schleizer <adrelanos@riseup.net>
Date:   Thu Apr 16 08:50:55 2020 -0400

    bumped changelog version

commit d5a7b25e4f1aad7b4d264541c57b17bad7ff1bbc
Author: Patrick Schleizer <adrelanos@riseup.net>
Date:   Wed Apr 15 14:05:41 2020 -0400

    readme

commit 2ac277812c7f1d532f7d0f7fedbeda9e69183d96
Author: Patrick Schleizer <adrelanos@riseup.net>
Date:   Thu Apr 9 12:43:33 2020 +0000

    bumped changelog version

commit b12d47f0cdb0888140cde4013a1880c5466f244e
Author: Patrick Schleizer <adrelanos@riseup.net>
Date:   Thu Apr 9 12:18:14 2020 +0000

    output

commit 6fcc74d4820124e1e7a8977c2944e27095b2359d
Author: Patrick Schleizer <adrelanos@riseup.net>
Date:   Thu Apr 9 12:11:12 2020 +0000

    bumped changelog version

commit cfe0b6067b936c6159cff24936a1136b676811db
Author: Patrick Schleizer <adrelanos@riseup.net>
Date:   Thu Apr 9 11:48:51 2020 +0000

    reduce log verbosity
    no longer write to /var/log/sdwdate.log
    code simplification

commit f52be299cc7020c5c53ceda0525e1ba92778a031
Author: Patrick Schleizer <adrelanos@riseup.net>
Date:   Thu Apr 2 08:09:17 2020 -0400

    bumped changelog version

commit 7a5b3e246160d15e1073f441deab773fa8965103
Author: Patrick Schleizer <adrelanos@riseup.net>
Date:   Thu Apr 2 07:23:03 2020 -0400

    readme

commit 8fcbf0c29d87c0de19f8d554480ee4cb181f69fe
Author: Patrick Schleizer <adrelanos@riseup.net>
Date:   Wed Apr 1 17:35:01 2020 -0400

    remove 'Build-Depends: ronn' since no longer required

commit 105db280c59e19d72578a5460445c857d997cfd3
Author: Patrick Schleizer <adrelanos@riseup.net>
Date:   Wed Apr 1 16:57:35 2020 -0400

    remove genmkfile

commit af09089d721cfea61b117f27efb8c519f6f09bb8
Author: Patrick Schleizer <adrelanos@riseup.net>
Date:   Wed Apr 1 16:34:23 2020 -0400

    add debian install file

commit 21ce53e9005eca53eb35936cc4c1c49e022f6ada
Author: Patrick Schleizer <adrelanos@riseup.net>
Date:   Wed Apr 1 15:56:50 2020 -0400

    add man pages (generated using "genmkfile manpages")

commit 8d7b3270e00a05a6e6732b7e6f8cfcb86cb21d8b
Author: Patrick Schleizer <adrelanos@riseup.net>
Date:   Wed Apr 1 15:50:32 2020 -0400

    no longer create man pages during build process
    use pre-created man pages

commit 27d97007d68dce8de7a1cde4090168fff951cd32
Author: Patrick Schleizer <adrelanos@riseup.net>
Date:   Wed Apr 1 15:43:12 2020 -0400

    change path to auto generated man pages

commit cd1ddb663c4b93676f548a9e630f45e3b0649722
Author: Patrick Schleizer <adrelanos@riseup.net>
Date:   Wed Apr 1 11:12:02 2020 -0400

    bumped changelog version

commit 7825381de3c1686f5989cc330471e9c629ee4b12
Author: Patrick Schleizer <adrelanos@riseup.net>
Date:   Wed Apr 1 09:04:01 2020 -0400

    update copyright year

commit e79399c0d52edc2e73cdbf1040d18fc6101bef68
Author: Patrick Schleizer <adrelanos@riseup.net>
Date:   Wed Apr 1 08:50:02 2020 -0400

    update copyright year

commit cc70a5bc63d5ca8204ba1f8ae315ce1aa2c973ff
Author: Patrick Schleizer <adrelanos@riseup.net>
Date:   Fri Mar 27 07:39:22 2020 -0400

    bumped changelog version

commit e5cf2b23b5e9d4fe708fc00690b400b4786a99fa
Author: Patrick Schleizer <adrelanos@riseup.net>
Date:   Fri Mar 27 07:31:59 2020 -0400

    fix adduser home

commit 175f7a45455fa5f05247d86d516f74e2ad1694eb
Author: Patrick Schleizer <adrelanos@riseup.net>
Date:   Tue Mar 24 03:55:49 2020 -0400

    bumped changelog version

commit f4a01a76fb0c1957fa297d1207db2834853c299f
Author: Patrick Schleizer <adrelanos@riseup.net>
Date:   Tue Mar 24 03:47:22 2020 -0400

    /usr/local/etc/whonix_firewall.d/*.conf

commit ebc095a12c2dc3b8e5e025ad84480944434d26b1
Author: Patrick Schleizer <adrelanos@riseup.net>
Date:   Sun Mar 22 06:15:32 2020 -0400

    bumped changelog version

commit fb4b21883cc2d67242927ac97ba8b60f8461ab40
Author: Patrick Schleizer <adrelanos@riseup.net>
Date:   Sat Mar 21 15:40:06 2020 -0400

    minor

commit 2b90a050feef8781eb71c48d6d36dda2185703c2
Author: Patrick Schleizer <adrelanos@riseup.net>
Date:   Sat Mar 21 15:38:57 2020 -0400

    refactoring

    Just so Whonix-Workstation firewall can be more similar to Whonix-Gateway firewall.

commit 5820b46380677b14c457b759f72aa8bfa0924de3
Author: Patrick Schleizer <adrelanos@riseup.net>
Date:   Sat Mar 21 15:37:20 2020 -0400

    refactoring

commit 32420f7a6d21b171dfe3d32e4a9c500d910b9463
Author: Patrick Schleizer <adrelanos@riseup.net>
Date:   Sat Mar 21 15:36:35 2020 -0400

    comments

commit 1d115bc90eedc6c19db3390731f898a35e137011
Author: Patrick Schleizer <adrelanos@riseup.net>
Date:   Sat Mar 21 15:33:34 2020 -0400

    comment

commit d73bb9e46a98fdc1d323721f821f9b8ab252d528
Author: Patrick Schleizer <adrelanos@riseup.net>
Date:   Sat Mar 21 15:32:48 2020 -0400

    output

commit 8d99f9c542e0de0844b6d21f06621ae1a16a042a
Author: Patrick Schleizer <adrelanos@riseup.net>
Date:   Sat Mar 21 15:31:53 2020 -0400

    comment

commit ba3d73bbc21603519e6a5a5ccdeb9d5b98c1f3d6
Author: Patrick Schleizer <adrelanos@riseup.net>
Date:   Sat Mar 21 15:29:09 2020 -0400

    comment

commit 8cda8af2e143a377ac43ad9058cacc84f460ea72
Author: Patrick Schleizer <adrelanos@riseup.net>
Date:   Sat Mar 21 15:28:42 2020 -0400

    config

commit 65b1028fb13e75a00eb7ec1e42a920966425fdd3
Author: Patrick Schleizer <adrelanos@riseup.net>
Date:   Sat Mar 21 15:26:45 2020 -0400

    import from whonix-host-firewall

commit 2b69ab3be420036d343ff3bf45a04e86034bb576
Author: Patrick Schleizer <adrelanos@riseup.net>
Date:   Sat Mar 21 15:24:37 2020 -0400

    improve Whonix-Host detection

commit 3a7b142b102e8e2d38562cb22c74fc36ad996c97
Author: Patrick Schleizer <adrelanos@riseup.net>
Date:   Sat Mar 21 15:23:49 2020 -0400

    improve Whonix-Host detection

commit fc0d2e25847aca89ced79ec149047639980b3910
Author: Patrick Schleizer <adrelanos@riseup.net>
Date:   Sat Mar 21 15:22:00 2020 -0400

    Whonix-Host detection

commit b90214f6226e0a011ffef5d1181b4ff16b4e2c4a
Author: Patrick Schleizer <adrelanos@riseup.net>
Date:   Sat Mar 21 15:18:01 2020 -0400

    import from whonix-host-firewall

commit 1bd560ff6c8c969db81994dd22e0b780a7b942e1
Author: Patrick Schleizer <adrelanos@riseup.net>
Date:   Mon Jan 13 12:33:54 2020 -0500

    bumped changelog version

commit c947e14a682299f6d5c724bc22176b6bdf700021
Merge: 16932a0 bdfed09
Author: Patrick Schleizer <adrelanos@riseup.net>
Date:   Mon Jan 13 12:32:24 2020 -0500

    Merge remote-tracking branch 'origin/master'

commit bdfed09ba6b55e2699ef21f760c17ef7879b2d4b
Merge: 16932a0 a47ea08
Author: Patrick Schleizer <adrelanos@riseup.net>
Date:   Mon Jan 13 17:32:05 2020 +0000

    Merge pull request #5 from madaidan/apparmor

    Allow ptracing

commit a47ea08768ca2a4133a02befb901eebb38d28131
Author: madaidan <50278627+madaidan@users.noreply.github.com>
Date:   Mon Jan 13 17:27:18 2020 +0000

    Allow ptracing

commit 16932a004befd1b2c175648f29e6eb77c42f2cc5
Author: Patrick Schleizer <adrelanos@riseup.net>
Date:   Wed Jan 1 15:10:16 2020 -0500

    bumped changelog version

commit d91bee55eb1c93e52ef98da6b04799750e2264ee
Author: Patrick Schleizer <adrelanos@riseup.net>
Date:   Wed Jan 1 14:42:36 2020 -0500

    remove trailing spaces

commit c353115081e6737b06a053bbc5f05bf16d3fc6ba
Merge: 602a347 9b7973c
Author: Patrick Schleizer <adrelanos@riseup.net>
Date:   Wed Jan 1 14:42:10 2020 -0500

    Merge remote-tracking branch 'origin/master'

commit 9b7973c5a2a66aeba6b214514b84325c91b51ee3
Merge: 602a347 e9c6a61
Author: Patrick Schleizer <adrelanos@riseup.net>
Date:   Wed Jan 1 19:37:25 2020 +0000

    Merge pull request #4 from madaidan/apparmor

    Apparmor fixes

commit e9c6a61ff1bef4d60b61f0d49e82fcc3aa09c502
Author: madaidan <50278627+madaidan@users.noreply.github.com>
Date:   Wed Jan 1 17:50:32 2020 +0000

    Apparmor fixes

commit 602a3474ad26ff0b6e10f21faa07d113cfdac932
Author: Patrick Schleizer <adrelanos@riseup.net>
Date:   Wed Dec 25 06:04:06 2019 -0500

    bumped changelog version

commit dfaa42d2d3b4b04eace785efa908a2467b572423
Author: Patrick Schleizer <adrelanos@riseup.net>
Date:   Tue Dec 24 18:53:59 2019 -0500

    local apparmor profile

commit 21024861aaaffee89f149934f4aed9f45a54d84d
Author: Patrick Schleizer <adrelanos@riseup.net>
Date:   Tue Dec 24 18:39:57 2019 -0500

    set to complain mode

commit 63d7d68614a6bf002758a2f77a9e92f3e11161e7
Merge: 4b24bbd 5ca8c31
Author: Patrick Schleizer <adrelanos@riseup.net>
Date:   Tue Dec 24 18:39:20 2019 -0500

    Merge remote-tracking branch 'origin/master'

commit 5ca8c319d340abdbdec42f3796f2fddb6bdca4de
Merge: 4b24bbd 448726e
Author: Patrick Schleizer <adrelanos@riseup.net>
Date:   Tue Dec 24 23:38:22 2019 +0000

    Merge pull request #2 from madaidan/apparmor

    whonix-firewall apparmor profile

commit 4b24bbd5d81d008c4f2f220ef43f2f4a72c1832c
Author: Patrick Schleizer <adrelanos@riseup.net>
Date:   Tue Dec 24 18:37:20 2019 -0500

    bumped changelog version

commit c7d2b4526678635a2bc1b240af3c3bd9ce22bf27
Merge: 9c7f08c e311611
Author: Patrick Schleizer <adrelanos@riseup.net>
Date:   Tue Dec 24 18:36:52 2019 -0500

    Merge remote-tracking branch 'origin/master'

commit e3116116ba4e619424b8dc0f681384057bf3819d
Merge: 9c7f08c 5cb824b
Author: Patrick Schleizer <adrelanos@riseup.net>
Date:   Tue Dec 24 23:27:15 2019 +0000

    Merge pull request #3 from madaidan/ipv6

    Don't fail if ipv6 isn't available

commit 5cb824b52f8c1aaf327bd87c5d7fb389f966b747
Author: madaidan <50278627+madaidan@users.noreply.github.com>
Date:   Tue Dec 24 20:05:05 2019 +0000

    Check for /proc/sys/net/ipv6/ instead

commit 08b303e87cf0967b07c172faa849388102b82e13
Author: madaidan <50278627+madaidan@users.noreply.github.com>
Date:   Tue Dec 24 20:04:59 2019 +0000

    Check for /proc/sys/net/ipv6/ instead

commit 9054c21cdca93a226eb384ebee00cb903e4aa7d8
Author: madaidan <50278627+madaidan@users.noreply.github.com>
Date:   Tue Dec 24 18:54:14 2019 +0000

     Don't fail if ipv6 isn't available

commit ca17a4ae7824b0217f2a4d0ec2aa0b49b8cb51ff
Author: madaidan <50278627+madaidan@users.noreply.github.com>
Date:   Tue Dec 24 18:53:43 2019 +0000

    Don't fail if ipv6 isn't available

commit 448726e32664196750202f1420530894eca039eb
Author: madaidan <50278627+madaidan@users.noreply.github.com>
Date:   Mon Dec 23 17:37:12 2019 +0000

    Missing >

commit 53e9314d779689bd672d14fc761bc4411452fbc4
Author: madaidan <50278627+madaidan@users.noreply.github.com>
Date:   Mon Dec 23 17:36:45 2019 +0000

    Licensing

commit ee4ebad90f31c1e3edc720fea66f1104639a5d50
Author: madaidan <50278627+madaidan@users.noreply.github.com>
Date:   Mon Dec 23 17:36:17 2019 +0000

    Confine /usr/lib/whonix-firewall/ too

commit 55480abf9bc1bc63e4ae25ae7b526551919c59a3
Author: madaidan <50278627+madaidan@users.noreply.github.com>
Date:   Mon Dec 23 17:34:51 2019 +0000

    whonix-firewall abstraction

commit f2270eb0ea06c8b08e996b8eea1f21062735ab20
Author: madaidan <50278627+madaidan@users.noreply.github.com>
Date:   Mon Dec 23 14:35:27 2019 +0000

    Confine whonix_firewall instead

commit b186d13d56edd3f3579498f8cdda1c83db60e5d3
Author: madaidan <50278627+madaidan@users.noreply.github.com>
Date:   Sat Dec 21 17:36:20 2019 +0000

    Debian apparmor packaging

commit cc3d33f8d6428d7d8d54589be51fb56ef52609d1
Author: madaidan <50278627+madaidan@users.noreply.github.com>
Date:   Sat Dec 21 17:34:52 2019 +0000

    Depend on dh-apparmor

commit e065ebc9d50c5895697834f6e35a076b87b6e522
Author: madaidan <50278627+madaidan@users.noreply.github.com>
Date:   Sat Dec 21 17:33:35 2019 +0000

    AppArmor profile

commit 9c7f08c24b7d1b5f9e93f6e409367af3632f0aab
Author: Patrick Schleizer <adrelanos@riseup.net>
Date:   Thu Dec 12 08:08:00 2019 -0500

    bumped changelog version

commit 2d448ef99eb735e3fee8638c445a986dcb71c9c0
Author: Patrick Schleizer <adrelanos@riseup.net>
Date:   Thu Dec 12 07:50:26 2019 -0500

    no longer depend on qubesdb-read

commit a8ceb10498b48b70110593c41dab95f11cb9c4fb
Author: Patrick Schleizer <adrelanos@riseup.net>
Date:   Tue Nov 19 15:03:05 2019 +0000

    bumped changelog version

commit 176f1a190f75ca2a4552f7fd2a43c94aa01cea53
Author: Patrick Schleizer <adrelanos@riseup.net>
Date:   Tue Nov 19 09:51:05 2019 -0500

    fix use of sudoedit

    https://forums.whonix.org/t/use-sudoedit-in-whonix-documentation-and-whonix-software/7599/30

    as suggested by @madaidan

commit ea80c48c1d75cc227b159c54643a762fd50aaa92
Author: Patrick Schleizer <adrelanos@riseup.net>
Date:   Mon Nov 18 19:44:31 2019 +0000

    bumped changelog version

commit 7cfae135befbb288e8294e3bfcff54099b82ebbd
Author: Patrick Schleizer <adrelanos@riseup.net>
Date:   Mon Nov 18 19:42:20 2019 +0000

    fix sudoedit

commit 969656d148a86d6da820ffcf950e504d2d25f411
Author: Patrick Schleizer <adrelanos@riseup.net>
Date:   Mon Oct 14 10:25:33 2019 +0000

    bumped changelog version

commit 2e65f71309923b8354074dc60c21ce2c4e7b9bc7
Author: Patrick Schleizer <adrelanos@riseup.net>
Date:   Tue Oct 8 07:02:01 2019 -0400

    code documentation

commit a21317c140a95007ed19c9a6fd8fadd41cd22553
Author: Patrick Schleizer <adrelanos@riseup.net>
Date:   Tue Oct 8 04:37:51 2019 -0400

    minor

commit 7a724f64969d6ae160cbf3838b947ac18c4a17e7
Author: Patrick Schleizer <adrelanos@riseup.net>
Date:   Tue Oct 8 04:37:28 2019 -0400

    code documentation

commit d67bbf9e935d0078c1c696c5db6d957bbd45530b
Author: Patrick Schleizer <adrelanos@riseup.net>
Date:   Tue Oct 8 04:19:23 2019 -0400

    code documentation

commit 732911acd347e5afaad54aeced9dbce12e1753ba
Author: Patrick Schleizer <adrelanos@riseup.net>
Date:   Mon Oct 7 05:54:24 2019 +0000

    code documentation

commit 1ebe7203e20cbc15d156324964333ea1f64b045d
Author: Patrick Schleizer <adrelanos@riseup.net>
Date:   Sat Oct 5 09:43:02 2019 +0000

    bumped changelog version

commit 49e4bbc09f36d29eeaba8c091633fd114d6eadd9
Author: Patrick Schleizer <adrelanos@riseup.net>
Date:   Sat Oct 5 09:35:01 2019 +0000

    fix systemd whonix-firewall.service: WantedBy=sysinit.target

commit 0e4761f195c9dfec3a988e58eabbf3c1eaa1fb00
Author: Patrick Schleizer <adrelanos@riseup.net>
Date:   Thu Sep 19 13:07:54 2019 +0000

    bumped changelog version

commit 5407aa536a587ef93b0ecb2153417c1098713f64
Author: Patrick Schleizer <adrelanos@riseup.net>
Date:   Wed Sep 18 07:13:58 2019 -0400

    use sudoedit rather than hardcoding lxsudo mousepad

commit dee08123513f51f881ae5a998337400c81b58192
Author: Patrick Schleizer <adrelanos@riseup.net>
Date:   Wed Aug 28 12:52:58 2019 +0000

    bumped changelog version

commit 087c12022c9c73f90ce16625c76dc005065ba2fd
Author: Patrick Schleizer <adrelanos@riseup.net>
Date:   Wed Aug 28 11:35:49 2019 +0000

    use properly override_dh_installman

commit 612de1c66497e6254cc6bf22ed2380a64d986bab
Author: Patrick Schleizer <adrelanos@riseup.net>
Date:   Sat Aug 10 06:37:49 2019 +0000

    bumped changelog version

commit ae4ac7027394ba2bef5f5ed4e0d1f95c92ca6253
Author: Patrick Schleizer <adrelanos@riseup.net>
Date:   Sat Aug 10 02:28:38 2019 -0400

    lxsu -> lxsudo

commit 9d658ae76696867f7b94c05d81249cd68f9c6eab
Author: Patrick Schleizer <adrelanos@riseup.net>
Date:   Thu Aug 1 12:12:11 2019 +0000

    bumped changelog version

commit c0a035bedc58e75b103d8d7c3ac8810b7ed17721
Author: Patrick Schleizer <adrelanos@riseup.net>
Date:   Thu Aug 1 11:13:47 2019 +0000

    readme

commit f0714f215453dc0e6e73a7605bc41f84d23204f9
Author: Patrick Schleizer <adrelanos@riseup.net>
Date:   Wed Jul 31 07:50:05 2019 +0000

    bumped changelog version

commit ffafd34baf9cd7910ca2ad35d106be848ca6a19a
Author: Patrick Schleizer <adrelanos@riseup.net>
Date:   Wed Jul 31 03:14:31 2019 -0400

    /var/run -> /run

commit 5f90bbf6f2bf0639fbb4da60b303c7f8dfe86cbc
Author: Patrick Schleizer <adrelanos@riseup.net>
Date:   Fri Jul 19 12:07:57 2019 +0000

    bumped changelog version

commit aac10f9ebe80bb07f15bac9a54be09a9a528e4ea
Author: Patrick Schleizer <adrelanos@riseup.net>
Date:   Fri Jul 19 12:06:58 2019 +0000

    lower debugging

commit a5e8f5c2554354f76d358175b4a5fac4eb0e847f
Author: Patrick Schleizer <adrelanos@riseup.net>
Date:   Fri Jul 19 11:56:39 2019 +0000

    bumped changelog version

commit 0836ec459ebb10720b67eca845ef13b0041e3c44
Author: Patrick Schleizer <adrelanos@riseup.net>
Date:   Fri Jul 19 11:55:38 2019 +0000

    Do not write to /var/log/sdwdate.log in TemplateVM

    since sdwdate does not run there to avoid polluting the log.

commit 8efd4c2def5bea29772251bb12f73f68acaa3fdd
Author: Patrick Schleizer <adrelanos@riseup.net>
Date:   Mon Jul 15 13:27:23 2019 +0000

    bumped changelog version

commit 91a5efaa6c2bccc0bc67050aea07afa0f7311c19
Author: Patrick Schleizer <adrelanos@riseup.net>
Date:   Sun Jul 14 11:30:49 2019 +0000

    code simplification, no longer require user "user" to exist

commit c189334ba86adeb5553dfd3f35faf1434af9cfdf
Author: Patrick Schleizer <adrelanos@riseup.net>
Date:   Sun Jun 30 07:16:40 2019 -0400

    bumped changelog version

commit 4b341bc81a9218637c0b0c53c78f935efcec27c9
Author: Patrick Schleizer <adrelanos@riseup.net>
Date:   Sat Jun 29 13:45:42 2019 +0000

    man page

commit 681ea83be2910a3dc375fc548b1b544d72a1f932
Author: Patrick Schleizer <adrelanos@riseup.net>
Date:   Sat Jun 8 11:40:49 2019 +0000

    bumped changelog version

commit eb6348c2c5a179b76c76945a77e3ea9eaff3f892
Author: Patrick Schleizer <adrelanos@riseup.net>
Date:   Sat Jun 8 00:05:38 2019 -0400

    fix debian/watch lintian warning debian-watch-contains-dh_make-template

commit f209a3a1bc22e49d346e6928b900957874f74f91
Author: Patrick Schleizer <adrelanos@riseup.net>
Date:   Fri Jun 7 23:30:40 2019 -0400

    fix IP range

    thanks to @marmarek for the suggestion!

    https://forums.whonix.org/t/whonix-gateway-not-reachable/7484/18

commit 5fc78ed8d82657fdb3209e51bec638bafb396813
Author: Patrick Schleizer <adrelanos@riseup.net>
Date:   Fri Jun 7 23:24:33 2019 -0400

    fix IP range

    thanks to @marmarek for the suggestion!

commit baafc747a568ecd9d136005655759543689f9bcb
Author: Patrick Schleizer <adrelanos@riseup.net>
Date:   Fri Jun 7 23:14:35 2019 -0400

    comment

commit f613f79f806803bb0096d5f39414fb8db7a2e1eb
Author: Patrick Schleizer <adrelanos@riseup.net>
Date:   Fri Jun 7 23:13:21 2019 -0400

    remove 10.138.0.0/8 as 10.138.0.0/8 results in 10.0.0.0/8 anyhow

    https://forums.whonix.org/t/whonix-gateway-not-reachable/7484/16

commit e96771637f88aba9f037466d9bb2f112f1a0e3c8
Author: Patrick Schleizer <adrelanos@riseup.net>
Date:   Fri Jun 7 23:07:40 2019 -0400

    compact PREROUTING rules

commit c55b2652eecd214804afb32d89dc8fdf05e31221
Author: Patrick Schleizer <adrelanos@riseup.net>
Date:   Fri Jun 7 22:40:45 2019 -0400

    remove 192.168.0.10  Non-Qubes-Whonix-Gateway old IP

commit fbf4ad487241bcd3cd0acd11b3faec864cdbbb85
Author: Patrick Schleizer <adrelanos@riseup.net>
Date:   Fri Jun 7 22:39:11 2019 -0400

    fix Qubes vs Non-Qubes prerouting IP range

commit a531dedc87a647e7935a60dd45dc77be9e184d3e
Author: Patrick Schleizer <adrelanos@riseup.net>
Date:   Sat Jun 1 08:25:02 2019 +0000

    bumped changelog version

commit 5cf35f4ffe9d2f7ff2d2f8200dd0f2ad82ea5f14
Author: Patrick Schleizer <adrelanos@riseup.net>
Date:   Mon May 27 16:01:13 2019 -0400

    implement EXTERNAL_UDP_OPEN_PORTS

commit 6882aa9a449e0b6317f96f35d54ddcfcf56df858
Author: Patrick Schleizer <adrelanos@riseup.net>
Date:   Mon May 27 15:42:30 2019 -0400

    comment

commit 5ffcbb5ad30b04a6c5ea57734a8907cdc08c9b9f
Author: Patrick Schleizer <adrelanos@riseup.net>
Date:   Mon May 27 15:39:54 2019 -0400

    Whonix-Gateway firewall: implement EXTERNAL_OPEN_ALL

commit 6110098e8ede20b8b630478f4ce814655fe61136
Author: Patrick Schleizer <adrelanos@riseup.net>
Date:   Fri May 24 21:04:33 2019 +0000

    bumped changelog version

commit e52fb0e57d8f421f818c33a055725e535fd7b21f
Author: Patrick Schleizer <adrelanos@riseup.net>
Date:   Fri May 24 12:29:13 2019 -0400

    readme

commit 64030ce47d5e375838da0e70acb12eb66945fb28
Author: Patrick Schleizer <adrelanos@riseup.net>
Date:   Sun May 12 10:54:42 2019 +0000

    bumped changelog version

commit 6761760037b0aa4d36c72477593044bafd528bd4
Author: Patrick Schleizer <adrelanos@riseup.net>
Date:   Sun May 12 02:58:46 2019 -0400

    update path to pre.bsh

commit e3cca93b5cb0ae0f069f1c68f521f9fb2eb6bd00
Author: Patrick Schleizer <adrelanos@riseup.net>
Date:   Sun May 12 02:50:16 2019 -0400

    anon-shared-helper-scripts -> helper-scripts

commit a9bdd7692eb04aa7ff6efa4454ac7543482e116c
Author: Patrick Schleizer <adrelanos@riseup.net>
Date:   Fri May 3 11:43:01 2019 +0000

    bumped changelog version

commit bea97613ddcd0ade8cc394777710faa5550768f1
Author: Patrick Schleizer <adrelanos@riseup.net>
Date:   Fri May 3 10:56:58 2019 +0000

    update

commit 1d01dca4d48eeb15e97c9175bc47bb2f18ae1852
Author: Patrick Schleizer <adrelanos@riseup.net>
Date:   Thu Apr 11 13:25:38 2019 +0000

    bumped changelog version

commit ffe6ebae579a92279a3321b788443c4eb25d7da3
Author: Patrick Schleizer <adrelanos@riseup.net>
Date:   Thu Apr 11 08:06:34 2019 -0400

    sudo

commit cfca0633f9d8cdc4e26ac62b4eb2a89005360a43
Author: Patrick Schleizer <adrelanos@riseup.net>
Date:   Wed Apr 10 17:04:37 2019 -0400

    bumped changelog version

commit 8ef5083729ef610a82563d3424c91d0757eb784b
Author: Patrick Schleizer <adrelanos@riseup.net>
Date:   Wed Apr 10 16:58:38 2019 -0400

    sudo

commit 4ef952f92e4848e4d34a1b34b3b66e17abdcefe8
Author: Patrick Schleizer <adrelanos@riseup.net>
Date:   Mon Apr 8 13:07:23 2019 +0000

    bumped changelog version

commit 3dae160695a5a1bab29620fd72b380fe9159b39f
Author: Patrick Schleizer <adrelanos@riseup.net>
Date:   Mon Apr 8 12:57:31 2019 +0000

    sudo

commit c04adffa0e0cf24ea457ad4e71202573afb7a342
Author: Patrick Schleizer <adrelanos@riseup.net>
Date:   Mon Apr 8 06:46:51 2019 -0400

    safer sdwdate.log permissions

commit 8e8f0fdc2ac55d7d779602bca609fef062b88fe2
Author: Patrick Schleizer <adrelanos@riseup.net>
Date:   Sat Apr 6 12:22:21 2019 +0000

    bumped changelog version

commit b6d27d94c0da2d10f8fe1a7c59b9308d39e0ef3f
Author: Patrick Schleizer <adrelanos@riseup.net>
Date:   Sat Apr 6 11:27:54 2019 +0000

    sudo

commit 19f9e3a4c6300f9a02a4e23270260490e0d935d7
Author: Patrick Schleizer <adrelanos@riseup.net>
Date:   Sat Apr 6 10:20:29 2019 +0000

    sudo

commit 5d6d4f1a2d4f6d903add9fd58c5d0323ef683f6f
Author: Patrick Schleizer <adrelanos@riseup.net>
Date:   Fri Apr 5 17:03:18 2019 -0400

    gksudo

commit f7ac6afc6ad73f1e7d0bd8af190233ba5d8affd6
Author: Patrick Schleizer <adrelanos@riseup.net>
Date:   Thu Apr 4 05:55:52 2019 -0400

    port to debian buster

commit dd4216d9ffe314dd64cb788baa15d2b8ae9e53a6
Author: Patrick Schleizer <adrelanos@riseup.net>
Date:   Thu Apr 4 05:51:09 2019 -0400

    port to debian buster

commit cb174deb03489b414445abffe2cfd281570d7d65
Author: Patrick Schleizer <adrelanos@riseup.net>
Date:   Wed Apr 3 18:06:13 2019 -0400

    readme

commit af865372b92c825436f54c64287d09bd2d3214ea
Author: Patrick Schleizer <adrelanos@riseup.net>
Date:   Fri Mar 29 10:11:40 2019 +0000

    bumped changelog version

commit acca2da445d8ebeee2f8638fbb4db4262468a72f
Author: Patrick Schleizer <adrelanos@riseup.net>
Date:   Fri Mar 29 09:03:20 2019 +0000

    https://www.whonix.org/wiki/Dev/Licensing

commit 0f71b28dc47086b47fde6110110945a2c3f96ad9
Author: Patrick Schleizer <adrelanos@riseup.net>
Date:   Tue Mar 12 11:45:15 2019 +0000

    bumped changelog version

commit 2ef2ae6623598694ac1557b689f8701be451b07f
Author: Patrick Schleizer <adrelanos@riseup.net>
Date:   Fri Mar 1 14:32:43 2019 +0000

    add improved legal protections clauses

    The license for software created by Whonix is the GNU General Public License as published by the Free Software Foundation, either version 3 of the License, or (at your option) any later version with additional terms applicable per GNU GPL version 3 section 7.

    The additional terms are based on the Doom 3 license which is Debian refers to as `GPL-3+-with-id-software-additional-terms`, which is Debian DFSG [1] (The Debian Free Software Guidelines) approved and which is therefore suitable for Debian `main`. Whonix made applied minimal changes to it:

    * Rewrite `The Doom 3 BFG Edition GPL Source Code` to the more common `this program` which is used throughout the GPL.
    * Added a "trump clause" [2], in other words, any conflicts or disputes between the additional terms and the GPLv3 shall be resolved in favor of the GPLv3 by adding `Notwithstanding any other provision of this License` (as mentioned in GPL FAQ [3]) at the beginning of the additional terms.

    [1] https://www.debian.org/social_contract#guidelines
    [2] https://www.fsf.org/news/canonical-updated-licensing-terms
    [3] https://www.gnu.org/licenses/gpl-faq.html#v3Notwithstanding

    For more considerations, see also:
    https://www.whonix.org/wiki/Dev/Licensing

commit 9bf1bf8c44a5ab1579f72e55fddc4c3b214626e0
Author: Patrick Schleizer <adrelanos@riseup.net>
Date:   Sat Nov 17 05:21:21 2018 +0000

    bumped changelog version

commit b359bc22428dd74d1bab1bf7405b46c219e7b9be
Author: Patrick Schleizer <adrelanos@riseup.net>
Date:   Sat Nov 17 00:13:17 2018 -0500

    Disable fail closed mechanism.
    (i.e. do not start networking if whonix-firewall.service fails to load.)
    Breaks networking on package upgrades.

    https://phabricator.whonix.org/T875

commit ec46e9b15c794ebf575dfcbd7539cc2632d0a3e9
Author: Patrick Schleizer <adrelanos@riseup.net>
Date:   Wed Nov 14 13:14:22 2018 +0000

    bumped changelog version

commit 8d9767a72fdbaac863f8e372a10dfa6f2779ce6f
Author: Patrick Schleizer <adrelanos@riseup.net>
Date:   Wed Nov 14 08:01:29 2018 -0500

    fix Whonix custom firewall settings start menu entry in Whonix XFCE

commit f8c389d59e365e17dd1f787aa5fa712c2acbbf64
Author: Patrick Schleizer <adrelanos@riseup.net>
Date:   Mon Aug 27 16:58:49 2018 +0000

    bumped changelog version

commit 60a6f826d4ff246e50f26e8e874769498f923a8a
Author: Patrick Schleizer <adrelanos@riseup.net>
Date:   Thu Aug 23 06:30:44 2018 -0400

    improve Qubes detection

    if command -v "qubesdb-read" >/dev/null 2>&1 ; then

commit 5a86e8698cf92318eb3de0f7af35aae40b92d50f
Author: Patrick Schleizer <adrelanos@riseup.net>
Date:   Tue Aug 21 05:18:53 2018 +0800

    readme

commit f173cd097690d0022c044af05d68bb715d911a58
Author: Patrick Schleizer <adrelanos@riseup.net>
Date:   Tue Aug 21 05:05:11 2018 +0800

    man page

commit 0c7bdbe05daffad48897ef4c4c2de6b4d493d70b
Author: Patrick Schleizer <adrelanos@riseup.net>
Date:   Thu Aug 9 16:05:01 2018 +0000

    bumped changelog version

commit c82a3493886ee3baeb42c827ed0856552a0824bf
Author: Patrick Schleizer <adrelanos@riseup.net>
Date:   Thu Aug 9 15:03:49 2018 +0000

    fix comment typo

commit de9c66dfad7bd80a3912fd3c037dfb94444b7a6f
Author: Patrick Schleizer <adrelanos@riseup.net>
Date:   Sun Aug 5 07:00:39 2018 +0000

    remove dependency on konsole

commit c13f3c4b575c1c1cac40cb2a3a83fd083ee57995
Author: Patrick Schleizer <adrelanos@riseup.net>
Date:   Sun Aug 5 14:28:16 2018 +0800

    fix, don't hardcode kwrite, use xdg-open

commit 86f341c6cbb4037c9d9055fd959251cf930d50ee
Author: Patrick Schleizer <adrelanos@riseup.net>
Date:   Fri Jul 6 06:59:58 2018 +0000

    bumped changelog version

commit b24bfdc11bce0e34a5a683824f32e05aadebefe3
Author: Patrick Schleizer <adrelanos@riseup.net>
Date:   Fri Jul 6 06:56:06 2018 +0000

    fix, anon-ws-disable-stacked-tor compatibility for firewall fail closed mode

commit 469190be4a91571607db39ce7107dbad92728a50
Author: Patrick Schleizer <adrelanos@riseup.net>
Date:   Fri Jul 6 06:44:59 2018 +0000

    fix

commit 14e5d3d73841d46e33d681e8cce639ee543711ce
Author: Patrick Schleizer <adrelanos@riseup.net>
Date:   Mon Feb 5 21:59:03 2018 +0000

    bumped changelog version

commit 40bfbcc7d328b2d641cf4ca699e6031e165bcee7
Author: Patrick Schleizer <adrelanos@riseup.net>
Date:   Mon Feb 5 21:36:45 2018 +0000

    .torrc -> .conf

commit 2345989185e64af23089b4c593b4d204a937fb78
Author: Patrick Schleizer <adrelanos@riseup.net>
Date:   Thu Feb 1 15:30:50 2018 +0000

    bumped changelog version

commit e9fc4f04761ddbe0bf232413cb285dd44a34f523
Author: Patrick Schleizer <adrelanos@riseup.net>
Date:   Mon Jan 29 15:50:55 2018 +0000

    readme

commit 33597295401719dd6969d74c0bef4dd3acef3979
Author: Patrick Schleizer <adrelanos@riseup.net>
Date:   Mon Jan 29 15:39:03 2018 +0000

    update copyright

commit 95bbe7fd32fef12ee8544a9e9132973532d6a41d
Author: Patrick Schleizer <adrelanos@riseup.net>
Date:   Mon Jan 29 15:22:12 2018 +0000

    update copyright

commit 2a7b588f68589cee5cbcb7d71552083ee6a24531
Author: Patrick Schleizer <adrelanos@riseup.net>
Date:   Mon Jan 29 15:15:24 2018 +0000

    update copyright

commit 4e7823bb9411e2eb8f76a439752530fa853e72ef
Author: Patrick Schleizer <adrelanos@riseup.net>
Date:   Mon Jan 29 15:09:49 2018 +0000

    update copyright

commit 1363a096c6ad008b2ad1c5cd4e1708868044b778
Author: Patrick Schleizer <adrelanos@riseup.net>
Date:   Thu Jan 18 17:33:30 2018 +0000

    bumped changelog version

commit 565532db595d7beadbc6bf3da633c8f1a43eb81a
Author: Patrick Schleizer <adrelanos@riseup.net>
Date:   Tue Jan 16 22:14:32 2018 +0100

    comment

commit 0fd6260d9fd7b5a8935e0e079cc74ffc64c253e9
Author: Patrick Schleizer <adrelanos@riseup.net>
Date:   Fri Dec 22 01:00:57 2017 +0000

    bumped changelog version

commit 782e716088bb92c5374f7ec3056a392628ac7777
Author: Patrick Schleizer <adrelanos@riseup.net>
Date:   Fri Dec 22 00:48:46 2017 +0000

    import enable-firewall script from anon-shared-helper scripts

commit 707be4fb6f03c6a18f17b50460d1bc0040906e3c
Author: Patrick Schleizer <adrelanos@riseup.net>
Date:   Fri Dec 22 00:45:47 2017 +0000

    Qubes R4 TemplateVM compatibility fixes

commit cdbeb9cfadfe1792406242bb0e142ad97ec098c8
Author: Patrick Schleizer <adrelanos@riseup.net>
Date:   Thu Dec 21 23:26:28 2017 +0000

    bumped changelog version

commit 821c49b7279d8a2e11154581a48f97d14d5facec
Author: Patrick Schleizer <adrelanos@riseup.net>
Date:   Thu Dec 21 23:25:37 2017 +0000

    fix firewall-restarter race condition

commit 287b7e41ee4ec2741e9a6f772ac1fc53ebb6a1d8
Author: Patrick Schleizer <adrelanos@riseup.net>
Date:   Thu Dec 21 23:24:19 2017 +0000

    fix firewall-restarter race condition

commit c88a7ad31808898897c8fa4d46330193d48df6f0
Author: Patrick Schleizer <adrelanos@riseup.net>
Date:   Thu Dec 21 23:10:00 2017 +0000

    After=qubes-whonix-torified-updates-proxy-check.service

commit 4516d231699119ba839b84f499d019e11e53b6b4
Author: Patrick Schleizer <adrelanos@riseup.net>
Date:   Thu Dec 21 22:43:42 2017 +0000

    mkdir --parents /var/run/qubes-service

commit 7b7b84007bebd23ebe529931bb785163a3278f6f
Author: Patrick Schleizer <adrelanos@riseup.net>
Date:   Thu Dec 21 22:41:51 2017 +0000

    run Whonix Firewall Restarter also in Qubes TemplateVM

commit 6b97204bf047f14376445c4eb333c33120c590d6
Author: Patrick Schleizer <adrelanos@riseup.net>
Date:   Thu Dec 21 22:20:48 2017 +0000

    bumped changelog version

commit d9216c6860419f0bf507192a1f686f7971ef62e2
Author: Patrick Schleizer <adrelanos@riseup.net>
Date:   Thu Dec 21 22:20:40 2017 +0000

    fix

commit 4abcd362c9ccc31352fcf24250ffaa5a449751de
Author: Patrick Schleizer <adrelanos@riseup.net>
Date:   Thu Dec 21 22:19:27 2017 +0000

    bumped changelog version

commit bc6e022f6656896c8f66e4291af9a4bae3b156d9
Author: Patrick Schleizer <adrelanos@riseup.net>
Date:   Thu Dec 21 22:19:16 2017 +0000

    fix

commit b727b342c2ac461861f2f950f6681edba643b16f
Author: Patrick Schleizer <adrelanos@riseup.net>
Date:   Thu Dec 21 22:17:50 2017 +0000

    bumped changelog version

commit 0e43700a22feea97fd0f1215d4984dec60f76cb1
Author: Patrick Schleizer <adrelanos@riseup.net>
Date:   Thu Dec 21 22:17:43 2017 +0000

    fix

commit 7f1ca57ac31bcd17d966b7192d1eb07f3eb0c992
Author: Patrick Schleizer <adrelanos@riseup.net>
Date:   Thu Dec 21 22:06:41 2017 +0000

    bumped changelog version

commit d57908b75e3fd2e382cdb3eb8e0d7f57f79c418c
Author: Patrick Schleizer <adrelanos@riseup.net>
Date:   Thu Dec 21 22:06:21 2017 +0000

    fix

commit c21527d3d18a50e07431681485502f5d3fe2bb7f
Author: Patrick Schleizer <adrelanos@riseup.net>
Date:   Thu Dec 21 20:37:25 2017 +0000

    bumped changelog version

commit 0bf4aac08642d40d09669ed3ed3b162407940ddb
Author: Patrick Schleizer <adrelanos@riseup.net>
Date:   Thu Dec 21 20:22:27 2017 +0000

    readme

commit 24f3d8c490f1e8ca07f6c49ce9781b7337ddabe0
Author: Patrick Schleizer <adrelanos@riseup.net>
Date:   Thu Dec 21 20:17:33 2017 +0000

    Restart firewall when file /var/run/qubes-service/whonix-secure-proxy gets created.

    So blocking access to Qubes updates proxy for everyone but user updatesproxycheck ends.

    In other words, to allow full access to Qubes updates proxy.

commit 972c62e492608862a93dc7828788babf3e9eb3d2
Author: Patrick Schleizer <adrelanos@riseup.net>
Date:   Thu Dec 21 20:16:04 2017 +0000

    comment

commit 2e6cac310f1b90ac5143e04e2855bd9678d2ec69
Author: Patrick Schleizer <adrelanos@riseup.net>
Date:   Thu Dec 21 20:11:45 2017 +0000

    renamed:    lib/systemd/system/whonix-firewall-watcher.service -> lib/systemd/system/whonix-firewall-restarter.service

commit a949683b03ba1a16e25d4141c116dad7374351c9
Author: Patrick Schleizer <adrelanos@riseup.net>
Date:   Thu Dec 21 20:11:01 2017 +0000

    adjust path

commit ee032c80c17461a94c6b901684fe3c697db642ac
Author: Patrick Schleizer <adrelanos@riseup.net>
Date:   Thu Dec 21 20:09:15 2017 +0000

    import usr/lib/whonix-firewall/firewall-restarter from anon-shared-helper-scripts

commit ff295cfd1343181783d2aa7533ca28d140af8f75
Author: Patrick Schleizer <adrelanos@riseup.net>
Date:   Thu Dec 21 20:07:22 2017 +0000

    renamed:    lib/systemd/system/whonix-firewall-sdwdate-watcher.service -> lib/systemd/system/whonix-firewall-watcher.service

commit 2b667112dc5563f39bf6156f6535ae124767a92f
Author: Patrick Schleizer <adrelanos@riseup.net>
Date:   Thu Dec 21 19:45:32 2017 +0000

    add usr/bin/whonix_firewall wrapper which starts appropriate firewall

commit 4aa40a3ec1527d1d22fb937f59525e04983cf0a4
Author: Patrick Schleizer <adrelanos@riseup.net>
Date:   Thu Dec 21 19:35:31 2017 +0000

    symlink man pages

    to fix lintian warning

commit 82ffba5f557bfe587baa733951d2da3b69ba99db
Author: Patrick Schleizer <adrelanos@riseup.net>
Date:   Thu Dec 21 19:34:15 2017 +0000

    package description

commit b53981e54bf59282ac5d3b01be2194907fc4991e
Author: Patrick Schleizer <adrelanos@riseup.net>
Date:   Thu Dec 21 19:33:00 2017 +0000

    refactoring

commit 771efcfb5ca05da880960c561a3cf4d600127466
Author: Patrick Schleizer <adrelanos@riseup.net>
Date:   Thu Dec 21 19:25:11 2017 +0000

    --group updatesproxycheck

commit aafe971cd94210584520240ecd52d360bce337b1
Author: Patrick Schleizer <adrelanos@riseup.net>
Date:   Thu Dec 21 19:23:19 2017 +0000

    shuffle

commit f1a3c69c44bb0e7533a8b19ad30fb8a4b78397c8
Author: Patrick Schleizer <adrelanos@riseup.net>
Date:   Thu Dec 21 19:22:42 2017 +0000

    --no-create-home

commit 42d9dce765bf69bfd65cd7451dc761576cfefa22
Author: Patrick Schleizer <adrelanos@riseup.net>
Date:   Thu Dec 21 19:22:03 2017 +0000

    fix lintian warning

commit be761b8147759cfcc91e34036e51cae6e6c2cf05
Author: Patrick Schleizer <adrelanos@riseup.net>
Date:   Thu Dec 21 19:20:17 2017 +0000

    adjust debian/changelog for package rename to whonix-firewall

commit 395b92300932f3d047650e5a09a9bc9fa404d795
Author: Patrick Schleizer <adrelanos@riseup.net>
Date:   Thu Dec 21 19:15:25 2017 +0000

    merge whonix-ws-firewall postinst

commit 46be6f67ab45313ef6151737ca7127bb7907a8cb
Author: Patrick Schleizer <adrelanos@riseup.net>
Date:   Thu Dec 21 19:09:56 2017 +0000

    Depends: anon-gw-base-files | anon-ws-base-files

commit 9055a3376f137b3bafb6e014a7f7c6b1612a2d1a
Author: Patrick Schleizer <adrelanos@riseup.net>
Date:   Thu Dec 21 19:03:33 2017 +0000

    package description

commit 51198da1922c59b3ddc7ab42b43049c172e2c93c
Author: Patrick Schleizer <adrelanos@riseup.net>
Date:   Thu Dec 21 19:01:00 2017 +0000

    import usr/share/whonix-ws-firewall/unit_tests/stream_isolation_test

    from whonix-ws-firewall package

commit 70df752f37d484c0b555435d1780031e973935e0
Author: Patrick Schleizer <adrelanos@riseup.net>
Date:   Thu Dec 21 18:58:16 2017 +0000

    adjust file names for merged whonix-gw-firewall / whonix-ws-firewall package

commit 7db9919cc616225bdfd98854b3a938c0a2427868
Author: Patrick Schleizer <adrelanos@riseup.net>
Date:   Thu Dec 21 18:56:51 2017 +0000

    apply Whonix-Workstation config only on Whonix-Workstation firewall

commit d9c5f2ac527d2daa4da615d0123e8c63b1046b6c
Author: Patrick Schleizer <adrelanos@riseup.net>
Date:   Thu Dec 21 18:55:20 2017 +0000

    import etc/whonix_firewall.d/30_whonix_workstation_default.conf from whonix-ws-firewall package

commit 102575d46f61e1e8e18d7b761ab6c242d2193323
Author: Patrick Schleizer <adrelanos@riseup.net>
Date:   Thu Dec 21 18:53:48 2017 +0000

    import usr/bin/whonix-workstation-firewall from whonix-ws-firewall package

commit 5ee460a049ebc573937ca44f9f328aa35cc271d5
Author: Patrick Schleizer <adrelanos@riseup.net>
Date:   Thu Dec 21 18:52:41 2017 +0000

    merge workstation firewall man page part

commit f4ec5effc212ba025a463279839562a1b26bb4fd
Author: Patrick Schleizer <adrelanos@riseup.net>
Date:   Thu Dec 21 18:40:05 2017 +0000

    comment

commit dcf1988461a46de78f90d98d26a927befce4fe04
Author: Patrick Schleizer <adrelanos@riseup.net>
Date:   Thu Dec 21 18:39:46 2017 +0000

    comment

commit f174338e4afc10f0190a925bdcbfa0ef16bfe139
Author: Patrick Schleizer <adrelanos@riseup.net>
Date:   Thu Dec 21 18:37:54 2017 +0000

    renamed:    usr/share/applications/gateway-firewall30default.desktop -> usr/share/applications/whonix-firewall30default.desktop
    renamed:    usr/share/applications/gateway-firewall50user.desktop -> usr/share/applications/whonix-firewall50user.desktop
    renamed:    usr/share/applications/gateway-reloadfirewall.desktop -> usr/share/applications/whonix-reloadfirewall.desktop

commit 692dbd148a68a57860bc82a778fb320704598c54
Author: Patrick Schleizer <adrelanos@riseup.net>
Date:   Thu Dec 21 18:36:39 2017 +0000

    whonix-gw-firewall / whonix-ws-firewall merge fixes

commit e95857dc6ba679e5e7415da30c8eb4cfdb5f7e18
Author: Patrick Schleizer <adrelanos@riseup.net>
Date:   Thu Dec 21 18:33:51 2017 +0000

    adjust paths

commit fca2f1c77968ea46d18b7a935edd780c1689623a
Author: Patrick Schleizer <adrelanos@riseup.net>
Date:   Thu Dec 21 18:22:27 2017 +0000

    adjust usr/lib/whonix-firewall/firewall30default for gw / ws merged firewall package

commit c231158963c949273845d759b49ba597d6bf466f
Author: Patrick Schleizer <adrelanos@riseup.net>
Date:   Thu Dec 21 18:21:23 2017 +0000

    comment

commit b351de6c2041e532f13abbed0bd70b8170fb2e28
Author: Patrick Schleizer <adrelanos@riseup.net>
Date:   Thu Dec 21 18:20:02 2017 +0000

    renamed:    usr/lib/gateway-shortcuts/firewall30default -> usr/lib/whonix-firewall/firewall30default
    renamed:    usr/lib/gateway-shortcuts/firewall50user -> usr/lib/whonix-firewall/firewall50user
    renamed:    usr/lib/gateway-shortcuts/reloadfirewall -> usr/lib/whonix-firewall/reloadfirewall

commit ae75056a502a39497057e2143dcd975bf25058c2
Author: Patrick Schleizer <adrelanos@riseup.net>
Date:   Thu Dec 21 18:18:26 2017 +0000

    comment

commit f336b45d58c360e24fbac1da20452e88380a1890
Author: Patrick Schleizer <adrelanos@riseup.net>
Date:   Thu Dec 21 18:13:24 2017 +0000

    renamed:    usr/share/lintian/overrides/whonix-gw-firewall -> usr/share/lintian/overrides/whonix-firewall

commit d90a5fb1b4997e14f8457c4ddd02653d8ef78d76
Author: Patrick Schleizer <adrelanos@riseup.net>
Date:   Thu Dec 21 18:12:48 2017 +0000

    update lintian override for package rename to whonix-firewall

commit 4718609b5d3d833e632d4f8ae8728be67e5b116f
Author: Patrick Schleizer <adrelanos@riseup.net>
Date:   Thu Dec 21 18:12:28 2017 +0000

    update desktop shortcut comment

commit 8a75166108ee9383a829f56c1f6a3bfd21f21fd6
Author: Patrick Schleizer <adrelanos@riseup.net>
Date:   Thu Dec 21 18:10:51 2017 +0000

    adjust debian/watch to new whonix-firewall git url

commit 135c3aaf4a7321006589566e41cad235971779e6
Author: Patrick Schleizer <adrelanos@riseup.net>
Date:   Thu Dec 21 18:10:44 2017 +0000

    rm_conffile /etc/whonix_firewall.d/30_default.conf

commit cb06243cb3d243e87bf68875aa8d30cdd48c1f96
Author: Patrick Schleizer <adrelanos@riseup.net>
Date:   Thu Dec 21 18:09:03 2017 +0000

    renamed:    30_default.conf -> 30_whonix_gateway_default.conf

commit 7696e76174e271df2e191cf414adecde561e7ea1
Author: Patrick Schleizer <adrelanos@riseup.net>
Date:   Thu Dec 21 18:08:35 2017 +0000

    apply Whonix-Gateway config only to Whonix-Gateway

commit b5a83f1e9d6cec85f379211ade7ce2b2ecfe4b45
Author: Patrick Schleizer <adrelanos@riseup.net>
Date:   Thu Dec 21 18:05:46 2017 +0000

    renamed:    whonix_firewall -> whonix-gateway-firewall

commit 41bc270e4bc2bcc5699fa0b57099799b91074db7
Author: Patrick Schleizer <adrelanos@riseup.net>
Date:   Thu Dec 21 18:04:46 2017 +0000

    Replaces: whonix-gw-firewall, whonix-ws-firewall

commit bd7a6014f4ac7155a49a424906d53d4c56bda57d
Author: Patrick Schleizer <adrelanos@riseup.net>
Date:   Thu Dec 21 18:04:08 2017 +0000

    rename to whonix-firewall

commit 7e20577427b5a5d38ce82993c04c647b12398f1b
Author: Patrick Schleizer <adrelanos@riseup.net>
Date:   Fri Dec 15 18:44:26 2017 +0000

    bumped changelog version

commit 50fc4ac8035b26917d91abdbafe39f690617f2d2
Author: Patrick Schleizer <adrelanos@riseup.net>
Date:   Sat Dec 2 19:23:56 2017 +0000

    Setting firewall_mode always to full by default because the following
    usability issues are not yet resolved. Help welcome!
    Non-Qubes-Whonix: enable sdwdate-gui systray by default
    https://phabricator.whonix.org/T636
    Qubes-Whonix: make sdwdate-gui Qubes friendlhttps://phabricator.whonix.org/T534

    firewall_mode=full

commit 040dd59cf8c307dd87a980315a00ea911400d26c
Author: Patrick Schleizer <adrelanos@riseup.net>
Date:   Tue Nov 21 22:57:44 2017 +0000

    bumped changelog version

commit 7930706d0dd399fc4dc1dc5691f41a563b4ece4f
Author: Patrick Schleizer <adrelanos@riseup.net>
Date:   Mon Oct 23 16:18:42 2017 +0200

    - Qubes: NON_TOR_GATEWAY=""
    - Qubes: allow user tinyproxy to connect to 127.0.0.1 9040 and 5300 where Tor is listening (required since we are now using NON_TOR_GATEWAY="")

    https://github.com/QubesOS/qubes-issues/issues/3201

commit df422c5aea2baec365273d1b140f12872cbaf240
Author: Patrick Schleizer <adrelanos@riseup.net>
Date:   Sat Oct 21 13:08:04 2017 +0000

    NON_TOR_GATEWAY="127.0.0.0-127.0.0.8"

    prevent sys-whonix from being able to access non-torified Qubes Updates Proxy

    https://github.com/QubesOS/qubes-issues/issues/3201

commit 4930133bc78535794ad52b97f05277c269cb4052
Author: Patrick Schleizer <adrelanos@riseup.net>
Date:   Tue Sep 12 03:00:26 2017 +0200

    bumped changelog version

commit c4c82dc7daff4d880209b9073a82dcf2b5e8c015
Author: Patrick Schleizer <adrelanos@riseup.net>
Date:   Sun Sep 3 12:45:45 2017 +0000

    onion-grater systemd drop-in path fix

commit 874faff1fb84bcd39ce3d2f7a04929b2035ab547
Author: Patrick Schleizer <adrelanos@riseup.net>
Date:   Wed Jul 26 14:42:33 2017 +0000

    bumped changelog version

commit 3bb8493df9d98e47782b5a14584f36e2d79238c6
Merge: dc7e553 99a0e1e
Author: Patrick Schleizer <adrelanos@riseup.net>
Date:   Fri Jul 21 13:56:10 2017 +0200

    Merge remote-tracking branch 'origin/master'

commit dc7e553f637ebfc4e0735438b830fea22663075b
Author: Patrick Schleizer <adrelanos@riseup.net>
Date:   Fri May 19 13:58:32 2017 +0200

    Whonix-Gateway firewall does not support TUNNEL_FIREWALL_ENABLE=true yet.
    It only supports VPN_FIREWALL="1".
    In case someone confused this setting, i.e. using TUNNEL_FIREWALL_ENABLE=true
    since this is how it is done on Whonix-Workstation, then gracefully enable
    VPN_FIREWALL="1" to prevent users shooting their own feet.

    if [ "$TUNNEL_FIREWALL_ENABLE" = "true" ]; then
       VPN_FIREWALL="1"
    fi

commit 99a0e1eb3ce3bd1728f12f673522d239b0a3d9f6
Author: Jason J. Ayala P <jason@jasonayala.com>
Date:   Tue Apr 25 22:03:26 2017 -0500

    typo in comments

commit 39778f60978a341eca5e771955da88e718f40ff9
Author: Patrick Schleizer <adrelanos@riseup.net>
Date:   Thu Mar 30 03:19:09 2017 +0200

    control-port-filter-python -> onion-grater

commit 20710a42ecec89662e59873913612362cc400af6
Author: Patrick Schleizer <adrelanos@riseup.net>
Date:   Thu Mar 30 03:13:45 2017 +0200

    control-port-filter-python -> onion-grater

commit 6511d52f68cfc762af70c5c82468f3ece0a7b003
Author: Patrick Schleizer <adrelanos@riseup.net>
Date:   Mon Mar 6 16:19:44 2017 +0000

    bumped changelog version

commit d22d9e0434cc171cc1668c6931186357ec41b414
Author: Patrick Schleizer <adrelanos@riseup.net>
Date:   Mon Mar 6 14:53:28 2017 +0000

    "$@"

commit c10620411a15dd1db251dd9a620e7f64135a3176
Author: Patrick Schleizer <adrelanos@riseup.net>
Date:   Fri Feb 17 15:15:44 2017 +0000

    bumped changelog version

commit acf4cb0b4eae478d456b5257a9e52c357962b098
Author: Patrick Schleizer <adrelanos@riseup.net>
Date:   Fri Feb 17 14:31:16 2017 +0000

    fix lintian warning

commit 6654e02566e18c5eca40a48417f184f340359e70
Author: Patrick Schleizer <adrelanos@riseup.net>
Date:   Fri Feb 17 14:14:25 2017 +0000

    bumped changelog version

commit c265cf24a91199c498786043c70354b57192c2c9
Author: Patrick Schleizer <adrelanos@riseup.net>
Date:   Wed Feb 15 21:33:04 2017 +0000

    output

commit 01e4276204ba0c0cc51b33e44b2e35f07523109e
Author: Patrick Schleizer <adrelanos@riseup.net>
Date:   Wed Feb 15 21:24:21 2017 +0000

    fix starting gateway shortcuts in konsole whole screen in Qubes

commit c191630e3886e78d09e4be3fbc0d9d27ad19b28c
Author: Patrick Schleizer <adrelanos@riseup.net>
Date:   Fri Feb 10 15:47:55 2017 +0000

    remove faketime from Build-Depends:

    since no longer used for reproducible builds

commit 0c341e90b128e76d6425f3478421ffb5a2abd226
Author: Patrick Schleizer <adrelanos@riseup.net>
Date:   Fri Feb 10 15:35:33 2017 +0000

    remove debian/gain-root-command workaround

commit bb00a5acb05b3a480f02230c2746f3eb7220ca1a
Author: Patrick Schleizer <adrelanos@riseup.net>
Date:   Fri Feb 10 15:26:55 2017 +0000

    packaging simplification ruby-ronn (>= 0.7.3) -> ruby-ronn

commit 28d1632d322d87ada083e6615cfa3bb6242f16dd
Author: Patrick Schleizer <adrelanos@riseup.net>
Date:   Mon Feb 6 02:10:46 2017 +0000

    bumped changelog version

commit 9bfb38caf2979678bcef7d7e5fb4b260be02bc7e
Author: Patrick Schleizer <adrelanos@riseup.net>
Date:   Mon Feb 6 01:36:01 2017 +0000

    add timestamp to sdwdate log

commit a072920b2290e6d4e8e5fb01d8a72afa58c4f498
Author: Patrick Schleizer <adrelanos@riseup.net>
Date:   Sun Jan 15 15:38:12 2017 +0000

    bumped changelog version

commit b353829add2cd22bd41ec0c3168bba145bbf2ecb
Author: Patrick Schleizer <adrelanos@riseup.net>
Date:   Sun Jan 15 07:52:29 2017 +0000

    use --home /nonexistent to fix lintian warning

commit d09fb2f99b64ef065c590e612038691176046aae
Author: Patrick Schleizer <adrelanos@riseup.net>
Date:   Sun Jan 15 08:35:51 2017 +0100

    packaging, bumped Standards-Version from 3.9.6 to 3.9.8 for jessie support

commit 6b46b5409ef488276407fbfced672711423eea4f
Author: Patrick Schleizer <adrelanos@riseup.net>
Date:   Thu Jan 12 02:58:33 2017 +0000

    bumped changelog version

commit 42177bc2b9a3b85d1515ab1d4b2328d193a21730
Author: Patrick Schleizer <adrelanos@riseup.net>
Date:   Mon Jan 9 03:53:04 2017 +0000

    add Documentation=

    to fix stretch lintian warning

commit ab7e84dfa67808c3fbcf76d235c75347a0ca0fcc
Author: Patrick Schleizer <adrelanos@riseup.net>
Date:   Sun Jan 8 05:42:17 2017 +0000

    StandardOutput=syslog

commit 0dffa4f4b3b8850326fd963c621ba9ff9437083d
Author: Patrick Schleizer <adrelanos@riseup.net>
Date:   Sun Dec 25 02:49:36 2016 +0000

    'local'ize more variables; improve variable names

commit 00823a325d104e04d065fda8ae96992d1f90e184
Author: Patrick Schleizer <adrelanos@riseup.net>
Date:   Sat Dec 24 00:25:09 2016 +0100

    Prevent connections to Tor SocksPorts in timesync-fail-closed mode.

    Access to localhost is required even in timesync-fail-closed mode, otherwise breaks applications such as konsole and kwrite.

    https://phabricator.whonix.org/T533#11025

commit 19c9382868cc390a39d40da7e5c4465c2fcd6307
Author: Patrick Schleizer <adrelanos@riseup.net>
Date:   Sun Dec 18 16:28:27 2016 +0100

    fix file location of tor-controlport-filter.d systemd dropin

    lib/systemd/system/tor-controlport-filter.d/30_whonix_cpfpy.conf
    ->
    lib/systemd/system/tor-controlport-filter.service.d/30_whonix_cpfpy.conf

commit 3d53bb048fbc29cb0e51d6c3a97caeddad2db14c
Author: Patrick Schleizer <adrelanos@riseup.net>
Date:   Fri Dec 16 16:44:30 2016 +0000

    bumped changelog version

commit 829761e27c8fe058a4389e3af08f6675be22e2db
Author: Patrick Schleizer <adrelanos@riseup.net>
Date:   Fri Dec 16 16:44:05 2016 +0000

    temporary workaround for 127.0.0.1 connections issues

    to unbreak developers repository

    https://phabricator.whonix.org/T533#10288

commit 67aaf37fdacaa83172b82802756dcc108be3119f
Author: Patrick Schleizer <adrelanos@riseup.net>
Date:   Fri Dec 16 16:19:09 2016 +0000

    bumped changelog version

commit 536831da2aba2c7e31728f7624a7982762782de2
Author: Patrick Schleizer <adrelanos@riseup.net>
Date:   Wed Dec 14 21:06:11 2016 +0000

    After=sysinit.target -> After=qubes-sysinit.target

    to prevent conflict with networking.service, which runs after before sysinit.target

commit 6f3d4e2888fac90947d9899bd7004bcf9ae63c17
Author: Patrick Schleizer <adrelanos@riseup.net>
Date:   Sat Dec 10 02:38:26 2016 +0000

    bumped changelog version

commit 610474204b41fddfc6da4e42e3f9e134e15b4e56
Author: Patrick Schleizer <adrelanos@riseup.net>
Date:   Wed Dec 7 23:02:21 2016 +0000

    adjust for tor-controlport-filter

    https://phabricator.whonix.org/T573

commit f7ee29c866d376d853140b0feea7e9e6b4446ce7
Author: Patrick Schleizer <adrelanos@riseup.net>
Date:   Wed Dec 7 19:28:48 2016 +0100

    CONTROL_PORT_FILTER_PROXY_PORT="9051"

    https://phabricator.whonix.org/T573

commit 44769385848f287dd663c1bdd05d6a7b5d2472b7
Author: Patrick Schleizer <adrelanos@riseup.net>
Date:   Mon Nov 21 17:43:54 2016 +0000

    readme

commit 0b43f74331fec0b93b15bc4c463c745215fa824f
Author: Patrick Schleizer <adrelanos@riseup.net>
Date:   Wed Oct 12 22:41:31 2016 +0000

    refactoring; fix

    https://phabricator.whonix.org/T462

commit f2dfc5c43cfe28a2b84b4543ee2f8eed07e7b4bd
Author: Patrick Schleizer <adrelanos@riseup.net>
Date:   Wed Oct 12 22:32:39 2016 +0000

    add sane built-in defaults even if config files are non-existing

    https://phabricator.whonix.org/T503

commit e4e8d73af263364870ec7ee6853d689e707991a0
Author: Patrick Schleizer <adrelanos@riseup.net>
Date:   Wed Oct 12 19:57:52 2016 +0200

    limit prerouting rules for socks redirectionto gateway IPs

    to prevent interfering with transparent torification

    Thanks to bubblewap for the bug report and fix suggestions!

    https://phabricator.whonix.org/T462

commit a5bc4b389083f7f7d78bc981209042ca59ba11cd
Author: Patrick Schleizer <adrelanos@riseup.net>
Date:   Thu Oct 6 17:45:56 2016 +0200

    add multiple internal network interfaces for Qubes also

commit 84c7523c3468fb1827e2c7f359db607e725d8b55
Author: Patrick Schleizer <adrelanos@riseup.net>
Date:   Thu Oct 6 17:38:37 2016 +0200

    remove partial Qubes TemplateVM support

    since we do not run Whonix firewall in Qubes TemplateVM

    and because Qubes TemplateVMs will be made non-networked in future

commit 54a32ab11b2e9bc88b55f2cdc559cf402d470ee2
Author: Patrick Schleizer <adrelanos@riseup.net>
Date:   Thu Sep 15 22:32:02 2016 +0000

    add firewall mode to sdwdate log

    https://phabricator.whonix.org/T551

commit c0ac966e2419e402b9daf6ce9e531b1a97197868
Author: Patrick Schleizer <adrelanos@riseup.net>
Date:   Sun Sep 11 17:57:48 2016 +0200

    comments

commit eca0acfa0cbc412d9794a1e9288e27f00fc130c5
Author: Patrick Schleizer <adrelanos@riseup.net>
Date:   Sun Sep 11 17:45:53 2016 +0200

    add configuration option to open external ports

    EXTERNAL_OPEN_PORTS+=" 22 "
    EXTERNAL_OPEN_PORTS+=" 9050 "

    https://phabricator.whonix.org/T533

commit e55b6213a4d284368a4d3736590f516b712a109e
Author: Patrick Schleizer <adrelanos@riseup.net>
Date:   Fri Sep 9 14:26:18 2016 +0000

    limit control-port-filter-python access in timesync-fail-closed mode to localhost

    https://phabricator.whonix.org/T533

commit 4bf032818748398fdc830fb584346f1f820b51fb
Author: Patrick Schleizer <adrelanos@riseup.net>
Date:   Mon Sep 5 16:52:43 2016 +0200

    improved terminology restricted mode to timesync-fail-closed mode

    as suggested by @HulaHoopWhonix

    https://phabricator.whonix.org/T533

commit 1f6c55e840a898741751614f166baf6bb1f5d0e7
Author: Patrick Schleizer <adrelanos@riseup.net>
Date:   Fri Aug 26 20:09:01 2016 +0000

    whonix-firewall.service: Before=shutdown.target

commit 057a01519c361561dad20e4c44f076cf1d18e702
Author: Patrick Schleizer <adrelanos@riseup.net>
Date:   Fri Aug 26 20:03:24 2016 +0000

    Create user sdwdate and whonxicheck so we do not have to depend on these packages.

    https://phabricator.whonix.org/T533

commit 29e282fdb7c7ba1d8a9795c18793b0c198685979
Author: Patrick Schleizer <adrelanos@riseup.net>
Date:   Fri Aug 26 20:00:55 2016 +0000

    create user 'user' if not existing

commit 6efdd73fe45f4cba98ca150d375409bc0a2adad2
Author: Patrick Schleizer <adrelanos@riseup.net>
Date:   Fri Aug 26 02:41:44 2016 +0000

    output

commit b9e7794931be0186825da7ea94717bfec88b6bc4
Author: Patrick Schleizer <adrelanos@riseup.net>
Date:   Fri Aug 26 02:40:47 2016 +0000

    improved firewall mode detection output; refactoring

commit 52d91011594ee3842292cee3c2dc8202277e53af
Author: Patrick Schleizer <adrelanos@riseup.net>
Date:   Wed Aug 24 21:36:10 2016 +0000

    do not run whonix-firewall-sdwdate-watcher.service in Qubes TemplateVM

commit 7ada53980cc74d260ecfb980714fcf93bc46cd70
Author: Patrick Schleizer <adrelanos@riseup.net>
Date:   Wed Aug 24 21:24:44 2016 +0000

    add whonix-firewall-sdwdate-watcher.service

    https://phabricator.whonix.org/T533

commit 2fc16d8ac336f77df65e9eb9e5a26730f687c349
Author: Patrick Schleizer <adrelanos@riseup.net>
Date:   Wed Aug 24 19:43:22 2016 +0000

    iptables block network access until sdwdate succeeded

    for everything but sdwdate and whonixcheck

    https://phabricator.whonix.org/T533

commit e9eaeb71bc85115ebba2121d550f0ddf4c8b4201
Author: Patrick Schleizer <adrelanos@riseup.net>
Date:   Tue Aug 23 17:00:40 2016 +0000

    create status files for first / consecutive runs

    https://phabricator.whonix.org/T533

commit d88073538fa9e5dd14ac46cb7335151ccd3d3a7c
Author: Patrick Schleizer <adrelanos@riseup.net>
Date:   Tue Aug 23 16:40:53 2016 +0000

    refactoring for 'iptables block network access until sdwdate succeeded'

    https://phabricator.whonix.org/T533

commit 149525c6e4e76eff16984ba065e16544fd861b00
Author: Patrick Schleizer <adrelanos@riseup.net>
Date:   Sun Aug 14 21:14:52 2016 +0000

    depend on systemd

commit 7024c181db5ffd09043a04fdd33a8723e35b2c06
Author: Patrick Schleizer <adrelanos@riseup.net>
Date:   Sun Aug 14 20:48:51 2016 +0000

    add networking.service system drop-in to refuse to bring up network on whonix-firewall.service failure

commit 75ab4e3262c6e9ed1ad2ab2b7030b2e1691bcc64
Author: Patrick Schleizer <adrelanos@riseup.net>
Date:   Sun Aug 14 20:15:56 2016 +0000

    control-port-filter-python.service.d systemd drop-in file

    Workaround:
    control-port-filter-python fails if it cannot bind on the network interface.
    This is the case when networking did not come up, which is the case when
    whonix-firewall.service failed. To make control-port-filter-python
    automatically start after lets says Whonix firewall config was fixed and the
    whonix-firewall.service was restarted.

    After=whonix-firewall.service
    Requires=whonix-firewall.service

commit 1d714f89ad6a5f9cebc9c6ed13554f6a5ce76d2b
Author: Patrick Schleizer <adrelanos@riseup.net>
Date:   Sun Aug 14 16:41:28 2016 +0000

    systemd packaging

commit f872fdb193e48337f13b4303988acf9d52c06e47
Author: Patrick Schleizer <adrelanos@riseup.net>
Date:   Sun Aug 14 18:28:44 2016 +0200

    removed /etc/network/if-pre-up.d/30_whonix_firewall

    because ported to systemd

commit 9a048cf886774b413b598663bb40961f365b9c83
Author: Patrick Schleizer <adrelanos@riseup.net>
Date:   Sun Aug 14 18:26:43 2016 +0200

    comment

commit 0f01fd38fa94c7e4b165ffc9dc072bef65666bcb
Author: Patrick Schleizer <adrelanos@riseup.net>
Date:   Sun Aug 14 18:25:34 2016 +0200

    systemd legacy Alias=qubes-whonix-firewall.service

commit c42f8b98106bfb1b902cda6c7224bbc57b0073c8
Author: Patrick Schleizer <adrelanos@riseup.net>
Date:   Sun Aug 14 18:23:03 2016 +0200

    import whonix-firewall.service from qubes-whonix package

commit aedec3a6bc347e100e2071f06899202ce3c0caf3
Author: Patrick Schleizer <adrelanos@riseup.net>
Date:   Sun Aug 14 18:17:10 2016 +0200

    fix dependencies

    Since issue "ifupdown, netbase are dependencies of whonix-gw-network-conf, that cannot
    be added to whonix-gw-network-conf due to conflicts with chroot." was solved.

    Also no longer need to depend on whonix-(gw|ws)-network-conf since in future firewall
    will be load using systemd service rather than /etc/network/pre-up.d.

commit af4f22756d25df3af7335583cd89d92328c04655
Author: Patrick Schleizer <adrelanos@riseup.net>
Date:   Sun Aug 14 16:23:52 2016 +0200

    depend on anon-shared-helper-scripts for enable-firewall

commit 0a859bbd33a0fbc92c86bf18c7d803421b83d9c1
Merge: 46cc7d5 508780d
Author: Patrick Schleizer <adrelanos@riseup.net>
Date:   Mon Jun 20 14:16:58 2016 +0200

    Merge remote-tracking branch 'origin/master'

commit 508780d252112b5e266c5494ee42f7bed76b18f9
Merge: 46cc7d5 1422df2
Author: Patrick Schleizer <adrelanos@riseup.net>
Date:   Mon Jun 20 14:16:20 2016 +0200

    Merge pull request #1 from rustybird/qubes-updates-cache

    qubes-updates-cache: Transparently torify squid traffic

commit 1422df28b79acc37c7cba8001b6786772c9c71f1
Author: Rusty Bird <rustybird@openmailbox.org>
Date:   Sun Jun 19 10:48:40 2016 +0000

    qubes-updates-cache: Transparently torify squid traffic

    qubes-updates-cache runs squid as user/group vm-updates. Eventually,
    qubes-updates-proxy could be modified to run tinyproxy with the same
    credentials so that only one ruleset is needed.

commit 46cc7d5e81a138222f1eb3dc9aa3ca61785d3a7b
Author: Patrick Schleizer <adrelanos@riseup.net>
Date:   Wed May 4 22:07:38 2016 +0000

    bumped changelog version

commit 724a0fc0546c83555a008cd1b7b03c048519121a
Author: Patrick Schleizer <adrelanos@riseup.net>
Date:   Sat Apr 30 18:35:49 2016 +0200

    output

commit 83e4f43bf29d594366926f9abb665a011815f4f3
Author: Patrick Schleizer <adrelanos@riseup.net>
Date:   Sat Apr 30 18:34:56 2016 +0200

    No NAT for tunnel user.

commit f5a57b6fd08e9cbd59747e06835a0a6f7831bf7e
Author: Patrick Schleizer <adrelanos@riseup.net>
Date:   Thu Apr 7 22:54:54 2016 +0000

    bumped changelog version

commit 5a80422a4330a2f38803198b9a1895e2f1778cd1
Author: Patrick Schleizer <adrelanos@riseup.net>
Date:   Tue Apr 5 16:34:01 2016 +0000

    comments

commit 0eb009b44abd1922575e4fa0d2a44c08d4afc425
Author: Patrick Schleizer <adrelanos@riseup.net>
Date:   Tue Apr 5 16:28:52 2016 +0000

    comment

commit b5c6ec2d680eb8331dff8aae51a556d04aa52b2a
Author: Patrick Schleizer <adrelanos@riseup.net>
Date:   Tue Apr 5 16:27:12 2016 +0000

    comment

commit 769ba0797a4c600dca8bb90e6e6d28002e0433de
Author: Patrick Schleizer <adrelanos@riseup.net>
Date:   Tue Apr 5 16:25:46 2016 +0000

    comment

commit 39768229e24d42655e18f9db671806f867735695
Author: Patrick Schleizer <adrelanos@riseup.net>
Date:   Thu Mar 31 20:46:34 2016 +0000

    made NO_NAT_USERS generic and configurable to aid I2PBOX development

    https://forums.whonix.org/t/i2p-running-on-whonix-gateway/2163/9

commit 1a2ad0cf4f12a0c6b296d50642b9b5e64b779ff6
Author: Patrick Schleizer <adrelanos@riseup.net>
Date:   Fri Mar 11 00:59:31 2016 +0000

    intent

commit d6c1e0bc95257c81d8c2bcd3d0959b37e53211dd
Author: Patrick Schleizer <adrelanos@riseup.net>
Date:   Fri Feb 19 18:23:02 2016 +0100

    also source /rw/config/whonix_firewall.d/

    https://forums.whonix.org/t/customizing-whonix-firewall-torified-dom0-upgrades/1356/14

commit f0d7020b6d3511d781cb072b88d5a28b6657c5b9
Author: Patrick Schleizer <adrelanos@riseup.net>
Date:   Thu Jan 28 11:16:13 2016 +0100

    comment

commit a79484d1178b1e4d10043b1e0007079d06ebf2a9
Author: Patrick Schleizer <adrelanos@riseup.net>
Date:   Wed Jan 13 14:57:31 2016 +0100

    comment

commit 6f80dcbfc8c840b9982ee0c1141ba184d8db2c5a
Author: Patrick Schleizer <adrelanos@riseup.net>
Date:   Wed Jan 13 14:56:46 2016 +0100

    minor

commit 7ef15d52e4d61a80f82df0e02b0b3f3ba21c942d
Author: Patrick Schleizer <adrelanos@riseup.net>
Date:   Tue Jan 12 20:31:31 2016 +0100

    refactoring

    Thanks to @marmarek for the suggestion!

commit 14c6e5ad3c37022be1acaa19cc327969d46aef27
Author: Patrick Schleizer <adrelanos@riseup.net>
Date:   Tue Jan 12 11:35:32 2016 +0100

    further refactored / shrinked socks redirection rules

    https://phabricator.whonix.org/T465

commit 34922d3831b6d0894ca22d16857bf3f5692aa754
Author: Patrick Schleizer <adrelanos@riseup.net>
Date:   Sun Jan 10 16:39:05 2016 +0000

    comments

commit e6ed118ede2bd012f5b869cd4b864262472aa9a9
Author: Patrick Schleizer <adrelanos@riseup.net>
Date:   Sun Jan 10 15:53:18 2016 +0000

    refactored / shrinked socks redirection rules

    https://phabricator.whonix.org/T465

commit 7f5f65f6bf682a7f7df1df37976b8733f933f239
Author: Patrick Schleizer <adrelanos@riseup.net>
Date:   Tue Jan 5 13:44:59 2016 +0000

    included DispVM IP range

    Thanks to @marmarek for the suggestion!

    https://phabricator.whonix.org/T462

commit c26d7395e1d0a6d03ffca320109869bdb5b383a7
Author: Patrick Schleizer <adrelanos@riseup.net>
Date:   Tue Dec 29 21:29:19 2015 +0100

    when VPN_FIREWALL=1, allow user 'tunnel'; abolished VPN_SERVERS variable

    https://phabricator.whonix.org/T460

commit 00724fd517e66fed0fb52051635aecb9f8e8dca3
Author: Patrick Schleizer <adrelanos@riseup.net>
Date:   Tue Dec 29 18:28:01 2015 +0100

    create user 'tunnel'

    https://phabricator.whonix.org/T158

commit 35c77c871c3ad449e82f53e2be5c789de8a8f1c7
Author: Patrick Schleizer <adrelanos@riseup.net>
Date:   Fri Dec 25 12:54:30 2015 +0100

    comments

commit 475ff8ae4e2c208146ff10b9de0ff954406bcac7
Author: Patrick Schleizer <adrelanos@riseup.net>
Date:   Wed Dec 9 19:04:05 2015 +0000

    open reload Tor starter maximized by default in Konsole

    https://phabricator.whonix.org/T451

commit 5e6e36a23cb8f273d5d7cbfce13fd7061d45377c
Author: Patrick Schleizer <adrelanos@riseup.net>
Date:   Tue Dec 1 21:40:27 2015 +0000

    fixed config file parser if config folder does not exist

commit bf855328b38194e2e09fcd51650bd487bb7a49c7
Author: Patrick Schleizer <adrelanos@riseup.net>
Date:   Mon Nov 30 21:27:58 2015 +0000

    Only source configuration files that end with the '.conf' extension.

    Thanks to @nrgaway for the suggestion!

    https://phabricator.whonix.org/T286

commit eafa4a9f7ec30b706597c88fccd22506691dfb69
Author: Patrick Schleizer <adrelanos@riseup.net>
Date:   Mon Nov 30 19:44:47 2015 +0000

    Only source configuration files that end with the '.conf' extension.

    Thanks to @nrgaway for the suggestion!

    https://phabricator.whonix.org/T286

commit a6f430d7bc8f8bf47c2eb3e2979fce3d3890d86e
Author: Patrick Schleizer <adrelanos@riseup.net>
Date:   Sun Nov 22 23:41:35 2015 +0000

    redirect tinyproxy traffic to 127.0.0.1 instead to qubes-netvm-gateway

    This saves one call 'qubesdb-read /qubes-netvm-gateway' and is more robust
    in case of IP changes, hypothetical failure or strange output of that command.

    https://phabricator.whonix.org/T434

commit 83779cac13877bc6f41bd8affba06bc7c6d1aa91
Author: Patrick Schleizer <adrelanos@riseup.net>
Date:   Sun Nov 22 22:24:05 2015 +0000

    no longer hardcode eth0

commit 11e30d99b5f866e3be73253fa5f1c11eb1165925
Author: Patrick Schleizer <adrelanos@riseup.net>
Date:   Sun Nov 22 22:22:47 2015 +0000

    no longer depend on /var/run/qubes-service status files

    https://phabricator.whonix.org/T432

commit dac74921a45d5cda93fecc0d59a1d6a6fa572c83
Author: Patrick Schleizer <adrelanos@riseup.net>
Date:   Sun Nov 22 22:14:46 2015 +0000

    no longer hardcode vif+

commit c8db3917b15c1f5bf57b36ad3623fc1b06257df3
Author: Patrick Schleizer <adrelanos@riseup.net>
Date:   Thu Oct 22 23:12:42 2015 +0000

    bumped changelog version

commit 38c7719a93158ac19647216dc19729301aed6f48
Author: Patrick Schleizer <adrelanos@riseup.net>
Date:   Mon Oct 12 11:45:06 2015 +0000

    empty password in Qubes for user clearnet

commit c30ad852911856051f43205f822446cc2a032fec
Author: Patrick Schleizer <adrelanos@riseup.net>
Date:   Fri Sep 18 23:39:06 2015 +0000

    quotes

commit f59c6e902ec9464900785b259c82bbbfb04ff31b
Author: Patrick Schleizer <adrelanos@riseup.net>
Date:   Fri Sep 18 23:30:26 2015 +0000

    cleanup, 'source /usr/lib/qubes-whonix/utility_functions.sh' no longer required, removed

commit 95b784f39938504ba747a622813e51bbf37974b0
Author: Patrick Schleizer <adrelanos@riseup.net>
Date:   Fri Sep 18 23:28:13 2015 +0000

    renamed variable ip to qubes_netvm_gateway_ip

commit 78e3595042cc821148670337012d754216f1b512
Author: Patrick Schleizer <adrelanos@riseup.net>
Date:   Fri Sep 18 23:27:05 2015 +0000

    deprecated Qubes R2 support, code simplification

commit 7e701d557d55e68c3429a73227f994e752949011
Author: Patrick Schleizer <adrelanos@riseup.net>
Date:   Fri Sep 18 23:25:02 2015 +0000

    allow variables INT_IF and INT_TIF being overwritten also in Qubes

commit 1ffbf1ed224b9857ef4060538b8b2e861ca03e14
Author: Patrick Schleizer <adrelanos@riseup.net>
Date:   Fri Sep 18 23:23:18 2015 +0000

    added native Qubes support (ip replace script no longer required); use iptables range notation for variables NON_TOR_GATEWAY and LOCAL_NET

commit d6401bb5e310504a454ee2d65b8b3d46b4dbfdb3
Author: Patrick Schleizer <adrelanos@riseup.net>
Date:   Thu Sep 3 13:00:04 2015 +0000

    added Tor SocksPort 9125 for yum

commit c64f20dfc8ecc65b616d504720c96436173b8e1c
Author: Patrick Schleizer <adrelanos@riseup.net>
Date:   Tue Aug 25 14:08:32 2015 +0000

    bumped changelog version

commit 455d485be99a713f70670ca2bd403000beefd2a3
Author: Patrick Schleizer <adrelanos@riseup.net>
Date:   Mon Aug 24 17:47:32 2015 +0000

    bumped changelog version

commit b478e440b71159961db58650307deeb587545c68
Author: Patrick Schleizer <adrelanos@riseup.net>
Date:   Thu Aug 20 00:39:36 2015 +0000

    Migrated from port Tor's DnsPort 53 to 5300. No longer listening on port 53 but rather on a port higher than 1024 to avoid issues with reloading Tor. (Tor drops privileges and is then unable to create listeners below 1024.)

commit 907f999c9ddc6d9b7bec9eb04c8a5f503cd87c2f
Author: Patrick Schleizer <adrelanos@riseup.net>
Date:   Wed Aug 12 15:28:12 2015 +0200

    refactoring, set INT_IF and INT_TIF for Qubes earlier (below the regular setting of these variables)

commit a88586071ba4026fdb3b025c393ff9a8d7dba355
Author: Patrick Schleizer <adrelanos@riseup.net>
Date:   Wed Aug 12 15:19:10 2015 +0200

    refactoring Qubes firewall rules, 'export' for variables INT_IF and INT_TIF not required, therefore removed

commit e0b5d9e2e9d60c634b48584961c7493adc517ead
Author: Patrick Schleizer <adrelanos@riseup.net>
Date:   Wed Aug 12 15:14:00 2015 +0200

    integrated Qubes-Whonix firewall rules (only load when run in Qubes) so those can be removed from the qubes-whonix package, deprecated GATEWAY_IPv4_DROP_INVALID_INCOMING_PACKAGES_POST_HOOK - https://phabricator.whonix.org/T395

commit db4ad049881f347734faff6682d5d036ae50da78
Author: Patrick Schleizer <adrelanos@riseup.net>
Date:   Sat Jun 6 15:22:53 2015 +0000

    bumped changelog version

commit 6ba2bb28ee5d65d4c6786329b31a81a6b7122d65
Author: Patrick Schleizer <adrelanos@riseup.net>
Date:   Sat Jun 6 14:17:54 2015 +0000

    use iptables --wait - https://phabricator.whonix.org/T344

commit b797bee5f0486d5c388c61c72752683af186ff4e
Author: Patrick Schleizer <adrelanos@riseup.net>
Date:   Thu Jun 4 10:38:17 2015 +0000

    bumped changelog version

commit 6aec420d362ed56f062dd653167e48365648278f
Author: Patrick Schleizer <adrelanos@riseup.net>
Date:   Thu Jun 4 10:36:09 2015 +0000

    Qubes fix - https://phabricator.whonix.org/T339

commit 87ee865fdc4d9c6c8216e909e95882aeff60fc32
Author: Patrick Schleizer <adrelanos@riseup.net>
Date:   Wed Jun 3 15:00:35 2015 +0000

    bumped changelog version

commit 487f3e31c23c8dbe54138fa14dd88225443dc218
Author: Patrick Schleizer <adrelanos@riseup.net>
Date:   Sat May 23 13:50:33 2015 +0000

    bumped changelog version

commit 5332e66f7670903bc4e4c50f1b435ca016734762
Author: Patrick Schleizer <adrelanos@riseup.net>
Date:   Sat May 23 13:48:28 2015 +0000

    Made package more standalone. Requiring 'pre-up /usr/bin/whonix_firewall' in /etc/network/interfaces is no longer necessary. Added etc/network/if-pre-up.d/30_whonix_firewall to load the firewall, because of a Debian upstream bug 'interface comes up even if a script in /etc/network/if-pre-up.d/ fails' http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=700811 was fixed. - https://phabricator.whonix.org/T68

commit fdac25f60a460d475685bad76de9438c78c497ba
Author: Patrick Schleizer <adrelanos@riseup.net>
Date:   Thu Apr 30 17:57:07 2015 +0000

    bumped changelog version

commit add5020b53063579448b4f1007f4530247150570
Author: Patrick Schleizer <adrelanos@riseup.net>
Date:   Tue Apr 28 15:28:09 2015 +0000

    added 'Keywords=' to '.desktop' files to fix lintian warning 'desktop-entry-lacks-keywords-entry' - https://phabricator.whonix.org/T281

commit 6879ea5eb1801e1991a558b99501469d386b540e
Author: Patrick Schleizer <adrelanos@riseup.net>
Date:   Tue Apr 28 13:43:30 2015 +0000

    added debian/source/lintian-overrides with debian-watch-may-check-gpg-signature to fix lintian warning - https://phabricator.whonix.org/T277

commit fd709c569f3723b8ed5370df61ad85d88c1215d2
Author: Patrick Schleizer <adrelanos@riseup.net>
Date:   Sun Apr 26 23:18:38 2015 +0000

    packaging, bumped Standards-Version from 3.9.4 to 3.9.6 for jessie support

commit b95e1e69cb4aedf0647e61edb656f25a8eaeb03e
Author: Patrick Schleizer <adrelanos@riseup.net>
Date:   Tue Apr 7 17:43:06 2015 +0000

    bumped changelog version

commit 2dec7728039383051d91d03b33bb5b5b266ab9ef
Author: Patrick Schleizer <adrelanos@riseup.net>
Date:   Thu Apr 2 18:41:39 2015 +0000

    added genmkfile to Build-Depends

commit c330e446692ea9c40d3520ed07666e44fe23d4af
Author: Patrick Schleizer <adrelanos@riseup.net>
Date:   Thu Apr 2 17:46:37 2015 +0000

    updated debian/rules for makefile generic to version 1.5

commit 7a38c25ceecaf7b45e7d472b90ac69d609ee976d
Author: Patrick Schleizer <adrelanos@riseup.net>
Date:   Thu Apr 2 17:24:54 2015 +0000

    updated makefile generic to version 1.5

commit c8f53919a89afe6ceb433f7a96e1194bbf597120
Author: Patrick Schleizer <adrelanos@riseup.net>
Date:   Tue Mar 24 17:37:10 2015 +0000

    bumped changelog version

commit 281f6970e0ee9fbc5a0e3133e074dd29d7855b75
Author: Patrick Schleizer <adrelanos@riseup.net>
Date:   Tue Mar 24 17:27:00 2015 +0000

    updated makefile generic to version 1.4

commit 5ebca43416269a5fd42c98a80af1b0b3d38adecf
Author: Patrick Schleizer <adrelanos@riseup.net>
Date:   Sun Feb 15 17:59:20 2015 +0000

    provide hook after drop ipv4 invalid packages through variable GATEWAY_IPv4_DROP_INVALID_INCOMING_PACKAGES_POST_HOOK - https://phabricator.whonix.org/T176

commit 75624f8ca739ae670a7cd6eff6e0bf64ff25bb42
Author: Patrick Schleizer <adrelanos@riseup.net>
Date:   Fri Feb 6 04:25:33 2015 +0000

    maintainer script output

commit e37d00c4bf6869104b4c3ca1e0a42c4fcc20e73c
Author: Patrick Schleizer <adrelanos@riseup.net>
Date:   Wed Feb 4 00:56:43 2015 +0000

    bumped changelog version

commit bc5efa48f696fa10a0dccc8c94ce403a4e2e8ed2
Author: Patrick Schleizer <adrelanos@riseup.net>
Date:   Wed Feb 4 00:45:06 2015 +0000

    added changelog.upstream

commit 638ee1a2d7efe1cb76f3dabe8f61683e6c1a992a
Author: Patrick Schleizer <adrelanos@riseup.net>
Date:   Wed Feb 4 00:40:59 2015 +0000

    updated makefile generic to version 1.3

commit 2f5eff01162650a24b356c0b4ab32c9ecc022aab
Author: Patrick Schleizer <adrelanos@riseup.net>
Date:   Tue Feb 3 23:59:00 2015 +0000

    Added creation of upstream changelog to debian/rules

commit 9b0345f9ede5aed4c90c2d6a9f956b3220900071
Author: Patrick Schleizer <adrelanos@riseup.net>
Date:   Tue Jan 27 00:56:00 2015 +0000

    provide an option WORKSTATION_ALLOW_SOCKSIFIED to skip Tor SocksPort iptables rules - https://phabricator.whonix.org/T121

commit dfdaf72382436c110ae10d835c94a3995fb47553
Author: Patrick Schleizer <adrelanos@riseup.net>
Date:   Tue Jan 27 00:34:41 2015 +0000

    support multiple external interfaces - https://phabricator.whonix.org/T120

commit 917d69bd746eca05399341c1a2de61efefeb94c8
Author: Patrick Schleizer <adrelanos@riseup.net>
Date:   Mon Jan 26 04:41:43 2015 +0000

    support multiple internal interfaces - https://phabricator.whonix.org/T109

commit b3da7972e9418258940a1ee9f1a87d1331c575a7
Author: Patrick Schleizer <adrelanos@riseup.net>
Date:   Thu Jan 8 14:41:00 2015 +0000

    comments

commit cdc904d0bc17070cc172d3f2539a58289c8a6f02
Author: Patrick Schleizer <adrelanos@riseup.net>
Date:   Wed Jan 7 19:35:01 2015 +0000

    bumped compat from 8 to 9

commit 414c2105149e02dcff82303e4c5b2dcd60ebbd29
Author: Patrick Schleizer <adrelanos@riseup.net>
Date:   Fri Dec 19 11:41:37 2014 +0000

    RELATED,ESTABLISHED -> ESTABLISHED

commit eafddb3aa33d7916018815086d642ede9ffaebfd
Author: Patrick Schleizer <adrelanos@riseup.net>
Date:   Fri Dec 5 19:01:30 2014 +0000

    updated generic makefile

commit dfa4654392d8f2ad88210e54e60c48814eeca9c9
Author: Patrick Schleizer <adrelanos@riseup.net>
Date:   Tue Oct 28 22:35:34 2014 +0000

    makefile: refactoring, avoid using IFS

commit 00708d47490b44fda49f2c7c4e18fe90bf21ea2d
Author: Patrick Schleizer <adrelanos@riseup.net>
Date:   Sat Oct 25 01:58:54 2014 +0000

    makefile:
    - make debdist; make undebdist
    - cleanup
    - refactoring

commit 797c230f3c0212c50a769e76f6c6430c955898ee
Author: Patrick Schleizer <adrelanos@riseup.net>
Date:   Thu Oct 23 22:43:05 2014 +0000

    makefile:
    - new target "make undist", which deletes the upstream tarball
    - $DISTDIR variable for make (un)dist, which defaults to ".." and can be used to create upstream tarballs in arbitrary locations
    - refactoring, all function names and global variables now start with "make_" to make the script `source`ing friendly
    - made `source`able

commit 81c05a294a4f75f017bf206fa4457c78f51b344f
Author: Patrick Schleizer <adrelanos@riseup.net>
Date:   Mon Oct 13 12:36:59 2014 +0000

    readme

commit 2bb4613676c9792b6cfad9bd018af065f24ce1e2
Author: Patrick Schleizer <adrelanos@riseup.net>
Date:   Tue Aug 19 18:52:46 2014 +0000

    makefile: added new feature "make deb-chl-bumpup" - Bump upstream version number in debian/changelog.

commit 817ef2f6202b31f85e9ff8414fcb502d8ef6c4c0
Author: Patrick Schleizer <adrelanos@riseup.net>
Date:   Mon Aug 18 13:11:57 2014 +0000

    bumped changelog version

commit 827ea83bed41256bda33ab69c173df2878966a30
Author: Patrick Schleizer <adrelanos@riseup.net>
Date:   Mon Aug 18 13:08:39 2014 +0000

    Added 10.0.2.2/24 to NON_TOR_GATEWAY and LOCAL_NET to prevent spamming syslog with:
    host dhclient: DHCPREQUEST on eth0 to 10.0.2.2 port 67
    host dhclient: send_packet: Operation not permitted

commit c2cce72af6dce21cc603abf654960b68aa9dddd9
Author: Patrick Schleizer <adrelanos@riseup.net>
Date:   Sun Aug 17 20:54:28 2014 +0000

    Updated debian/changelog.

commit 85d4009a41a082f17b3e0f2e208a506bff29cca5
Author: Patrick Schleizer <adrelanos@riseup.net>
Date:   Sun Aug 17 20:47:31 2014 +0000

    Fixed changelog date.

commit 42a23808b6146741c415e7587c65b244de3478e0
Author: Patrick Schleizer <adrelanos@riseup.net>
Date:   Sun Aug 17 18:03:33 2014 +0000

    bump version number

commit d3ff4f3d2c45b1326e96c2efa0d44687e79e37fc
Author: Patrick Schleizer <adrelanos@riseup.net>
Date:   Thu Aug 14 13:35:21 2014 +0000

    Implemented make deb-icup: Combination of make deb-pkg, make deb-pkg-install and make deb-pkg-cleanup.

commit 5598c05b4e63f389ac95f6cb0a93851ecfd74c27
Author: Patrick Schleizer <adrelanos@riseup.net>
Date:   Tue Aug 12 19:48:08 2014 +0000

    added Conflicts: ufw

commit b7c14430d9554dd0c7885d11ca64905fcd3ca221
Author: Patrick Schleizer <adrelanos@riseup.net>
Date:   Sun Aug 3 21:00:54 2014 +0000

    Drop all incoming ICMP traffic by default. All incoming connections are dropped by default anyway, but should a user allow incoming ports (such as for incoming SSH or FlashProxy), ICMP should still be dropped to filter for example ICMP time stamp requests.

commit 3a7a0526f42ea75a5333fff23f5d6da80e4f8c62
Author: Patrick Schleizer <adrelanos@riseup.net>
Date:   Mon Jul 28 23:25:47 2014 +0000

    readme

commit f681e44d283ec50ef514db05b51384819ffda9a7
Author: Patrick Schleizer <adrelanos@riseup.net>
Date:   Sun Jul 27 12:42:30 2014 +0000

    packaging

commit 7655a758a60cedf0ab3de5c481d61b2ca5108106
Author: Patrick Schleizer <adrelanos@riseup.net>
Date:   Sun Jul 27 04:01:16 2014 +0000

    packaging

commit efa9ca9c0e1f79b283c9ca056c348afe743fe20d
Author: Patrick Schleizer <adrelanos@riseup.net>
Date:   Sat Jul 26 15:26:41 2014 +0000

    packaging

commit a6d063610dfb66cc0a983bcf149370b120f73469
Author: Patrick Schleizer <adrelanos@riseup.net>
Date:   Sat Jul 26 15:16:08 2014 +0000

    packaging: removed build dependency on git, since the .git folder won't be included in the upstream tarball.

commit 2f6ea8246e85727ea3e16767eb5f076bc84e870f
Author: Patrick Schleizer <adrelanos@riseup.net>
Date:   Fri Jul 25 15:11:16 2014 +0000

    extended package description to fix lintian warning; comment

commit 2b3fd1c7d358652bcf395fc2a7390e7f22010d5e
Author: Patrick Schleizer <adrelanos@riseup.net>
Date:   Sat Jul 12 17:31:56 2014 +0000

    packaging

commit 7aca02118980b032d05a5050d6290e385e31bea9
Author: Patrick Schleizer <adrelanos@riseup.net>
Date:   Sat Jul 12 17:11:04 2014 +0000

    packaging

commit ba7bf6fc628d6d89b765e6f7844060d69d852f1c
Author: Patrick Schleizer <adrelanos@riseup.net>
Date:   Sat Jul 12 15:34:21 2014 +0000

    packaging

commit f961725d63509b4ccfa0f355cbb4876743ecb3b8
Author: Patrick Schleizer <adrelanos@riseup.net>
Date:   Sun Jul 6 11:52:40 2014 +0000

    sanity test

commit 598a7d5c5db364599c3ee331054f47cecb3bdebc
Author: Patrick Schleizer <adrelanos@riseup.net>
Date:   Sat Jul 5 08:11:01 2014 +0000

    Bumped debian revision number to avoid lintian warning "new-package-should-close-itp-bug" so we can use lintian --fail-on-warnings as sanity test.

commit 23dfcc888d99b7499bb8af7f08d2ecc7dfd59a25
Author: Patrick Schleizer <adrelanos@riseup.net>
Date:   Tue Jun 24 15:45:15 2014 +0000

    added debian epoch; added dotglob

commit 10d97b88bd8a0f99460e08d4095b5feef4bb488d
Author: Patrick Schleizer <adrelanos@riseup.net>
Date:   Sat Jun 14 10:05:18 2014 +0000

    packaging

commit 404c7bff8838afbf75cfbe511259a0c380d533cf
Author: Patrick Schleizer <adrelanos@riseup.net>
Date:   Thu Jun 12 04:18:22 2014 +0000

    packaging

commit 07b2c50ee3807bac636fa3878846128b7591e099
Author: Patrick Schleizer <adrelanos@riseup.net>
Date:   Thu Jun 12 04:17:40 2014 +0000

    packaging

commit fedf91a37e58b34859541af547a33f24b80f0f0a
Author: Patrick Schleizer <adrelanos@riseup.net>
Date:   Tue Jun 10 14:19:22 2014 +0000

    update IP as per https://www.whonix.org/forum/index.php/topic,107.0.html

commit dd83eb9cc08f3a3ca8cd6907e212d6928d5481c3
Author: Patrick Schleizer <adrelanos@riseup.net>
Date:   Tue Jun 10 13:03:29 2014 +0000

    comments

commit 75d371d171df7c0a214d7fd0a764c734f1fc28ef
Author: Patrick Schleizer <adrelanos@riseup.net>
Date:   Mon Jun 9 13:48:42 2014 +0000

    added 11.150.150.150/24 to LOCAL_NET

commit d7a91031d0135cb70ed855088602393590588e07
Author: Patrick Schleizer <adrelanos@riseup.net>
Date:   Mon Jun 9 13:35:23 2014 +0000

    added 11.150.150.150/24 to NON_TOR_GATEWAY to be able to change Whonix's internal IPs

commit 1cec5929ae12a5b182585f07d448cdc28fdac03e
Author: Patrick Schleizer <adrelanos@riseup.net>
Date:   Mon Jun 9 13:30:53 2014 +0000

    comments

commit 2cb13eb4d57a52e48ed4ffa11390001f19a94dde
Author: Patrick Schleizer <adrelanos@riseup.net>
Date:   Mon Jun 9 13:28:18 2014 +0000

    reject more invalid packages

commit e545a52b190cd67223d5e1dcf4abfa9dcab5bef5
Author: Patrick Schleizer <adrelanos@riseup.net>
Date:   Mon Jun 9 13:22:33 2014 +0000

    added "iptables -A INPUT -m conntrack --ctstate INVALID -j DROP" in addition to "iptables -A INPUT -m state --state INVALID -j DROP" as inspired by https://lists.torproject.org/pipermail/tor-talk/2014-March/032507.html

commit c7b100bab692a2498c787ee8cac96c5f8d17e14f
Author: Patrick Schleizer <adrelanos@riseup.net>
Date:   Mon Jun 9 13:18:38 2014 +0000

    reject invalid outgoing packages

commit dd142ad0702c1c6a88675fa9d0d7a7bc257e7e16
Author: Patrick Schleizer <adrelanos@riseup.net>
Date:   Sat Jun 7 16:41:05 2014 +0000

    merged anon-gw-clearnet-user package into whonix-gw-firewall package

commit 40a418df50f996c166c9dce5add122c677ad6076
Author: Patrick Schleizer <adrelanos@riseup.net>
Date:   Wed Jun 4 19:28:07 2014 +0000

    comments

commit 8c6fd1f5450cebffdbb09539373a2dec9558aaa2
Author: Patrick Schleizer <adrelanos@riseup.net>
Date:   Wed Jun 4 19:18:05 2014 +0000

    comments

commit 71d725e9afcd4684b98883c700f3644c052b4ec2
Author: Patrick Schleizer <adrelanos@riseup.net>
Date:   Wed Jun 4 19:11:12 2014 +0000

    fix

commit 106fe480dc0745ab55a5320704aa744d9879a485
Author: Patrick Schleizer <adrelanos@riseup.net>
Date:   Wed Jun 4 19:03:01 2014 +0000

    renamed variable NON_TOR_WHONIXG to NON_TOR_GATEWAY

commit e89019e0f41278fdec2fd78410cd8c38152e8fd8
Author: Patrick Schleizer <adrelanos@riseup.net>
Date:   Wed Jun 4 19:00:51 2014 +0000

    make variables overwrite able

commit 4078969e6de62f7e939ae32e9d6374fb3c585162
Author: Patrick Schleizer <adrelanos@riseup.net>
Date:   Wed Jun 4 13:20:27 2014 +0000

    added VPN_FIREWALL feature to Whonix-Gateway's firewall

commit ad298750b4089344610b309b63652565b80b757f
Author: Patrick Schleizer <adrelanos@riseup.net>
Date:   Tue Jun 3 18:27:40 2014 +0000

    readme

commit 15a8d953d2234edfb842924a8a341011ef3dc212
Author: Patrick Schleizer <adrelanos@riseup.net>
Date:   Mon Jun 2 14:40:28 2014 +0000

    packaging

commit 13ee07715aeb5a596d56a84ec22e4fb077718010
Author: Patrick Schleizer <adrelanos@riseup.net>
Date:   Sun Jun 1 15:38:55 2014 +0000

    readme

commit d44cffed4608357c2df3411495bb759d8d16d11b
Author: Patrick Schleizer <adrelanos@riseup.net>
Date:   Thu May 29 11:03:24 2014 +0000

    variable names; cleanup

commit 91172def085f3e503602a9403a1f1adbb3c0db92
Author: Patrick Schleizer <adrelanos@riseup.net>
Date:   Thu May 29 10:58:37 2014 +0000

    initial import from https://github.com/Whonix/Whonix
