See the release schedule.


To release Tails you'll need some packages installed:

  • mktorrent and transmission-cli
  • Aufs DKMS module for your running kernel.
  • tails-iuk dependencies (see debian/control in the debian branch of its repo)
  • tails-perl5lib dependencies (same trick than tails-iuk to get the list)


Export the following environment variables to be able to copy'n'paste the scripts snippets found on this page:

  • version numbers (see release schedule):

    export VERSION=$(dpkg-parsechangelog -SVersion)
    export TAG=$(echo "${VERSION:?}" | sed -e 's,~,-,')
    export PREVIOUS_VERSION=$(dpkg-parsechangelog --offset 1 --count 1 -SVersion)
  • NEXT_PLANNED_VERSION: set to the version number of the next Tails release (e.g. 0.23 when releasing 0.22.1, and 1.3 when releasing 1.2)

  • MAJOR_RELEASE: set to 1 if preparing a major release, to 0 else
  • ISOS: the directory where one stores tails-i386-* sub-directories like the ones downloaded with BitTorrent.
  • ARTIFACTS: the directory where build artifacts (e.g. the .packages file) land.
  • MASTER_CHECKOUT: a checkout of the master branch of the main Tails Git repository.
  • RELEASE_BRANCH: the name of the branch of the main Tails Git repository used to prepare the release (stable or testing).
  • RELEASE_CHECKOUT: a checkout of the branch of the main Tails Git repository used to prepare the release (stable or testing).
  • IUK_CHECKOUT: a checkout of the relevant tag of the iuk Git repository.
  • PERL5LIB_CHECKOUT: a checkout of the relevant tag of the perl5lib Git repository.
  • DIST: either 'alpha' (for RC:s) or 'stable' (for actual releases)
  • export DEBEMAIL=''
  • export DEBFULLNAME='Tails developers'


The release manager role documentation has more tasks that should be done early enough.

Update Icedove preferences

  • update extensions.enigmail.configuredVersion in config/chroot_local-includes/etc/skel/.icedove/profile.default/preferences/0000tails.js

Coordinate with Debian security updates

See Debian security updates.

Select the right branch

What we refer to as the "release branch" (and RELEASE_BRANCH) should be testing for major releases, and stable for point-releases.

Read the remainder of this document from the branch used to prepare the release!


Major release

If we are at freeze time for a major release:

  1. Merge the master Git branch into devel:

     git checkout devel && git merge --no-ff origin/master
  2. Merge each APT overlay suite listed in the devel branch's config/APT_overlays.d/ into the devel APT suite.

  3. Merge the devel Git branch into the testing one:

     git checkout testing && git merge devel

    ... and check that the resulting config/APT_overlays.d/ in the testing branch is empty.

  4. Hard reset the testing custom APT suite to the current state of the devel one.

  5. Freeze the time-based APT repository snapshots that shall be used during the freeze.

  6. Make it so the time-based APT repository snapshots are kept around long enough, by bumping their Valid-Until to 10 days after the next major release (the one after the one you're preparing)'s scheduled date: time-based snapshots


If we are at freeze time for a point-release:

  1. Merge the master Git branch into stable:

     git checkout stable && git merge --no-ff origin/master
  2. Merge each APT overlay suite listed in the stable branch's config/APT_overlays.d/ into the stable APT suite.

Common steps for point and major releases

Reset the release branch's config/base_branch:

    echo "${RELEASE_BRANCH:?}" > config/base_branch && \
       git commit config/base_branch \
           -m "Restore ${RELEASE_BRANCH:?}'s base branch."

Update included files

uBlock patterns and settings file

The patterns+settings file is stored as a converted sqlite text dump in config/chroot_local-includes/usr/share/tails/ublock-origin/ublock0.dump.

  1. Boot Tails
  2. Start the Tor Browser and open the uBlock dashboard by clicking on the uBlock icon.
  3. Select the tab 3rd-party filters
  4. Click on the button Update now to update all used patterns
  5. Close the Tor Browser
  6. Copy the .tor-browser/profile.default/extension-data/ublock0.sqlite from this Tor Browser instance into the root of Tails' Git repo and run the following command:

    # For posterity: the general idea is to introduce \r\n as a
    # token where we have made a line break to make the dump more
    # diff-friendly (and, hence, Git-friendly). The most complex
    # expression is the one done with perl, where we employ
    # negative lookahead. What it means, is: replace single
    # occurrences of | except when followed by \\n.
    echo '.dump' | sqlite3 ublock0.sqlite | \
        grep -v "cached_asset_content://cache://compiled-" | \
        awk '!/^INSERT/; /^INSERT/ {print $0 | "sort -n"}' | \
        sed 's_\\n_\\n\r\n_g' | \
        sed 's_,_,\r\n_g' | \
        perl -pi -e 's/([^|])\|((?!\||\\n).)/\1\|\r\n\2/g' | \
        sed "/^INSERT INTO \"settings\" VALUES('\(remoteBlacklists\|cached_asset_entries\)'/"'s_,_,\r\n_g' > \
  7. Commit:

    git commit -m 'Update uBlock Origin patterns + settings file.' \
  8. Remove the original ublock0.sqlite from the Git root.

Upgrade bundled binary Debian packages

Skip this section unless we are at freeze time for a major release (i.e. we are about to prepare a release candidate).

That is: make sure the bundled binary Debian packages contain up-to-date localization files.

For each bundled Debian package, cd into the package's root directory (e.g. a checkout of the whisperback repository), and then run the import-translations script that is in the main Tails repository. For example:

cd whisperback

If the import-translations script fails to import translations for the current package, manually copy updated PO files from the Transifex branches of git:// (e.g. whisperback_completed) instead. In this case, skip PO files for translation teams that use Git.

Add and commit.

Then check the PO files:


Correct any displayed error, then commit the changes if any.

Then see the relevant release processes, and upload the packages to the release branch's custom APT suite:

Upgrade Tor Browser

See the dedicated page: tor-browser

Upgrade Icedove

See the dedicated page: icedove

Update PO files

Pull updated translations for languages translated in Transifex, refresh the code PO files, and commit the result, including new PO files:

cd "${RELEASE_CHECKOUT:?}" && \
./import-translations  && \
./refresh-translations && \
./submodules/jenkins-tools/slaves/check_po && \
git add po && git commit -m 'Update PO files.'

If check_po complains:

  • delete the offending PO files;
  • send a note to so that they get in touch with whoever can fix them.

When preparing an actual release

If we're about to prepare an image for a final (non-RC) release, then follow these instructions:

Major release

Merge each APT overlay suite listed in the testing branch's config/APT_overlays.d/ into the testing custom APT suite.


For point-releases, we generally do not put any RC out, so freeze time is the same as preparing the actual release. Hence, the following steps have already been done above, and this section is a noop in the general case.

Merge each APT overlay suite listed in the stable branch's config/APT_overlays.d/ into the stable custom APT suite.

Update other base branches

  1. Merge the release branch into devel following the instructions for merging base branches.

  2. Merge devel into feature/stretch following the instructions for merging base branches. Given that these two branches' APT suites have diverged a lot, and that tails-merge-suite currently happily overwrites newer packages in the target with older packages from the source, it's probably easier to just merge each individual APT overlay that was just merged into the release branch into feature/stretch's APT suite. Also, most of our just upgraded bundled packages (e.g. tails-greeter) may need to be rebuilt for Stretch.

  3. Ensure that the release, devel and feature/stretch branches have the expected content in config/APT_overlays.d/: e.g. it must not list any overlay APT suite that has been merged already.

  4. Push the modified branches to Git:

     git push origin                          \
        feature/stretch:feature/stretch       \

Update more included files


Remove the placeholder entry for next release in debian/changelog, and then:

git checkout "${RELEASE_BRANCH:?}" && \
./release ${VERSION:?} ${PREVIOUS_VERSION:?}

This populates the Changelog with the Git log entries.

Then, launch an editor for the needed cleanup of the result:

dch -e

Then, gather other useful information from:

  • every custom bundled package's own Changelog (Greeter, Persistent Volume Assistant, etc.);
  • the diff between the previous version's .packages file and the one from the to-be-released ISO;
  • the "Fix committed" section on the Release Manager View for ${VERSION:?} in Redmine.

Finally, sanity check the version and commit:

if [ "$(dpkg-parsechangelog -SVersion)" = "${VERSION:?}" ]; then
    git commit debian/changelog -m "Update changelog for ${VERSION:?}."
    echo 'Error: version mismatch: please compare ${VERSION:?} with the last entry in debian/changelog'

Included website

Merge master

Merge master into the branch used for the release:

git fetch origin && git merge origin/master

version number

If preparing a RC, skip this part.

In the branch used to build the release, update the wiki/src/inc/* files to match the version number and date of the new release. Set the date at least 24 hours in the future! Between tests and mirror synchronization, the build will not be released on the same day. Try to make sure it matches the date of the future signature.


echo "${VERSION:?}"      > wiki/src/inc/stable_i386_version.html
echo -n "${RELEASE_DATE:?}" > wiki/src/inc/stable_i386_date.html
sed -ri "s%news/version_.*]]%news/version_${VERSION:?}]]%" wiki/src/inc/stable_i386_release_notes.*
${EDITOR:?} wiki/src/inc/*.html
git commit wiki/src/inc/ -m "Update version and date for ${VERSION:?}."

features and design documentation

Read the Changelog carefully, and update features pages accordingly.

Website translations

Refresh the website PO files and commit the ones corresponding to pages that were added or changed accordingly to changes coming with the new release. This e.g. ensures that the RC call for translation points translators to up-to-date PO files:

./build-website && git add wiki/src && git commit -m 'Update website PO files.'
git push origin "${RELEASE_BRANCH:?}:${RELEASE_BRANCH:?}"

Call for translation

If at freeze time, send a call for translations to tails-l10n, making it clear what Git branch the translations must be based on, and what are the priorities. Also, add a few words to remember the translation teams using Git that they should regularly contact Transifex translators, as detailed on the documentation for translators.

To get a list of changes on the website:

git diff --stat ${PREVIOUS_VERSION:?}.. -- \
    *.{mdwn,html} \
    ':!wiki/src/blueprint*' \
    ':!wiki/src/contribute*' \
    ':!wiki/src/inc' \
    ':!wiki/src/news*' \

Import the signing key

Skip this part if you have a Tails signing subkey on an OpenPGPG smartcard, i.e. if you are one of the usual release managers. This is only relevant when the master key has been reassembled, e.g. for signing a Tails emergency release where none of the usual release managers are available.

You should never import the Tails signing key into your own keyring, and a good practice is to import it to a tmpfs to limit the risks that the private key material is written to disk:

export GNUPGHOME=$(mktemp -d)
sudo mount -t ramfs ramfs "${GNUPGHOME:?}"
sudo chown $(id -u):$(id -g) "${GNUPGHOME:?}"
sudo chmod 0700 "${GNUPGHOME:?}"
gpg --homedir ${HOME:?}/.gnupg --export ${TAILS_SIGNATURE_KEY:?} | gpg --import
gpg --import path/to/private-key

Let's also ensure that strong digest algorithms are used for our signatures, like the defaults we set in Tails:

cp config/chroot_local-includes/etc/skel/.gnupg/gpg.conf "${GNUPGHOME:?}"

Build the almost-final image

  1. Build an ISO image from the release branch.
  2. Carefully read the build logs to make sure nothing bad happened.
  3. Keep at least the resulting ISO image and the manifest of needed packages until the end of this release process.
  4. Record where the manifest of needed packages is stored:

     [ -f "${PACKAGES_MANIFEST:?}" ] || echo "ERROR: PACKAGES_MANIFEST is incorrect"

Tag the release in Git

git tag -u "${TAILS_SIGNATURE_KEY:?}" \
  -m "tagging version ${VERSION:?}" "${TAG:?}" && \
git push --tags origin "${RELEASE_BRANCH:?}"

(Pushing the tag is needed so that the APT repository is updated, and the Tails APT configuration works at build and boot time. It might be premature, as testing might reveal critical issues, but this is a signed tag, so it can be overridden later. Yes, there is room for improvement here.)

XXX: From this push of a tag, the builds in Jenkins fail because we prevent it to continue if the last debian/changelog entry has a tag. There are workarounds we need to decide and implement.

Prepare the versioned APT suites

  • Prepare the versioned APT suite in our custom APT repository.

  • Prepare tagged snapshots of upstream APT repositories:

        ./bin/tag-apt-snapshots "${PACKAGES_MANIFEST:?}" "${TAG:?}"


    • This command can take a while (about a dozen minutes).
    • It's expected that the packages that were pulled from our custom APT repository are listed under "some packages were not found anywhere" (because we are current not using time-based snapshots for our custom APT repository). However, no other package should be on that list. Now, we have a "safety" net, in case you don't notice such a problem: if other packages are missing, the next build (that will use the newly created partial, tagged APT repository) will fail.

Build images

Sanity check

Verify that the TBB release used in Tails still is the most recent. Also look if there's a new -buildX tag for the targetted TBB and Tor Browser versions in their respective Git repos:

A new tag may indicate that a new TBB release is imminent.

Better catch this before people spend time doing manual tests.

SquashFS file order

  1. Burn the almost final ISO image to a DVD.
  2. Boot this DVD on bare metal.
  3. Add profile to the kernel command-line.
  4. Login.
  5. Wait for the "Tor is ready" notification.
  6. Start the web browser.
  7. A few minutes later, once the boot-profile process has been killed, retrieve the new sort file from /var/log/boot-profile.
  8. Copy the new sort file to config/binary_rootfs/squashfs.sort.
  9. Cleanup a bit:
    • remove var/log/live/config.pipe: otherwise the boot is broken or super-slow
    • remove the bits about kill-boot-profile at the end: they're only useful when profiling the boot
  10. Inspect the Git diff (including diff stat), apply common sense. The following command is also helpful but requires that you save a copy of the old sort file into /tmp/squashfs.sort.old:

    diff -NaurB \
        <( cut -d' ' -f1 /tmp/squashfs.sort.old | sort ) \
        <( cut -d' ' -f1 config/binary_rootfs/squashfs.sort | sort ) \
        | less
  11. git commit -m 'Updating SquashFS sort file' config/binary_rootfs/squashfs.sort

Build the final image

Then all included files should be up-to-date and the versioned APT suite should be ready, so it is time to:

  • Mark the version as "released" in the changelog:

    dch --release --no-force-save-on-release --maintmaint
    git commit -m "Mark Tails ${VERSION:?} as released." debian/changelog
  • tag the release again, with all included files in:

    git tag -f -u "${TAILS_SIGNATURE_KEY:?}" \
            -m "tagging version ${VERSION:?}" "${TAG:?}" && \
    git push --tags --force && \
    git push origin "${RELEASE_BRANCH:?}"
  • check out the release tag:

    git checkout "${TAG:?}"
  • build the final image!

  • compare the new build manifest with the one from the previous, almost final build; they should be identical, except that the debian-security serial might be higher. To ensure we publish the final build's .build-manifest, please run:

    export PACKAGES_MANIFEST="${ARTIFACTS:?}/tails-i386-${VERSION:?}"
  • check out the release branch again:

    git checkout "${RELEASE_BRANCH:?}"

Generate the OpenPGP signatures and Torrents

First, create a directory with a suitable name and go there:

mkdir "${ISOS:?}/tails-i386-${VERSION:?}" && \
cd "${ISOS:?}/tails-i386-${VERSION:?}"

Second, move the built image to this brand new directory:

mv "${ARTIFACTS:?}/tails-i386-${VERSION:?}.iso" \

Third, generate detached OpenPGP signatures for the image to be published, in the same directory as the image and with a .sig extension; e.g.

gpg --armor --default-key "${TAILS_SIGNATURE_KEY:?}" --detach-sign *.iso
rename 's,\.asc$,.sig,' *.asc

Fourth, go up to the parent directory, create a .torrent file and check the generated .torrent files metainfo:

cd .. && \
mktorrent \
  -a 'udp://' \
  -a 'udp://'   \
  "tails-i386-${VERSION:?}" && \
transmission-show tails-i386-${VERSION:?}.torrent

Lastly, let's set some variables to be used later:

ISO_SHA256SUM="$(sha256sum "${ISO_PATH:?}" | cut -f 1 -d ' ' | tr -d '\n')"
ISO_SIZE_IN_BYTES="$(stat -c %s "${ISO_PATH:?}")"

Prepare incremental upgrades

Build the Incremental Upgrade Kits

Incremental upgrades may be skipped if the delta is too big (like when migrating to a new Debian release) or if there are changes outside of the scope for IUKs (like partition table changes). Use common sense!

Use tails-create-iuk to build the following IUKs:

  • From the two previous planned releases, and any emergency releases in between and after. This should be, more or less, all releases for the last 12 weeks (although irregularities in Firefox release schedule may add or remove a few weeks).

  • From the last RC for the version being released, e.g. 1.0~rc1 to 1.0. This should be done even if there was no IUK generated from the previous stable release since it is a good way to test the iuk code that'll be used for the incremental upgrade paths to the next version.

Include each such version in a white-space separated list called IUK_SOURCE_VERSIONS, (e.g. IUK_SOURCE_VERSIONS="2.8 2.9 2.9.1 2.10~rc1") and run the following:

for source_version in ${IUK_SOURCE_VERSIONS}; do
    sudo su -c "cd ${IUK_CHECKOUT:?} && \
      PERL5LIB=\"${PERL5LIB_CHECKOUT:?}/lib\" \
        ./bin/tails-create-iuk \
           --squashfs-diff-name \"${VERSION:?}.squashfs\"           \
           --old-iso \"${ISOS:?}/tails-i386-${source_version:?}/tails-i386-${source_version:?}.iso\" \
           --new-iso \"${ISOS:?}/tails-i386-${VERSION:?}/tails-i386-${VERSION:?}.iso\"          \
           --outfile \"${ISOS:?}/Tails_i386_${source_version:?}_to_${VERSION:?}.iuk\""

Note that developer tools for creating IUK and upgrade-description files were only tested on Debian sid. It should hopefully work well on Jessie too.

Prepare upgrade-description files

  1. Prepare upgrade-description files (see the upgrade-description files specification for details). The idea is to:

    • update (create if needed) an upgrade-description file for every previous supported release (e.g. N~rc1, N-1, N-1~rc2) that replaces all existing upgrade paths with the path to the version being released;
    • create a new upgrade-description for the version being released, that expresses that no upgrade is available for that one yet.

    This is what tails-iuk-generate-upgrade-description-files tool does:

    ( cd ${IUK_CHECKOUT:?} && \
    ./bin/tails-iuk-generate-upgrade-description-files \
        --version "${VERSION:?}" \
        --next-version "${NEXT_PLANNED_VERSION:?}" \
        --next-version "${NEXT_PLANNED_VERSION:?}~rc1" \
        --next-version "${VERSION:?}.1" \
        --iso "${ISOS:?}/tails-i386-${VERSION:?}/tails-i386-${VERSION:?}.iso" \
        --previous-version "${PREVIOUS_VERSION:?}" \
        --previous-version "${VERSION:?}~rc1" \
        --iuks "${ISOS:?}" \
        --release-checkout "${RELEASE_CHECKOUT:?}" \
        --major-release "${MAJOR_RELEASE:?}" \
    • The --iuks argument must point to the directory where the IUKs generated at the previous step are stored.
    • At least the last stable release and the previous release candidates for the version being released must be passed to --previous-version.
    • Older versions for which there is no incremental upgrade path to the new release must be passed with --previous-version, so that users who skipped a release or two are informed of the new one. Note that multi-steps incremental upgrade paths are valid and supported: e.g. when releasing 1.1.2, 1.1 users should still be able to incrementally upgrade to 1.1.1, and in turn to 1.1.2; to make this work, one must not pass --previous-version 1.1, that would remove the existing incremental upgrade path from 1.1 to 1.1.1.
    • If preparing a release candidate, add --channel alpha
    • If preparing a release candidate, drop all --next-version arguments, and instead pass (untested!) --next-version $(echo ${VERSION:?} | sed -e 's,~rc.*$,,')
    • If preparing a point-release, pass neither --next-version "${VERSION:?}.1", nor --next-version "${VERSION:?}.1~rc1"
  2. Create an armoured detached signature for each created or modified upgrade-description file.

    find "${RELEASE_CHECKOUT:?}/wiki/src/upgrade/" \
       -type f -name upgrades.yml | \
       while read udf; do
           if [ -n "$(git status --porcelain "${udf:?}")" ]; then
               gpg -u "${TAILS_SIGNATURE_KEY:?}" --armor --detach-sign "${udf:?}"
               mv "${udf:?}.asc" "${udf:?}.pgp"
               ( \
                 cd ${IUK_CHECKOUT:?} && \
                 ./bin/tails-iuk-check-upgrade-description-file "${udf:?}" \
               ) || break
  3. Add and commit the upgrade-description files and their detached signatures to the Git branch used to prepare the release (stable or testing):

    ( \
      cd "${RELEASE_CHECKOUT:?}" && git add wiki/src/upgrade && \
      git commit -m "Update upgrade-description files." && \
      git push origin ${RELEASE_BRANCH:?} \
  4. If preparing a release candidate, move the generated or updated files to ${MASTER_CHECKOUT:?}, commit and push: given the updates are advertised on the alpha channel, while all users use the stable one by default, this will allow you to more easily test the IUK without impacting anyone.

  5. If preparing a point release, copy the generated UDF for the previous release in the alpha channel in the master branch, modify its content accordingly, sign it, commit and push

    # If more old versions are supported, add them (whitespace
    # separated) to this variable
    ( \
      cd ${MASTER_CHECKOUT:?} && \
      git fetch && \
      for old_version in ${SUPPORTED_OLD_VERSIONS:?}; do
        stable_udf="wiki/src/upgrade/v1/Tails/${old_version:?}/i386/stable/upgrades.yml" && \
        alpha_udf="wiki/src/upgrade/v1/Tails/${old_version:?}/i386/alpha/upgrades.yml" && \
        git show origin/${RELEASE_BRANCH:?}:${stable_udf:?} \
          | sed -e 's/channel: stable/channel: alpha/' > ${alpha_udf:?} && \
        gpg -u "${TAILS_SIGNATURE_KEY:?}" --armor --detach-sign ${alpha_udf:?} && \
        mv ${alpha_udf:?}.asc ${alpha_udf:?}.pgp && \
        git add ${alpha_udf:?}* ; \
      done && \
      git commit -m "Add incremental upgrades on the alpha channel for Tails ${VERSION:?}" && \
      git push origin master:master \

Prepare the ISO description file for DAVE

If preparing a RC, skip this part.

Update the ISO description file (IDF) used by the browser extension:

cat > "${RELEASE_CHECKOUT:?}"/wiki/src/install/v1/Tails/i386/stable/latest.yml <<EOF
build-target: i386
channel: stable
product-name: Tails
version: '${VERSION:?}'
- sha256: ${ISO_SHA256SUM}
  size: ${ISO_SIZE_IN_BYTES:?}
( cd "${RELEASE_CHECKOUT:?}" && \
  git add wiki/src/install/v1/Tails/i386/stable/latest.yml && \
  git commit -m "Update IDF file for DAVE." )

Upload images

Sanity check

Verify once more that the TBB we ship is still the most recent (see above).

Announce, seed and test the Torrents

Announce and seed the Torrents.

Test them with a BitTorrent client running in a different place.

Download and seed image from lizard

scp "${ISOS:?}/tails-i386-${VERSION:?}.torrent" \
   bittorrent.lizard: && \
   ssh bittorrent.lizard \
     transmission-remote --add tails-i386-${VERSION:?}.torrent \
       --find /var/lib/transmission-daemon/downloads/

Publish the ISO and IUK over HTTP

Upload the images to the primary rsync mirror. Best practice is to first let bittorrent.lizard download the image, and then copy it from there to rsync.lizard:

ssh \
    scp -3 -r \
        bittorrent.lizard:/var/lib/transmission-daemon/downloads/tails-i386-${VERSION:?} \
ssh rsync.lizard << EOF
  sudo chown -R root:rsync_tails \
     tails-i386-${VERSION:?} \
     Tails_i386_${PREVIOUS_VERSION:?}_to_${VERSION:?}.iuk && \
  sudo chmod -R u=rwX,go=rX \
     tails-i386-${VERSION:?} \
     Tails_i386_${PREVIOUS_VERSION:?}_to_${VERSION:?}.iuk && \
  sudo mv tails-i386-${VERSION:?} \
          /srv/rsync/tails/tails/${DIST:?}/ && \
  sudo mv Tails_i386_${PREVIOUS_VERSION:?}_to_${VERSION:?}.iuk \

Update the time in project/trace file on the primary rsync mirror and on the live wiki (even for a release candidate):

TRACE_TIME=$(date +%s) &&
echo ${TRACE_TIME:?} | ssh rsync.lizard "cat > /srv/rsync/tails/tails/project/trace" && \
[ -n "${MASTER_CHECKOUT:?}" ] && \
echo ${TRACE_TIME:?} > "${MASTER_CHECKOUT:?}/wiki/src/inc/trace" &&
   cd "${MASTER_CHECKOUT:?}" && \
   git commit wiki/src/inc/trace \
      -m "Updating trace file after uploading ${VERSION:?}." && \
   git push origin master

ISO history

Push the released ISO to our Tails ISO history git-annex repo, so that our isotesters can fetch it from there for their testing. How to do so is described in our internal Git repo.

Update the website and Git repository

What follows in this section happens on the release branch in ${RELEASE_CHECKOUT:?}.

If preparing a final release

Skip this part if preparing a RC.

Rename the .packages file to remove the .iso and build date parts of its name:

mv "${ARTIFACTS:?}"/tails-i386-"${VERSION:?}".iso.packages \

Rename the manifest of needed packages as well:

mv "${PACKAGES_MANIFEST:?}" "${ARTIFACTS:?}/tails-i386-${VERSION:?}.build-manifest"

Copy the .iso.sig, .build-manifest, .packages, .torrent and .torrent.sig files into the website repository:

cp "${ISOS:?}/tails-i386-${VERSION:?}/tails-i386-${VERSION:?}.iso.sig" \
   "${ARTIFACTS:?}/tails-i386-${VERSION:?}.build-manifest" \
   "${ARTIFACTS:?}/tails-i386-${VERSION:?}.packages" \
   "${ISOS:?}/tails-i386-${VERSION:?}.torrent" \

Remove from wiki/src/torrents/files/ any remaining file from the previous release (including any RC).

Update the size of the ISO image in inc/*:

    LC_NUMERIC=C ls -l -h ${ISOS:?}/tails-i386-${VERSION:?}/tails-i386-${VERSION:?}.iso | \
      cut -f 5 -d ' ' | sed -r 's/(.+)([MG])/\1 \2iB/' \
      > "${RELEASE_CHECKOUT:?}/wiki/src/inc/stable_i386_iso_size.html"

Generate the expected signature verification output:

  gpg --keyid-format 0xlong --verify "${ISO_PATH:?}.sig" "${ISO_PATH:?}" 2>&1 | \
  sed 's/ /\&nbsp;/g;s/</\&lt;/;s/>/\&gt;/;s/$/<br\/>/g' > \

Update the known issues page:

  • Add regressions brought by the new release.
  • Remove older known issues that are fixed by the new release.

Write the announcement for the release in wiki/src/news/version_${TAG:?}.mdwn. See the release notes documentation

XXX: we should probably merge that into the above liked documentation. Check you correctly:

  • Updated the meta title directive.
  • Updated the meta date directive.
  • Made sure there's an announce tag to have an email sent to the news mailing list.
  • Documented important config changes that persistence users have to do themselves (e.g. the Pidgin proxy settings change in 9925321 breaks all existing persistent profiles).
  • Documented known issues.

Write an announcement listing the security bugs affecting the previous version in wiki/src/security/Numerous_security_holes_in_${PREVIOUS_VERSION:?}.mdwn in order to let the users of the old versions know that they have to upgrade. Date it a few days before the ISO image to be released was built. Including:

If preparing a release candidate

Skip this part if preparing a final release.

Copy the .iso.sig file into the website repository:

cp "${ISO_PATH:?}.sig" \
   "${ISOS:?}/tails-i386-${VERSION:?}.torrent" \

Write the announcement for the release in ${MASTER_CHECKOUT:?}/wiki/src/news/test_${TAG:?}.mdwn, including:

  • Update the meta title directive.
  • Update the meta date directive.
  • Document important config changes that persistence users have to do themselves (e.g. the Pidgin proxy settings change in 9925321 breaks all existing persistent profiles).
  • Document known issues.
  • This snippet can help to convert the copied changelog's ticket references to links:

    sed -i 's@#\([0-9]\{4,5\}\)@<a href="\1">#\1</a>@g' \

In any case

Generate PO files for the announcements with ./build-website.

Then, send them to so that they get translated shortly, perhaps even soon enough to integrate them before pushing the release out officially.

Then, record the last commit before putting the release out for real:

git add wiki/src && \
git commit -m "releasing version ${VERSION:?}"


  1. Using check-mirrors, choose a fast mirror that already has the tentative ISO. E.g. or are reliable and have plenty of bandwidth.
  2. Email to ask them to test the tentative ISO, pointing them to the up-to-date mirror you've found previously.
  3. Set up a pad and copy the manual test suite in it.
  4. Email and potential contributors (see manual_testers.mdwn in the internal Git repository) that tests may start:
    • point them to the up-to-date mirror you've found previously
    • make it clear what's the deadline
    • make it clear where and how you expect to get feedback
    • attach the Torrent
    • attach the .packages file
  5. Make sure someone is committed to run the automated test suite.
  6. Make sure that enough people are here to run the tests, that they report their results in due time, and that they make it clear when they're leaving for good.
  7. Fill the holes and make sure that the manual test suite is done in due time.
  8. Triage test results, reproduce bugs as needed, decide what the next step is and make sure it happens: add to known issues? file ticket? release blocker?

Go wild!

Wait for the HTTP mirrors to catch up

Test downloading the ISO and IUK over HTTP.

Make sure every active mirror in the pool has the new version (when releasing an RC, add --channel alpha):

./check-mirrors.rb --allow-multiple --fast tails-i386-${VERSION:?}

Ask to drop those that are lagging behind and notify their administrators.

Sanity check

Verify once more that the TBB we ship is still the most recent (see above).



If preparing a release candidate, just push the master branch:

git push origin master:master

If preparing an actual release, push the last commits to our Git repository like this:

( cd "${RELEASE_CHECKOUT:?}" && \
  git push origin "${RELEASE_BRANCH:?}:${RELEASE_BRANCH:?}" \
                  devel:devel \
) && \
( cd "${MASTER_CHECKOUT:?}" && \
  git fetch && \
  git merge "origin/${RELEASE_BRANCH:?}" && \
  git push origin master:master \

Bug tracker

Skip this part if preparing a release candidate.

Mark all issues fixed in this release as Status: Resolved in our bug tracker. For a list of candidates, see:

Then, mark the just-released Redmine milestone as done: go to the target version page, click Edit, and set Status to Closed.

Tickets linked from the website

Go through the tickets linked from the documentation and support sections of the website and point documentation writers to the tickets that might be resolved in this release.

find wiki/src/{doc,support} -name "*.mdwn" -o -name "*.html" | xargs cat | \
    ruby -e 'puts\[\[!tails_ticket\s+(\d+)[^\]]*\]\]/)' | \
    while read ticket; do
        url_content=$(curl --fail --silent ${url:?})
        if [ "${?}" -ne 0 ]; then
            echo "Failed to fetch ${url:?} so manually investigate #${ticket:?}" >&2
        ticket_status=$(echo "${url_content:?}" | \
            sed -n 's,^.*<th class="status">Status:</th><td class="status">\([^<]\+\)</td>.*$,\1,p')
        if [ "${ticket_status:?}" != "New" ] && \
           [ "${ticket_status:?}" != "Confirmed" ] && \
           [ "${ticket_status:?}" != "In Progress" ]; then
            echo "It seems ticket #${ticket:?} has been fixed (Status: ${ticket_status:?}) so please find all instances in the wiki and fix them. Ticket URL: ${url:?}"

Remember that ticket expressions, e.g. <a href="">#1234</a>, can span several lines, so finding the ones reported by the above code might be harder than git grep "tails_ticket 1234".


Check in the comments of the ticket for the release notes if the technical writers have prepared a tweet. Otherwise tweet a simple link to the release notes:

Tails x.y is out:

Tor blog

We announce major releases on the Tor blog:

  • login to their Drupal
  • Add a New Blog Post
  • add the same tags as the previous release announce had
  • choose Filtered HTML as the Input format
  • paste the HTML generated by ikiwiki from the announce in news/ into the textarea in the blog post editor
  • cleanup a bit to make it shorter
  • add a link to the installation assistant
  • change the internal links into external links
  • turn <h1> into <strong>
  • direct users to our communication channels for comments and feedback
  • disable comments

Tor weekly news

Write a short announcement for the Tor weekly news's next issue (follow the Next steps link), or find someone who's happy to do it.

Amnesia news

The release announcement are automatically sent to amnesia-news@ (thanks to the announce flag) on an hourly basis, but it will be stuck in the moderation queue. Log in and accept it.

Prepare for the next release

XXX: adapt / fork for release candidates. In the meantime, read all this, and skip what does not make sense for a RC.

  1. If you just released a new stable release, remove the previous stable release on the mirrors.
  2. Remove any remaining RC for the just-published release from the mirrors.
  3. Revert the commits adding alpha channel incremental upgrades to the just released version.
  4. Remove IUKs that are more than 6 months old from /{stable,alpha}/iuk on the rsync server:

    • first check that it's not going to remove anything we want to keep:

      ssh rsync.lizard /bin/sh -c \
          \"find /srv/rsync/tails/tails/alpha  \
                 /srv/rsync/tails/tails/stable \
                 -type f -name '*.iuk' -mtime '+183' \
                 -not -name '*~test_*~test.iuk' -ls \
    • then actually delete the files:

      ssh rsync.lizard /bin/sh -c \
          \"find /srv/rsync/tails/tails/alpha  \
                 /srv/rsync/tails/tails/stable \
                 -type f -name '*.iuk' -mtime '+183' \
                 -not -name '*~test_*~test.iuk' -delete \
  5. Delete Git branches that were merged:

     bare_repo=$(mktemp -d)
     (cd "${MASTER_CHECKOUT:?}" && git fetch) && \
     (cd "${MASTER_CHECKOUT:?}" && git submodule update) && \
     git clone --bare --reference "${MASTER_CHECKOUT:?}" \ \
        "${bare_repo:?}" && \
     PYTHONPATH=lib/python3 ./bin/delete-merged-git-branches \
        --repo "${bare_repo:?}" && \
     rm -rf "${bare_repo:?}"
  6. Remove all old versions in wiki/src/upgrade/v1/Tails and debian/changelog that were never released. Explanation: the post-release APT repository steps from the previous stable release will usually have had us prepare for an emergency release that was never made.

  7. Thaw the packages that were granted freeze exceptions.
  8. Pull master back and merge it into stable, and in turn into devel
  9. Thaw, on the devel branch, the time-based APT repository snapshots that were used during the freeze.
  10. Follow the post-release custom APT repository documentation. Make sure there are upgrade-description files for any new versions that were added.
  11. Verify that the snapshots used in the release branch are ok, e.g. they use the correct snapshots, and they were bumped appropriately (they should expire a bit after the next release, so the dates must be ~six weeks in the future). Look carefully at the output of this command:

     git checkout "${RELEASE_BRANCH:?}" && \
         cd config/APT_snapshots.d && \
         for ARCHIVE in * ; do
             SERIAL="$(cat ${ARCHIVE:?}/serial)"
             if [ "${SERIAL:?}" = 'latest' ]; then
                 if [ "${ARCHIVE:?}" != 'debian-security' ]; then
                     echo "Warning: origin '${ARCHIVE:?}' is using the 'latest' snapshot, which is unexpected" >&2
                 EXPIRY="$(curl --silent "${ARCHIVE:?}/dists/stable/snapshots/${SERIAL:?}/Release" | sed -n 's/^Valid-Until:\s\+\(.*\)$/\1/p')"
            echo "Origin '${ARCHIVE:?}' uses snapshot '${SERIAL:?}' which expires on: ${EXPIRY:?}"
  12. Push the resulting branches.

  13. Make sure Jenkins manages to build all updated major branches:
  14. Delete the Release Manager View for ${VERSION:?}_ Redmine custom query.
  15. Ensure the next few releases have their own Release Manager View.
  16. On the roadmap, update the Due date for the Holes in the Roof so that this section appears after the next release.
  17. If you are the release manager for the next release too, look at the tasks that must be done at the beginning of your shift in the release manager role page.

Related pages