Update SecureDrop workstation to support 4.2 and use an install-time base template. #970

zenmonkeykstop · 2024-04-02T13:52:36Z

Status

Work in progress:

sdw-admin --apply command detects existing appVM dependencies on debian-12-minimal and alerts the user, but should also reinstall debian-12-minimal if necessary
some tests failing - needs a grsec kernel with the expected identifier (including -workstation-grsec) and needs updates to the RPC checks.
launcher tests are failing in CI

Description of Changes

Fixes #969 .

Testing

Much larger plan TK, but roughly

Provision dev env via make clone, make dev, verify that the latter completes successfully
reboot
Verify that make test passes
Verify that the launcher is triggered and update is successful
Verify basic client functionality (log in, retrieve and view submissions,, reply, export/print)

Deployment

Migration from 4.1 is not supported - fresh installs on 4.2 only.

Checklist

If you have made changes to the provisioning logic

All tests (make test) pass in dom0

If you have added or removed files

vi

I have updated MANIFEST.in and rpm-build/SPECS/securedrop-workstation-dom0-config.spec

If documentation is required

I have opened a PR in the docs repo for these changes, or will do so later
I would appreciate help with the documentation

Makefile

legoktm · 2024-04-02T14:11:46Z

Makefile

-	TERM=xterm-256color $(CONTAINER) bash -c "sudo ln -s $$PWD/scripts/fake-setarch.py /usr/local/bin/setarch && sudo reprotest 'make build-rpm' 'rpm-build/RPMS/noarch/*.rpm' --variations '+all,+kernel,-fileordering,-domain_host'"
+	TERM=xterm-256color $(CONTAINER) bash -c "sudo ln -s $$PWD/scripts/fake-setarch.py /usr/local/bin/setarch && sudo reprotest 'make build-rpm' 'rpm-build/RPMS/noarch/*.rpm' --variations '+all,+kernel,-time,-fileordering,-domain_host'"
+	@echo
+	@echo Warning! Temporarily removed time variations for reprotest.


This seems like a blocker. Or if its just reprotest/libfaketime we can switch to the approach of doing two builds and then diffing them.

legoktm · 2024-04-02T14:12:25Z

dom0/sd-base-template-files.sls

+sd-base-template-install-additional-packages:
+  pkg.installed:
+    - pkgs:
+      - qubes-core-agent-passwordless-root


All of these should be dependencies in -config or other packages. But I'm not sure why we're not starting with the GNOME (or even XFCE) templates to begin with, I thought that was what we had discussed initially?

If we start with -gnome or -xfce, then the base template will include more than we want. The initial discussion was actually around using -minimal, I did flip to -xfce temporarily, but the resulting attack surface in terms of unused packages is too great, and removing them would be more hassle than starting with minimal and adding just what we need.

But I'm on board with adding them in the securedrop-workstation-config package.

legoktm · 2024-04-02T14:16:05Z

rpm-build/SPECS/securedrop-workstation-dom0-config.spec

@@ -53,6 +51,9 @@ configuration over time.

 %install
 %{python3} -m pip install --no-compile --no-index --no-build-isolation --root %{buildroot} .
+# direct_url.json is is not reproducible and not strictly needed
+rm %{buildroot}/%{python3_sitelib}/*%{version}.dist-info/direct_url.json
+sed -i "/\.dist-info\/direct_url\.json,/d" %{buildroot}/%{python3_sitelib}/*%{version}.dist-info/RECORD


from the client:

override_dh_strip_nondeterminism: find ./debian/ -type f -name '*.pyc' -delete find ./debian/ -type d -name '__pycache__' -delete find ./debian/ -type f -name 'pip-selfcheck.json' -delete find ./debian/ -type f -name 'direct_url.json' -delete find ./debian/ -type f -name 'RECORD' -delete dh_strip_nondeterminism $@

let's just delete these instead of trying to fix them up

legoktm · 2024-04-02T19:28:33Z

Summary of the dom0 test failures:

test_sd_client_apparmor - apparently not set to enforce
test_log_dirs_properly_named / test_logs_are_flowing - unclear what the error is, but probably related to the next two
test_redis_service_running - it's not running
test_sd_log_service_running - it's not running
test_sd_proxy_rpc_spec - file doesn't exist maybe?
test_Policies - RPC policy doesn't exist
test_sd_workstation_template - template doesn't exist
test_all_fedora_vms_uptodate - Command 'sudo dnf check-update' returned non-zero exit status 100.
test_gpg_domain_configured - returned '' instead of sd-gpg
test_logging_configured, and a number of related dependency-related tests all saying not installed
test_mime_types - selecting wrong opener
_check_kernel - known that the kernel is reporting the wrong version
test_all_sd_vm_apt_sources - missing apt source

rocodes · 2024-04-02T19:52:21Z

dom0/sd-dom0-qvm-rpc.sls

@@ -146,10 +70,23 @@ dom0-rpc-qubes.r5-format-ask-allow:
        securedrop.Log          *           sd-log sd-log deny notify=no
        securedrop.Log          *           @tag:sd-workstation sd-log allow

+        securedrop.Proxy        *           sd-app sd-proxy allow
+
+        qubes.Gpg               *           @tag:sd-client sd-gpg allow


(are we missing the allow rule for GpgImportKey? qubes.GpgImportKey * @tag:sd-client sd-gpg allow)

rocodes · 2024-04-02T19:57:59Z

dom0/sd-dom0-qvm-rpc.sls

+
+        qubes.USB               *           sd-devices sys-usb allow
+
+        # TODO: should this be handled with the new Global Config UI instead?


I think this is appropriate for this policy file, so that the config is set by files we control (and if uninstall is run it will be removed cleanly)

rocodes · 2024-04-02T21:19:33Z

dom0/sd-logging-setup.sls

@@ -1,7 +1,8 @@
 # -*- coding: utf-8 -*-
 # vim: set syntax=yaml ts=2 sw=2 sts=2 et :

-{% if grains['id'] in ["securedrop-workstation-bullseye", "sd-small-bullseye-template", "sd-large-bullseye-template"] %}
+# TODO: parametrise this
+{% if grains['id'] in ["sd-small-bookworm-template", "sd-large-bookworm-template"] %}


nit: if we check against {{ sdvars.distribution }} , we will more towards one source of truth for debian version name (maybe that's what you meant by parameterise?)

Yup that's what I meant.

rocodes · 2024-04-02T21:30:24Z

dom0/securedrop-check-migration

@@ -22,7 +22,7 @@ function request_migration() {

 # Template consolidation. If old template names are found,
 # then we must rerun the full states to re-apply.
-if [[ -n "$(qvm-ls --tags sd-workstation --raw-list | perl -nE '/sd-(?!small|large).*-template/ and print $_')" ]] ; then
+if [[ -n "$(qvm-ls --tags sd-workstation --raw-list | perl -nE '/sd-(?!small|large|base).*-template/ and print $_')" ]] ; then
    reason="template-consolidation"


Can we remove this, since we're starting clean on 4.2?

Yup, I think so.

rocodes · 2024-04-02T21:37:39Z

dom0/sd-dom0-files.sls

-
-dom0-install-securedrop-workstation-template:
+# Ensure debian-12-minimal is present for use as base template
+dom0-install-debian-minimal-template:
  cmd.run:


I think we can just use qvm.template_installed instead of cmd.run. If memory serves, we had an issue with the qvm-template tooling because we were using the same repo to serve templates and the dom0 config rpm, and qvm-template was upset by this.

This can probably be an issue.

legoktm · 2024-04-02T22:45:42Z

I squashed it down from 41 commits to 11. 3 are annotated as FIXMES, I think we'd want to drop them before merging. I'll look into the rpm reproducibility issue tomorrow, and the shutdown VMs one can be dropped once freedomofpress/securedrop-workstation-ci#44 is deployed. I'm not sure about the qvm-check one.

mig5 · 2024-04-03T00:45:31Z

the shutdown VMs one can be dropped once freedomofpress/securedrop-workstation-ci#44 is deployed.

freedomofpress/securedrop-workstation-ci#44 is now merged and deployed to the runner bastion, should now be active for all future CI runs.

rocodes · 2024-04-03T14:32:19Z

dom0/sd-sys-vms.sls

 # Finally, remove the old supported fedora DVM we created. We won't uninstall
 # the template, in case it's being used elsewhere, but the `sd-` VMs we can
 # reasonably manage (remove) ourselves.
+# TODO: does this need to be updated to refer to sd-fedora-<previous>-dvm? or was it
+# a one-time thing?


Yes, if we're still going with sd-fedora-xx-dvm for the sys-usb dvm template, it would be friendly to clean up the old ones when we're not using them anymore. But since we're installing clean on 4.2, users won't have an out-of-date sd-fedora dvm on their machines, so this won't be relevant til the next fedora base template upgrade.

files/provision-all

files/sdw-admin.py

rocodes · 2024-04-03T14:56:42Z

files/sdw-admin.py

+            "SecureDrop Workstation should be installed on a fresh Qubes OS install.\n"
+            "The installation process will overwrite any user modifications to the\n"
+            f"{BASE_TEMPLATE} TemplateVM, and will disable old-format qubes-rpc\n"
+            "policy directives.\n"


I don't think this latter part is true anymore - I think we have decided that we won't disable them, we'll just make sure all our rules take precedence before the old-style rules can even load.

sdw-admin will get another pass to clean up output and add more stringent prod checks, we can bake that final decision in (and maybe check the rpc rules config as well as checking for VMs) when we do.

deeplow · 2024-04-03T19:17:29Z

tests/test_vms_platform.py

@@ -9,7 +9,7 @@
 BULLSEYE_STRING = "Debian GNU/Linux 11 (bullseye)"


Can be removed, I think.

legoktm · 2024-04-03T21:13:23Z

I don't want to disuade people from pointing out things that can safely be removed, because I think there's a bunch, but I think we can defer them for follow-up PRs that will be trivial to merge?

In my testing locally, with the two commits I just pushed, the only test failures I have left are related to the kernel version. There are a few different failures remaining in CI that I wonder if they're related to the VM shutdown issue (but I can see they're being shut down in the log?)

zenmonkeykstop · 2024-04-04T00:56:17Z

I don't want to disuade people from pointing out things that can safely be removed, because I think there's a bunch, but I think we can defer them for follow-up PRs that will be trivial to merge?

Yup, I agree - I'd like to get a functional 4.2 main ASAP and work on fixes/major changes/tweaks, in that order.

legoktm · 2024-04-04T01:00:26Z

We're down to two failing tests (excluding kernel version suffix):

INFO:[2024-04-04-00:02:31:790536] ======================================================================
INFO:[2024-04-04-00:02:31:790573] ERROR: test_all_fedora_vms_uptodate (test_vms_platform.SD_VM_Platform_Tests.test_all_fedora_vms_uptodate)
INFO:[2024-04-04-00:02:31:790610] Asserts that all Fedora-based templates, such as sys-net, have all
INFO:[2024-04-04-00:02:31:790647] ----------------------------------------------------------------------
INFO:[2024-04-04-00:02:31:790682] Traceback (most recent call last):
INFO:[2024-04-04-00:02:31:790718]   File "/home/user/securedrop-workstation/tests/test_vms_platform.py", line 174, in test_all_fedora_vms_uptodate
INFO:[2024-04-04-00:02:31:790752]     self._ensure_packages_up_to_date(vm, fedora=True)
INFO:[2024-04-04-00:02:31:790788]   File "/home/user/securedrop-workstation/tests/test_vms_platform.py", line 104, in _ensure_packages_up_to_date
INFO:[2024-04-04-00:02:31:790821]     stdout, stderr = vm.run(cmd)
INFO:[2024-04-04-00:02:31:790858]                      ^^^^^^^^^^^
INFO:[2024-04-04-00:02:31:790891]   File "/usr/lib/python3.11/site-packages/qubesadmin/vm/__init__.py", line 320, in run
INFO:[2024-04-04-00:02:31:790927]     raise e
INFO:[2024-04-04-00:02:31:790960]   File "/usr/lib/python3.11/site-packages/qubesadmin/vm/__init__.py", line 316, in run
INFO:[2024-04-04-00:02:31:790996]     return self.run_service_for_stdio('qubes.VMShell',
INFO:[2024-04-04-00:02:31:791029]            ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
INFO:[2024-04-04-00:02:31:791064]   File "/usr/lib/python3.11/site-packages/qubesadmin/vm/__init__.py", line 296, in run_service_for_stdio
INFO:[2024-04-04-00:02:31:791098]     raise exc
INFO:[2024-04-04-00:02:31:791135] subprocess.CalledProcessError: Command 'sudo dnf check-update' returned non-zero exit status 100.

and

INFO:[2024-04-04-00:02:31:792645] ======================================================================
INFO:[2024-04-04-00:02:31:792681] FAIL: test_all_sd_vm_apt_sources (test_vms_platform.SD_VM_Platform_Tests.test_all_sd_vm_apt_sources)
INFO:[2024-04-04-00:02:31:792716] Test all VMs fpf apt source list iteratively.
INFO:[2024-04-04-00:02:31:792753] ----------------------------------------------------------------------
INFO:[2024-04-04-00:02:31:792787] Traceback (most recent call last):
INFO:[2024-04-04-00:02:31:792823]   File "/home/user/securedrop-workstation/tests/test_vms_platform.py", line 221, in test_all_sd_vm_apt_sources
INFO:[2024-04-04-00:02:31:792857]     self._validate_apt_sources(vm)
INFO:[2024-04-04-00:02:31:792893]   File "/home/user/securedrop-workstation/tests/test_vms_platform.py", line 83, in _validate_apt_sources
INFO:[2024-04-04-00:02:31:792927]     self.assertTrue(self.apt_url in contents)
INFO:[2024-04-04-00:02:31:792963] AssertionError: False is not true

I pushed some better error messages to surface which VMs are at fault. I suspect it's sys-net, etc. that have pending Fedora updates because we're not restarting them (since they don't have the sd-workstation tag). I also don't know if we can restart them, because we need a network connection to communicate with the ws-ci-bastion. If this is the case I would suggest we skip these tests if we're in the CI environment and leave a fixme for a better solution.

zenmonkeykstop · 2024-04-04T01:02:23Z

One option (for the system template updates at least) might be to trigger the cli updater as a first/early step in the install process. For the pilot we told folk to manually update before kicking things off, but if we can do it for them so much the better.

legoktm · 2024-04-04T01:03:02Z

Also the VM shutdown we did in the CI repo doesn't seem sufficient, I think we might need to properly wait until they're shutdown. So we can probably ship the current FIXME commit (with a different summary) and revert it once CI is fixed.

Primarily changing the base dev containers to Fedora 37 and Python 3.11.

Suspecting upstream issues in rpm land is causing issues with 1 file's modification time not being clamped correctly only in a reprotest environment. However, there's no actual issue with reproducible builds, the packaging correctly clamps times.

(cherry picked from commit 99b72a5)

Note that it uses the `fedora-XX-xfce` naming pattern now.

We run under "set -e", which will abort the entire script when "qvm-check --running foo" returns nonzero when foo isn't running. Here we simplify the logic and wrap it in a function to enter with "set +e" and exit reinstating "set -e".

This is needed for CI/tests to pass, a number of dependencies were too old. For the launcher, remove black (the root-installed black already formats the launcher) and gitpython (no longer needed by bandit).

This is needed to make workstation CI happy.

Instead of shipping our own template, we now pull the debian-12-minimal template, clone it, install some base packages, then clone it again into the small and large variants. Take the opportunity to switch the kernel to use PVH instead of HVM. While people should only be using fresh Qubes installs for SDW, a check is added to ensure there are no other VMs using the debian-12-minimal template, since we need it to be pristine.

Just verify the new policy files are installed, don't do any verification of contents yet.

While we do recommend a reboot, just preemptively shutdown all of our VMs after provisioning to ensure anything that follows (e.g. CI runs) will be from a cleaner state. We tried to implement this in workstation-ci itself (<freedomofpress/securedrop-workstation-ci#44>), but it isn't working as we desired, so we'll do this for now and revert once CI is fixed.

legoktm · 2024-04-09T19:24:07Z

I'll look into the rpm reproducibility issue tomorrow

I forgot to report back that I did investigate the reproducibility issue - the rpms are reproducible except when built under reprotest (I suspect this is some libfaketime interaction gone wrong). I've updated the commit/comments to reflect this and don't consider it a blocker to moving forwards.

cfm

Just to stress-test things, uninstalling an existing installation on Qubes 4.2 from 4d6ca1a...5873c63 and then installing from here:

Provision dev env via make clone, make dev, verify that the latter completes successfully

[user@dom0 ~] sdw-admin --uninstall
[user@dom0 ~] cd securedrop-workstation
[user@dom0 securedrop-workstation] make clone
[user@dom0 securedrop-workstation] make dev

Failed because the signing key has changed per #972. Apply that locally, then:

[user@dom0 securedrop-workstation] sdw-admin --uninstall  # our templates deleted: ✓
[user@dom0 securedrop-workstation] make clone
[user@dom0 securedrop-workstation] make dev

reboot

Updates, and reboot again.

Verify that make test passes

Exceptions:

Update SecureDrop workstation to support 4.2 and use an install-time base template. #970 (comment)
VM kernels fail

securedrop-workstation/tests/test_vms_exist.py

Line 36 in 941f051

assert kernel_version.endswith("-grsec-workstation")
Verify that the launcher is triggered and update is successful
~~Verify basic client functionality (log in, retrieve and view submissions,, reply, export/print)~~

cfm · 2024-04-09T19:11:25Z

dom0/sd-default-config.sls

@@ -17,7 +17,7 @@
 {% if d.environment == "dev" %}
  # use apt-test and nightlies
  {% set sdvars = sdvars_defaults["test"] %}
-  {% set _ = sdvars.update({"component": "nightlies"}) %}
+  {% set _ = sdvars.update({"component": "main nightlies"}) %}


This breaks:

securedrop-workstation/tests/test_vms_platform.py

Lines 36 to 37 in 941f051

else:

self.apt_url = FPF_APT_TEST_SOURCES.format(dist=dist, component="nightlies")

Yupp - to fix, we can either update that test or push the kernels+extras into the nightlies channel as well. (they would not need to be built nightly, just pushed when updated). I think the latter is the better option as we want dev instances to always be on nightly deb packages.

the kernel string test failure will be addressed with next 6.6 kernels, @legoktm already fixed that in a PR pending to kernel-builder.

zenmonkeykstop

@legoktm's changes LGTM. I can't approve having created the PR tho, someone else will need to.

zenmonkeykstop · 2024-04-09T21:24:54Z

tests/test_qubes_rpc.py

-        with io.open(filepath, "r") as f:
-            data = yaml.safe_load(f)
-        return data
+    def test_policies(self):


This is a good first step IMO

zenmonkeykstop · 2024-04-09T21:27:34Z

files/provision-all

@@ -47,3 +47,8 @@ qvm-check --quiet sd-fedora-39-dvm 2> /dev/null && \
  sudo qubesctl --show-output --skip-dom0 --targets sd-fedora-39-dvm state.highstate && \
  qvm-shutdown --wait sys-usb && qvm-start sys-usb || \
  sudo qubesctl --show-output --skip-dom0 --targets sys-usb state.highstate
+
+# Shut down all VMs to ensure new configuration takes place, if the user doesn't reboot.


If we actually need a reboot, we could probably change this to a user Y/N prompt - "The system must be rebooted to complete the installation. Reboot now? Y/N" or similar. If we don't actually need a reboot then kicking the VMs is fine.

cfm

Approving based on all testing and review so far, per #970 (review).

zenmonkeykstop marked this pull request as draft April 2, 2024 14:15

legoktm reviewed Apr 2, 2024

View reviewed changes

zenmonkeykstop force-pushed the 4_2-compat-deb12-base branch 2 times, most recently from a38de98 to 503d73d Compare April 2, 2024 15:16

zenmonkeykstop mentioned this pull request Apr 2, 2024

Drop securedrop-workstation-bullseye base template, use a debian-12 system template #969

Closed

legoktm force-pushed the 4_2-compat-deb12-base branch 3 times, most recently from dd82553 to 0f3bb34 Compare April 2, 2024 19:22

rocodes reviewed Apr 2, 2024

View reviewed changes

legoktm force-pushed the 4_2-compat-deb12-base branch from 7e867f3 to 34e59ff Compare April 2, 2024 22:36

legoktm marked this pull request as ready for review April 2, 2024 22:48

zenmonkeykstop mentioned this pull request Apr 3, 2024

WIP: Qubes OS R4.2 related changes #898

Closed

3 tasks

rocodes reviewed Apr 3, 2024

View reviewed changes

files/provision-all Show resolved Hide resolved

rocodes reviewed Apr 3, 2024

View reviewed changes

files/sdw-admin.py Show resolved Hide resolved

rocodes reviewed Apr 3, 2024

View reviewed changes

legoktm force-pushed the 4_2-compat-deb12-base branch from 34e59ff to f5cf6da Compare April 3, 2024 18:10

deeplow reviewed Apr 3, 2024

View reviewed changes

legoktm force-pushed the 4_2-compat-deb12-base branch 3 times, most recently from 426d6c1 to 1e36c74 Compare April 5, 2024 03:19

cfm mentioned this pull request Apr 8, 2024

configure VMs via vm-config.* features #956

Closed

4 tasks

eaon and others added 13 commits April 9, 2024 10:20

Make initial Qubes 4.2 changes

0c2ccff

Primarily changing the base dev containers to Fedora 37 and Python 3.11.

Convert the remaining policies into the r5 format

b99e435

(cherry picked from commit 99b72a5)

Update default system template to Fedora 39

e4d72dd

Note that it uses the `fedora-XX-xfce` naming pattern now.

Don't abort on qvm-shutdown failure

28a4109

We run under "set -e", which will abort the entire script when "qvm-check --running foo" returns nonzero when foo isn't running. Here we simplify the logic and wrap it in a function to enter with "set +e" and exit reinstating "set -e".

Update dependencies for Python 3.11

9c71fc0

This is needed for CI/tests to pass, a number of dependencies were too old. For the launcher, remove black (the root-installed black already formats the launcher) and gitpython (no longer needed by bandit).

Make dom0 config files world-readable in dev setups

f104c67

This is needed to make workstation CI happy.

Add main component to sources.list for dev env

2792a60

Remove obsolete dvm cleanup

21f3822

Update qubes-rpc tests

20ea5c6

Just verify the new policy files are installed, don't do any verification of contents yet.

Add some more context on why certain tests are failing

941f051

zenmonkeykstop force-pushed the 4_2-compat-deb12-base branch from 1e36c74 to 941f051 Compare April 9, 2024 14:20

cfm reviewed Apr 9, 2024

View reviewed changes

zenmonkeykstop commented Apr 9, 2024

View reviewed changes

cfm approved these changes Apr 9, 2024

View reviewed changes

zenmonkeykstop merged commit f73b6bf into main Apr 9, 2024
6 checks passed

zenmonkeykstop deleted the 4_2-compat-deb12-base branch April 9, 2024 21:42

legoktm restored the 4_2-compat-deb12-base branch April 10, 2024 16:20

legoktm deleted the 4_2-compat-deb12-base branch April 10, 2024 16:21

rocodes mentioned this pull request May 24, 2024

Consider preferring Salt customizations to custom template RPM #765

Closed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Update SecureDrop workstation to support 4.2 and use an install-time base template. #970

Update SecureDrop workstation to support 4.2 and use an install-time base template. #970

zenmonkeykstop commented Apr 2, 2024 •

edited

Loading

legoktm Apr 2, 2024

legoktm Apr 2, 2024

zenmonkeykstop Apr 2, 2024

zenmonkeykstop Apr 2, 2024 •

edited

Loading

legoktm Apr 2, 2024

legoktm commented Apr 2, 2024

rocodes Apr 2, 2024 •

edited

Loading

rocodes Apr 2, 2024 •

edited

Loading

rocodes Apr 2, 2024 •

edited

Loading

zenmonkeykstop Apr 9, 2024

rocodes Apr 2, 2024

zenmonkeykstop Apr 3, 2024

rocodes Apr 2, 2024 •

edited

Loading

zenmonkeykstop Apr 9, 2024

legoktm commented Apr 2, 2024

mig5 commented Apr 3, 2024

rocodes Apr 3, 2024

rocodes Apr 3, 2024

zenmonkeykstop Apr 3, 2024

deeplow Apr 3, 2024 •

edited

Loading

legoktm commented Apr 3, 2024

zenmonkeykstop commented Apr 4, 2024

legoktm commented Apr 4, 2024

zenmonkeykstop commented Apr 4, 2024 •

edited

Loading

legoktm commented Apr 4, 2024

legoktm commented Apr 9, 2024

cfm left a comment •

edited

Loading

cfm Apr 9, 2024

zenmonkeykstop Apr 9, 2024

zenmonkeykstop Apr 9, 2024

zenmonkeykstop left a comment

zenmonkeykstop Apr 9, 2024

zenmonkeykstop Apr 9, 2024

cfm left a comment


		qubes.USB * sd-devices sys-usb allow

		# TODO: should this be handled with the new Global Config UI instead?

		@@ -9,7 +9,7 @@
		BULLSEYE_STRING = "Debian GNU/Linux 11 (bullseye)"

	else:
	self.apt_url = FPF_APT_TEST_SOURCES.format(dist=dist, component="nightlies")

Update SecureDrop workstation to support 4.2 and use an install-time base template. #970

Update SecureDrop workstation to support 4.2 and use an install-time base template. #970

Conversation

zenmonkeykstop commented Apr 2, 2024 • edited Loading

Status

Description of Changes

Testing

Deployment

Checklist

If you have made changes to the provisioning logic

If you have added or removed files

If documentation is required

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

zenmonkeykstop Apr 2, 2024 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

legoktm commented Apr 2, 2024

rocodes Apr 2, 2024 • edited Loading

Choose a reason for hiding this comment

rocodes Apr 2, 2024 • edited Loading

Choose a reason for hiding this comment

rocodes Apr 2, 2024 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

rocodes Apr 2, 2024 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

legoktm commented Apr 2, 2024

mig5 commented Apr 3, 2024

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

deeplow Apr 3, 2024 • edited Loading

Choose a reason for hiding this comment

legoktm commented Apr 3, 2024

zenmonkeykstop commented Apr 4, 2024

legoktm commented Apr 4, 2024

zenmonkeykstop commented Apr 4, 2024 • edited Loading

legoktm commented Apr 4, 2024

legoktm commented Apr 9, 2024

cfm left a comment • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

zenmonkeykstop left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

cfm left a comment

Choose a reason for hiding this comment

zenmonkeykstop commented Apr 2, 2024 •

edited

Loading

zenmonkeykstop Apr 2, 2024 •

edited

Loading

rocodes Apr 2, 2024 •

edited

Loading

rocodes Apr 2, 2024 •

edited

Loading

rocodes Apr 2, 2024 •

edited

Loading

rocodes Apr 2, 2024 •

edited

Loading

deeplow Apr 3, 2024 •

edited

Loading

zenmonkeykstop commented Apr 4, 2024 •

edited

Loading

cfm left a comment •

edited

Loading