clarify pre-release instuctions

[sssoleileraaa]

Status

Ready for review

Description of Changes

• Add docs to recommend adding a link to the latest version of Tails in the release tracking issue
• Consolidate pre-release comms instructions

[sssoleileraaa]

Example of how we can start including it in the tracking issue: freedomofpress/securedrop#5689

[eloquence]

LGTM, not merging yet in case you want to address the above comments.

[sssoleileraaa]

yes, i will address both comments, plus I add one more change to include notifying the localization manager after the tag is pushed so the localization team can start translations

[sssoleileraaa]

This looks ready for another review. I also made an update about checking for Tor release candidates with major bug fixes to communicate them to the team. (Currently I'm eyeballing 0.4.5.3-rc - 2021-01-12 for instance since it includes a major v3 onion service bugfix.)

[eloquence]

Why remove the securedrop here? AFAICT securedrop/bin/dev-shell is still the correct invocation when you're in the repo root (given that, somewhat confusingly, we have a subdirectory also called securedrop)

[sssoleileraaa]

if you're in the repo root then the ../update_version.sh is incorrect, and as far as i can tell, you have to be in the securedrop directory for this script to work. this is how it worked for me anyway.

[eloquence]

I believe the .. is correct from the point of view of the dev-shell container:

~/Code/securedrop $ securedrop/bin/dev-shell ls ..
SECURITY.md   codecov.yml	  mypy.ini
CODE_OF_CONDUCT.md  SOURCE_OFFER  devops	  securedrop
CONTRIBUTING.md     Vagrantfile   git		  securedrop-admin
LICENSE		    admin	  install_files   setup.py
MANIFEST.in	    ansible.cfg   journalist_gui  tails_files
Makefile	    build	  junit		  update_version.sh
README.md	    changelog.md  molecule

[eloquence]

Running securedrop/bin/dev-shell ../update_version.sh 1.8.0~rc1 in the repo root has the expected behavior for me.

[sssoleileraaa]

oh i see it does work the way it was, but confusing when you look at the command because it looks like you are specifying a path from the parent directory that will not exist, i.e. ../update_version.sh will take you the parent directory of the root, which does not contain update_version.sh. the reason it works is because that path is given to the container. that's the confusing part.

[eloquence]

That's my understanding as well. I don't have an opinion about the preferred invocation, but if we change the instructions we'll have to be explicit about changing into the securedrop subdirectory first.

[sssoleileraaa]

to avoid confusion, i'll update this to include cd'ing into securedrop - i think that's the clearest the way this is currently written to work. any objections?

[eloquence]

LGTM, one question about a changed command invocation.

[eloquence]

As a side note, when dch is not installed, the script helpfully prints:

$ ./update_version.sh 1.8.0~rc1
dch is missing
run with securedrop/bin/dev-shell ../update_version.sh <version>

So I think this is a fine simplification, and folks who need the container can still find out how to use it that way.

[eloquence]

Looks great, thanks a lot for these improvements :)

[eloquence]

(One more rebase completed due to strict repo settings)