coordination with upstream Whonix

[adrelanos]

Is securedrop-workstation deployed live anywhere yet?

Reason I am asking, there are significant changes in Whonix testers repository which will then flow to stable-proposed-updates repository and then flow to stable repository. I would like to avoid any upgrades bricking [1] running instances.

There is also a Q/A issue. And lack of automated testing, though it is getting better.

Therefore if this is deployed live, I'd suggest to run tests using Whonix testers repository or stable-proposed-updates repository. Some sort of coordination. If you'll find any grave regressions, then it would still be time to fix these before upgrades flow to Whonix stable repository.

Maybe there are other opportunities for coordination with upstream Whonix. Just keeping this kinda brief as a dialog starter.

[1] Brick loosely, quickly defined as: grave issues such as no longer bootable, no longer upgradeable, broken connectivity at least not without manual fixes.

[redshiftzero]

hey @adrelanos! so we don't have securedrop workstation deployed anywhere yet, the plan right now is mid-March for an initial beta release where we'd install in prod for a few news organizations for testing and feedback.

thanks for flagging the many changes approaching - before our prod release next month we should definitely ensure that we do some basic testing of our workstation code with whonix testers or stable-proposed-updates. we can do this at first manually and then we can investigate modifying the dev/staging envs in this repository such that SecureDrop workstation developers and testers would find issues early (we do something similar with Tails before a SecureDrop release, we perform pre-release testing on the Tails release candidates when available to catch any issues).

[eloquence]

@adrelanos Are you aware of the sdwdate-gui system tray icon glitchiness in Qubes 4? I was not able to find an upstream issue for it. See the screenshots in #369 (ignore the bit about duplication).

If you're up for it, it may be useful for you, @ninavizz, myself and other interested/relevant parties from Whonix/SD to have a call about the user experience of that system tray widget; right now there are IMO a lot of usability issues with it, and working together, we may be able to identify some low hanging fruit improvements beyond bugfixes.

(Thanks again for making this issue!)

[adrelanos]

About ~ 2 weeks ago I received the e-mail from @ninavizz (cc'd was @eloquence) and replied shortly after and re-send a week later or so.

Just wondering, did you receive my reply or perhaps it was lost in some spam filter or something?

[adrelanos]

Just reply related to sdwdate-gui so anyone else who's reading here can follow. This was also posted and discussed a bit here:

• Whonix GUI usability QubesOS/qubes-issues#5653
• https://phabricator.whonix.org/T963

Yes, a call would be possible. To avoid (potential) e-mail issues, @marmarek or anyone are welcome to share my mobile number and other messenger account names for this purpose.

[adrelanos]

On reflection, probably best to test using Whonix testers repository. Not Whonix stable-proposed-updates. That is because #491 wasn't caught by any Whonix testers and then fixes take yet longer to hit stable-proposed-updates or stable.

[adrelanos]

Whonix recently added (in stable) drop-in configuration snippet support for folders /etc/torrc.d and /usr/local/etc/torrc.d. I.e. by dropping a file into either folder with usual file extension .conf you could extend Tor's config. Examples: /etc/torrc.d/40_securedrop.conf / /usr/local/etc/torrc.d/40_securedrop.conf. /etc/torrc.d could be useful if you want to drop a file there using a Debian package but you might not want that since changes to whonix-gw-15 also apply to sys-whonix and as far as I understand you're not forking whonix-gw-15 yet.

I've also worked on making authenticated v3 onion services easier to use. That could use some feedback on that design.

• https://github.com/Whonix/anon-gw-anonymizer-config/blob/master/man/anon-auth-autogen.8.ronn
• https://github.com/Whonix/anon-gw-anonymizer-config/blob/master/man/anon-server-to-client-install.8.ronn
• https://forums.whonix.org/t/onion-services-authentication/975

You might also find anon-info and anon-verify useful.

• https://github.com/Whonix/anon-gw-anonymizer-config/blob/master/man/anon-info.8.ronn
• https://www.whonix.org/wiki/Tor#Configuration_Check
• https://github.com/Whonix/anon-gw-anonymizer-config/blob/master/man/anon-verify.8.ronn

[zenmonkeykstop]

We haven't hit any breaking issues with Whonix so far (Tor weather lately has caused the occasional update issue but that's not related). Closing this for now, will revisit once we have a better overall plan for automation of Qubes testing.