Create small/large templates

[eloquence]

As part of the template consolidation epic (#471) we'll need to create new "small" and "large" base templates in our provisioning logic, which will ultimately be used by the SecureDrop Workstation AppVMs (sd-whonix out of scope for now), and configured primarily via Salt. See https://docs.google.com/document/d/1T56gQdp9YllEmzzFMKKW_qwSIzSvCvPmb8YBVnuzjs8/edit#heading=h.5jg2o5t163o for more background on the consolidation strategy.

[eloquence]

As part of the 9/3-9/17 sprint, @zenmonkeykstop wants to take a stab at creating an initial working branch that includes this change, with support from @conorsch. This will provide a base from which to further test changes such as the MIME type consolidation.

[zenmonkeykstop]

@conorsch and I:

• Created a working branch 608-import-export-security including two new templateVMs:
  • sd-small-buster-template, used for sd-app, sd-gpg, sd-proxy, sd-log, containing the union of the packages formerly installed for those AppVMs' individual templates
  • sd-large-buster-template, used for sd-devices, sd-viewer, containing the union of the packages formerly installed for those AppVMs' individual templates.
• added locally-built versions of the securedrop-workstation-config and securedrop-workstation-svs-disp .debs, including changes to mimetype configuration that have not yet been released
• updated the logging setup statefile to accommodate the now-shared template (some config changes should now be made on sd-log only (and now that I think of it would probably need to be reconfigured from /rw/config on startup))
• updated configuration tests to reflect the changes above.

Basic client functionality (retrieving, decrypting, viewing submissions) looks good.

[conorsch]

Screenshot from consolidated setup:

In addition to the https://github.com/freedomofpress/securedrop-workstation/tree/608-import-export-security branch, we also had packaging changes in https://github.com/freedomofpress/securedrop-debian-packaging/tree/mimetype-reorg-for-all. If anyone wants to poke at the consolidated setup, the "608-import-export-security" branch is sufficient: we committed deb packages directly to that branch to aid in collaboration. Neither of those branches are suitable for merge, but should be useful references when we evaluate the upgrade story.

[eloquence]

Thank you both. That concludes our commitment from the current sprint, so moving back to backlog for now until we've scoped next steps.

[eloquence]

As noted in #471, we'll continue to use the 608-import-export-security branch during the 9/17-10/1 sprint, keeping up-to-date with main, and using it to explore the best way to upgrade existing instances to the consolidated model, ideally without requiring a full reinstall. We can continue to track the work against this issue for now.

[conorsch]

Reporting the latest progress. We now have a working in-place upgrade, so that a Workstation provisioned via "make dev" on latest main branch can move to the consolidated setup via "make dev" on the long-running 608-import-export-security branch, by pulling packages in from a dedicated channel on apt-test (i.e. no more deb packages committed to the 608 branch, as mentioned above). The fact that all client operations are working as expected post-upgrade is a solid indicator that we can indeed perform updates in place, we just need to modify the updater logic to rerun the install action if unconsolidated templates were detected.

The in-flight changes making the upgrade-in-place possible can be found in:

• Add template-consolidation component for buster  securedrop-apt-test#65 - new "template-consolidation" channel for apt-test
• Reorganizes mimetype declarations for template consolidation securedrop-builder#198 - packaging branch containing changes now available on apt-test "template-consolidation" channel
• https://github.com/freedomofpress/securedrop-workstation/tree/608-import-export-security - ongoing SDW collab branch

If you want to reproduce the upgrade-in-place logic, follow these steps:

1. Check out "main" branch in https://github.com/freedomofpress/securedrop-workstation, run make dev.
2. Store results of qvm ls --tags sd-workstation, confirm using many different templates
3. Check out "608-import-export-security" branch in https://github.com/freedomofpress/securedrop-workstation, run make clone and make dev
4. Inspect qvm ls --tags sd-workstation, confirm using only two templates.
5. Run the client, decrypt messages, open submissions, document any problems

Next, I'll inspect the state of the config tests to ensure all passing, then begin work on adding conditional logic to the graphical updater to support in-place upgrades.

[eloquence]

This is a leftover issue from #471 which was resolved a while ago, closing.