WIP: Qubes OS R4.2 related changes

[eaon]

Description of Changes

Addresses #884. More TK

Testing

TK

Deployment

TK

Checklist

If you have made changes to the provisioning logic

• All tests (make test) pass in dom0
• I have updated MANIFEST.in and rpm-build/SPECS/securedrop-workstation-dom0-config.spec
• I would appreciate help with the documentation

[eaon]

Unfortunately GH doesn't support renaming branches without closing the associated PRs. See #897 (comment) for more context

[cfm]

On a fresh Qubes 4.2 installation, the initial make {clone,dev} incantation failed, and I needed to add 9f9d1d3 before it would resume. That's a workaround, not a fix; we'll need to refactor the logic of the qvm-checks there.

[deeplow]

I was trying to use this branch in order to be able to do make clone on 4.2. That part works. However, I see now that this branch fully removes the launcher..

As we're exploring in #899 that is not entirely the case and there is still relevance for the launcher. So I'd suggest reverting the commit that removed them.

[deeplow]

Suggested change

	PYTHON3 := $(if $(shell bash -c "command -v python3.11"), python3.8, python3)
	PYTHON3 := $(if $(shell bash -c "command -v python3.11"), python3.11, python3)

I think the semantics were lost a bit in the change. We want run a version as close as possible to dom0's (python3.11). What the line is currently saying is: if there's python3.11, run python3.8.

[zenmonkeykstop]

I cherry-picked commits from this branch (dropping the commits that remove the launcher) into a new one a few days back @deeplow, and started updating there for Qubes 4.2.1 - see https://github.com/freedomofpress/securedrop-workstation/tree/4_2-compat-keep-launcher

[zenmonkeykstop]

Leaving this PR as draft for now - once the https://github.com/freedomofpress/securedrop-workstation/tree/4_2-compat-keep-launcher branch is mergeable we can cut a new PR and close this one.

[zenmonkeykstop]

Closing this in favour of #970