Merge pull request #5723 from freedomofpress/backports-and-170-rc3

[1.7.0] Backport 5718,5720 and bump to 1.7.0-rc3

.circleci/config.yml

@@ -225,9 +225,9 @@ jobs:
 
   admin-tests:
     docker:
-      - image: gcr.io/cloud-builders/docker
+      - image: cimg/python:3.7
     steps:
-      - run: apt-get install -y make jq
+      - run: sudo apt update && sudo apt-get install -y make jq
       - checkout
       - setup_remote_docker
       - run:
@@ -239,9 +239,9 @@ jobs:
 
   fetch-tor-debs:
     docker:
-      - image: gcr.io/cloud-builders/docker
+      - image: cimg/python:3.7
     steps:
-      - run: apt-get install -y make virtualenv python3-pip enchant jq
+      - run: sudo apt-get update && sudo apt-get install -y make virtualenv python3-pip enchant jq rsync
       - checkout
       - setup_remote_docker
       - run:
@@ -369,12 +369,12 @@ jobs:
 
   deb-tests:
     docker:
-      - image: gcr.io/cloud-builders/docker
+      - image: cimg/python:3.7
     environment:
       LC_ALL: C.UTF-8
       LANG: C.UTF-8
     steps:
-      - run: apt-get install -y make virtualenv enchant jq python3-dev build-essential
+      - run: sudo apt-get update && sudo apt-get install -y make virtualenv enchant jq python3-dev build-essential rsync
       - checkout
       - setup_remote_docker
       - run:
@@ -386,12 +386,12 @@ jobs:
 
   deb-tests-focal:
     docker:
-      - image: gcr.io/cloud-builders/docker
+      - image: cimg/python:3.7
     environment:
       LC_ALL: C.UTF-8
       LANG: C.UTF-8
     steps:
-      - run: apt-get install -y make virtualenv enchant jq python3-dev build-essential
+      - run: sudo apt-get update && sudo apt-get install -y make virtualenv enchant jq python3-dev build-essential rsync
       - checkout
       - setup_remote_docker
       - run:

changelog.md

@@ -1,5 +1,9 @@
 # Changelog
 
+## 1.7.0~rc3
+
+* Disable v2 ssh ATHS when v2 onion services are disabled
+
 ## 1.7.0~rc2
 
 * Fixup commits for RC1 changes:

install_files/ansible-base/group_vars/all/securedrop

@@ -2,8 +2,8 @@
 # Variables that apply to both the app and monitor server go in this file
 # If the monitor or app server need different values define the variable in
 # hosts_vars/app.yml or host_vars/mon.yml
-securedrop_app_code_version: "1.7.0~rc2"
-securedrop_app_code_sdist_version: "securedrop-app-code-1.7.0-rc2"
+securedrop_app_code_version: "1.7.0~rc3"
+securedrop_app_code_sdist_version: "securedrop-app-code-1.7.0-rc3"
 securedrop_app_code_sdist_name: "{{ securedrop_app_code_sdist_version }}.tar.gz"
 
 grsecurity: true

install_files/ansible-base/roles/build-securedrop-app-code-deb-pkg/files/changelog-focal

@@ -1,3 +1,9 @@
+securedrop-app-code (1.7.0~rc3+focal) focal; urgency=medium
+
+  * See changelog.md
+
+ -- SecureDrop Team <[email protected]>  Tue, 19 Jan 2021 20:52:40 +0000
+
 securedrop-app-code (1.7.0~rc2+focal) focal; urgency=medium
 
   * See changelog.md

install_files/ansible-base/roles/build-securedrop-app-code-deb-pkg/files/changelog-xenial

@@ -1,3 +1,9 @@
+securedrop-app-code (1.7.0~rc3+xenial) xenial; urgency=medium
+
+  * See changelog.md
+
+ -- SecureDrop Team <[email protected]>  Tue, 19 Jan 2021 20:52:30 +0000
+
 securedrop-app-code (1.7.0~rc2+xenial) xenial; urgency=medium
 
   * See changelog.md

install_files/ansible-base/roles/tor-hidden-services/templates/torrc

@@ -16,7 +16,7 @@ HiddenServicePort 80 127.0.0.1:8080
 HiddenServiceAuthorizeClient stealth journalist
 {% endif %}
 
-{% if enable_ssh_over_tor %}
+{% if enable_ssh_over_tor and v2_onion_services %}
 HiddenServiceDir /var/lib/tor/services/ssh
 HiddenServiceVersion 2
 HiddenServicePort 22 127.0.0.1:22

install_files/securedrop-config/DEBIAN/control

@@ -4,7 +4,7 @@ Priority: optional
 Maintainer: SecureDrop Team <[email protected]>
 Homepage: https://securedrop.org
 Package: securedrop-config
-Version: 0.1.3+1.7.0~rc2
+Version: 0.1.3+1.7.0~rc3
 Architecture: all
 Description: Establishes baseline system state for running SecureDrop.
  Configures apt repositories.

install_files/securedrop-keyring/DEBIAN/control

@@ -4,7 +4,7 @@ Priority: optional
 Maintainer: SecureDrop Team <[email protected]>
 Homepage: https://securedrop.org
 Package: securedrop-keyring
-Version: 0.1.4+1.7.0~rc2
+Version: 0.1.4+1.7.0~rc3
 Architecture: amd64
 Depends: gnupg
 Description: Provides an apt keyring for SecureDrop-related packages, so the master signing key used for SecureDrop packages can be updated via apt.

install_files/securedrop-ossec-agent/DEBIAN/control.j2

@@ -4,7 +4,7 @@ Priority: optional
 Maintainer: SecureDrop Team <securedrop@freedom.press>
 Homepage: https://securedrop.org
 Package: securedrop-ossec-agent
-Version: 3.6.0+1.7.0~rc2
+Version: 3.6.0+1.7.0~rc3
 Architecture: amd64
 {% if securedrop_build_focal_support %}
 Depends: libevent-2.1-7,libpcre2-8-0,ossec-agent,securedrop-keyring,securedrop-config

install_files/securedrop-ossec-server/DEBIAN/control.j2

@@ -4,7 +4,7 @@ Priority: optional
 Maintainer: SecureDrop Team <securedrop@freedom.press>
 Homepage: https://securedrop.org
 Package: securedrop-ossec-server
-Version: 3.6.0+1.7.0~rc2
+Version: 3.6.0+1.7.0~rc3
 Architecture: amd64
 {% if securedrop_build_focal_support %}
 Depends: libevent-2.1-7,libpcre2-8-0,ossec-server,securedrop-keyring,securedrop-config

molecule/builder-xenial/tests/vars.yml

@@ -1,5 +1,5 @@
 ---
-securedrop_version: "1.7.0~rc2"
+securedrop_version: "1.7.0~rc3"
 ossec_version: "3.6.0"
 keyring_version: "0.1.4"
 config_version: "0.1.3"

securedrop/version.py

@@ -1 +1 @@
-__version__ = '1.7.0~rc2'
+__version__ = '1.7.0~rc3'

setup.py

@@ -4,7 +4,7 @@
 
 setuptools.setup(
     name="securedrop-app-code",
-    version="1.7.0~rc2",
+    version="1.7.0~rc3",
     author="Freedom of the Press Foundation",
     author_email="[email protected]",
     description="SecureDrop Server",