Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Release SecureDrop 0.13.1 #4524

Closed
12 tasks done
redshiftzero opened this issue Jun 14, 2019 · 5 comments
Closed
12 tasks done

Release SecureDrop 0.13.1 #4524

redshiftzero opened this issue Jun 14, 2019 · 5 comments
Milestone
0.13.1

Comments

@redshiftzero
Copy link
Contributor

redshiftzero commented Jun 14, 2019 •
edited by emkll
Loading

This is a tracking issue for the upcoming release of SecureDrop 0.13.1 - tasks may get added or modified.

Feature freeze: EOD Pacific time, Friday, June 14
Release date: Tuesday, June 18

SecureDrop maintainers and testers: As you QA 0.13.1, please report back your testing results as comments on this ticket. File GitHub issues for any problems found, tag them "QA: Release", and associate them with the 0.13.1 milestone for tracking (or ask a maintainer to do so).

Test debian packages will be posted on https://apt-test.freedom.press signed with the test key. An Ansible playbook testing the upgrade path is here.

Prepare release candidate (0.13.1~rc1)

  • Prepare 0.13.1-rc1 release changelog - @emkll
  • Branch off 0.13.1~rc1 into release/0.13.1 - @emkll
  • Build debs and put up 0.13.1~rc1 on test apt server @emkll

Test plan

https://github.com/freedomofpress/securedrop/wiki/0.13.1-Test-plan

QA matrix

https://docs.google.com/spreadsheets/d/19L1zj4otg2IoTxSKw5ZLaNjgUm7uZETvc37LkX6IQ1E/edit#gid=0

Final release

  • Ensure builder in release branch is updated and/or update builder image @zenmonkeykstop @emkll
  • Push signed tag @redshiftzero
  • Build final Debian packages for 0.13.1 - @conorsch
  • Upload Debian packages to apt test - @conorsch
  • Pre-Flight: Test install and upgrade (both cron-apt on Trusty, and Ansible on Xenial) of 0.13.1 works w/ prod repo debs, test updater logic in Tails
  • Prepare and distribute release messaging

Post release
@redshiftzero redshiftzero added this to the 0.13.1 milestone Jun 14, 2019
@emkll emkll mentioned this issue Jun 14, 2019
Merged
@redshiftzero redshiftzero pinned this issue Jun 17, 2019
@rmol
Copy link
Contributor

rmol commented Jun 17, 2019

Environment

  • Install target: NUC7i5BNH
  • Tails version: 3.14
  • Test Scenario: cron-apt upgrade of 0.13.0 to 0.13.1
  • SSH over Tor: yes
  • Release candidate: 0.13.1~rc1
  • General notes: I skipped the backup before upgrade. The updater GUI isn't popping up because of the rc tag. But the journalist-key endpoint is working.

Basic Server Testing

  • I can access both the source and journalist interfaces
  • I can SSH into both machines over Tor
  • AppArmor is loaded on app
    • 0 processes are running unconfined
  • AppArmor is loaded on mon
    • 0 processes are running unconfined
  • Both servers are running grsec kernels
  • iptables rules loaded
  • OSSEC emails begin to flow after install
  • OSSEC emails are decrypted to correct key and I am able to decrypt them
  • QA Matrix checks pass

Command Line User Generation

  • Can successfully add admin user and login

Administration

  • I have backed up and successfully restored the app server following the documentation here: https://docs.securedrop.org/en/latest/backup_and_restore.html
  • If doing upgrade testing, make a backup on 0.13.0 and restore this backup on 0.13.1
  • "Send Test OSSEC Alert" button in the journalist triggers an OSSEC alert and an email is sent.

Application Acceptance Testing

Source Interface

Landing page base cases
  • JS warning bar does not appear when using Security Slider high
  • JS warning bar does appear when using Security Slider Low (#4211)
First submission base cases
  • On generate page, refreshing codename produces a new 7-word codename
  • On submit page, empty submissions produce flashed message
  • On submit page, short message submitted successfully
  • On submit page, file greater than 500 MB produces "The connection was reset" in Tor Browser quickly before the entire file is uploaded
  • On submit page, file less than 500 MB submitted successfully
Returning source base cases
  • Nonexistent codename cannot log in
  • Empty codename cannot log in
  • Legitimate codename can log in
  • Returning user can view journalist replies - need to log into journalist interface to test

Journalist Interface

Login base cases
  • Can log in with 2FA tokens
  • incorrect password cannot log in
  • invalid 2fa token cannot log in
  • 2fa immediate reuse cannot log in
Index base cases
  • Filter by codename works
  • Starring and unstarring works
  • Click select all selects all submissions
  • Selecting all and clicking "Download" works
Individual source page
  • You can submit a reply and a flashed message and new row appears
  • You cannot submit an empty reply
  • Clicking "Delete Source And Submissions" and the source and docs are deleted
  • You can click on a document and successfully decrypt using application private key

Basic Tails Testing

Updater GUI

After updating to this release candidate and running securedrop-admin tailsconfig

  • The Updater GUI appears on boot
  • Updating occurs without issue

0.13.1-specific changes

@eloquence
Copy link
Member

Draft release messaging for SecureDrop 0.13.1:
https://docs.google.com/document/d/1kqWbFywGGB1E4V7aLMFCFjLWHxqj-pYp0X4mFZ9wem8/edit#

@eloquence eloquence mentioned this issue Jun 17, 2019
Merged
1 task
@zenmonkeykstop
Copy link
Contributor

QA plan

  • NUC5s
    OR
  • NUC7s
    OR
  • Mac Minis
    OR
  • 1U servers in SF

0.13.1 QA Checklist

For both upgrades and fresh installs, here is a list of functionality that requires testing. You can use this for copy/pasting into your QA report. Feel free to edit this message to update the plan as appropriate.

If you have submitted a QA report already for a 0.13.1 release candidate with successful basic server testing and application acceptance testing sections, then you can skip these sections in subsequent reports, unless otherwise indicated by the Release Manager. This is to ensure that you focus your QA effort on the 0.13.1-specific changes as well as changes since the previous release candidate.

Note: if you are testing an upgrade scenario, you should create several sources and submit a large number of files of varying sizes up to the 500MB limit before performing the upgrade. A large dataset is required in order to test the long-running database migration task implemented in #4134.

Environment

  • Install target:NUC5s
  • Tails version: 3.14
  • Test Scenario: fresh
  • SSH over Tor: yes
  • Release candidate: rc1
  • General notes:

Basic Server Testing

  • I can access both the source and journalist interfaces
  • I can SSH into both machines over Tor
  • AppArmor is loaded on app
    • 0 processes are running unconfined
  • AppArmor is loaded on mon
    • 0 processes are running unconfined
  • Both servers are running grsec kernels
  • iptables rules loaded
  • OSSEC emails begin to flow after install
  • OSSEC emails are decrypted to correct key and I am able to decrypt them
  • QA Matrix checks pass

Command Line User Generation

  • Can successfully add admin user and login

Administration

  • I have backed up and successfully restored the app server following the documentation here: https://docs.securedrop.org/en/latest/backup_and_restore.html
  • If doing upgrade testing, make a backup on 0.13.0 and restore this backup on 0.13.1 -n/a
  • "Send Test OSSEC Alert" button in the journalist triggers an OSSEC alert and an email is sent.

Application Acceptance Testing

Source Interface

Landing page base cases
  • JS warning bar does not appear when using Security Slider high (this passes in 3.14/8.5 but fails in 3.13.1/8.0)
  • JS warning bar does appear when using Security Slider Low (#4211)
First submission base cases
  • On generate page, refreshing codename produces a new 7-word codename
  • On submit page, empty submissions produce flashed message
  • On submit page, short message submitted successfully
  • On submit page, file greater than 500 MB produces "The connection was reset" in Tor Browser quickly before the entire file is uploaded
  • On submit page, file less than 500 MB submitted successfully
Returning source base cases
  • Nonexistent codename cannot log in
  • Empty codename cannot log in
  • Legitimate codename can log in
  • Returning user can view journalist replies - need to log into journalist interface to test

Journalist Interface

Login base cases
  • Can log in with 2FA tokens
  • incorrect password cannot log in
  • invalid 2fa token cannot log in
  • 2fa immediate reuse cannot log in
Index base cases
  • Filter by codename works
  • Starring and unstarring works
  • Click select all selects all submissions
  • Selecting all and clicking "Download" works
Individual source page
  • You can submit a reply and a flashed message and new row appears
  • You cannot submit an empty reply
  • Clicking "Delete Source And Submissions" and the source and docs are deleted
  • You can click on a document and successfully decrypt using application private key

Basic Tails Testing

Updater GUI

After updating to this release candidate and running securedrop-admin tailsconfig

  • The Updater GUI appears on boot
  • Updating occurs without issue

0.13.1-specific changes

Preflight

  • Ensure the builder image is up-to-date on release day

These tests should be performed the day of release prior to live debian packages on apt.freedom.press

Basic testing

  • Install or upgrade occurs without error
  • Source interface is available and version string indicates it is 0.13.1
  • A message can be successfully submitted

Tails

  • The updater GUI appears on boot
  • The update successfully occurs to 0.13.1
  • After reboot, updater GUI no longer appears

This was referenced Jun 18, 2019
Merged
Merged
@eloquence eloquence mentioned this issue Jun 18, 2019
Merged
1 task
@eloquence
Copy link
Member

All release comms completed.

  • Tweet
  • Blog post
  • Bulk announcements to admins can be found in the support portal

This was referenced Jun 19, 2019
Merged
Merged
@conorsch conorsch mentioned this issue Jun 20, 2019
Merged
9 tasks
@emkll
Copy link
Contributor

emkll commented Jun 21, 2019

Final box was checked via #4545, closing.

@emkll emkll closed this as completed Jun 21, 2019
@redshiftzero redshiftzero unpinned this issue Jun 25, 2019
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
0.13.1
Development

No branches or pull requests
5 participants
@eloquence @zenmonkeykstop @redshiftzero @emkll @rmol