Release SecureDrop 2.1.0 #6103
Labels
epic
Meta issue tracking child issues
Comments
3 tasks
3 tasks
15 tasks
|
Draft release comms are ready for initial review. As always, it's a bit of a judgment call which changes should go into the blog post and which ones are only in the changelog -- if there's stuff you feel warrants more or less visibility, please don't hesitate to comment. |
|
NB. An upgrade scenario newly provisioned from a tag (i.e., without #6120) will fail in root@sd-staging:~/securedrop# molecule login -s libvirt-prod-focal -h app-prod
vagrant@app-prod:~$ sudo apt-get update
vagrant@app-prod:~$ sudo apt-get upgrade -y
vagrant@app-prod:~$ exit
root@sd-staging:~/securedrop# molecule login -s libvirt-prod-focal -h mon-prod
vagrant@mon-prod:~$ sudo apt-get update
vagrant@mon-prod:~$ sudo apt-get upgrade -y
vagrant@mon-prod:~$ exit |
|
Yup, that's the same root cause as captured in #6119. If you have more up-to-date bento/20.04 boxes it shouldn't be a problem, but it doesn't look like those are available yet in a provider format that we can use. |
This was referenced Oct 6, 2021
Summary
Test plan and results
Environment
[...]
Basic Server Testing
Tests failing: (see also: #6127)
Command Line User Generation
Administration
Application Acceptance TestingSource InterfaceLanding page base cases
First submission base cases
Returning source base cases
Journalist InterfaceLogin base cases
Index base cases
Individual source page
Basic Tails TestingAfter updating to this release candidate and running
2.1.0 release-specific changesWeb Applications
Tor Browser "Page Info" says (my emphasis):
After rerunning
This suggests that an explicit
amnesia@amnesia:~/Persistent/securedrop$ git branch --points-at HEAD
* release/2.1.0
amnesia@amnesia:~/Persistent/securedrop$ ssh app "grep 'SSLProtocol all -SSLv3 -TLSv1 -TLSv1.1 -TLSv1.2' /etc/apache2/sites-enabled/source.conf"
SSLProtocol all -SSLv3 -TLSv1 -TLSv1.1 -TLSv1.2
amnesia@amnesia:~/Persistent/securedrop$ git branch --points-at HEAD
* release/2.1.0
amnesia@amnesia:~/Persistent/securedrop$ for s in app mon; do ssh $s sudo apt-key list | grep -b2 -a1 "2224"; done
Warning: apt-key output should not be parsed (stdout is not a terminal)
587-pub rsa4096 2016-10-20 [SC] [expired: 2021-06-30]
639: 2224 5C81 E3BA EB41 38B3 6061 310F 5612 00F4 AD77
696-uid [ expired] SecureDrop Release Signing Key
Warning: apt-key output should not be parsed (stdout is not a terminal)
587-pub rsa4096 2016-10-20 [SC] [expired: 2021-06-30]
639: 2224 5C81 E3BA EB41 38B3 6061 310F 5612 00F4 AD77
696-uid [ expired] SecureDrop Release Signing Key
amnesia@amnesia:~/Persistent/securedrop$ git branch --points-at HEAD
* release/2.1.0
amnesia@amnesia:~/Persistent/securedrop$ for s in app mon; do ssh $s sudo apt-key list | grep -b2 -a1 "2359"; done
Warning: apt-key output should not be parsed (stdout is not a terminal)
326-pub rsa4096 2021-05-10 [SC] [expires: 2022-07-04]
378: 2359 E653 8C06 13E6 5295 5E6C 188E DD3B 7B22 E6A3
435-uid [ unknown] SecureDrop Release Signing Key <[email protected]>
Warning: apt-key output should not be parsed (stdout is not a terminal)
326-pub rsa4096 2021-05-10 [SC] [expires: 2022-07-04]
378: 2359 E653 8C06 13E6 5295 5E6C 188E DD3B 7B22 E6A3
435-uid [ unknown] SecureDrop Release Signing Key <[email protected]>
amnesia@amnesia:~/Persistent/securedrop$ git branch --points-at HEAD
* release/2.1.0
amnesia@amnesia:~/Persistent/securedrop$ ssh mon sudo grep -R "fwupd" /var/ossec/logs/alerts | grep -v "grep" | wc -l
0
amnesia@amnesia:~/Persistent/securedrop$ git branch --points-at HEAD
* release/2.1.0
amnesia@amnesia:~/Persistent/securedrop$ scp install_files/ansible-base/sd-backup-2021-10-08* app:/tmp/sd-backup-2021-10-08.tar.gz
sd-backup-2021-10-08--01-23-08.tar.gz 100% 107KB 72.1KB/s 00:01
amnesia@amnesia:~/Persistent/securedrop$ ./securedrop-admin --force restore --no-transfer sd-backup-2021-10-08.tar.gz
[...]
TASK [restore : Extract Tor configuration from backup] *************************
fatal: [app]: FAILED! => {
"changed": false
}
MSG:
Source '/home/amnesia/Persistent/securedrop/install_files/ansible-base/sd-backup-2021-10-08.tar.gz' does not exist
[...]
amnesia@amnesia:~/Persistent/securedrop$ scp install_files/ansible-base/sd-backup-2021-10-08* app:/tmp/
sd-backup-2021-10-08--01-23-08.tar.gz 100% 107KB 93.4KB/s 00:01
amnesia@amnesia:~/Persistent/securedrop$ ./securedrop-admin --force restore --no-transfer sd-backup-2021-10-08--01-23-08.tar.gz
[...]
PLAY RECAP *********************************************************************
app : ok=17 changed=12 unreachable=0 failed=0 skipped=13 rescued=0 ignored=0Even with
|
This was referenced Oct 8, 2021
Environment
Basic Server Testing
Command Line User Generation
Administration(Not tested)
Application Acceptance TestingSource InterfaceLanding page base cases
First submission base cases
Returning source base cases
Journalist InterfaceLogin base cases
Index base casesN.B. If you previously used "Safest" mode in Tor Browser as a Source, you'll have to re-enable JS to verify some of the functionality below.
Individual source page
2.1.0 release-specific changesWeb Applications
|
|
@cfm: re the manual transfer test, the playbook does require that the tarball be available locally as well to verify that it is valid - good catch on the docs side, this option hasn't been documented yet and should be for the release. |
|
Updated the OP with mention of 2.1.0~rc2. @cfm if you've got cycles today, simply re-testing the problematic sections of your previous testing report on rc1 would be ideal. For simplicity's sake, I'd say take the VM upgrade scenario again, and I'll take clean install VMs again and post results. |
|
So far so good on 2.1.0~rc2. One issue of note is that on the clean install scenario, I observed an apt-update failure:
It appears the order of operations is as follows:
This issue only affects QA testing, it isn't a problem for prod. But I'm documenting it here in case other testers encounter it. |
|
All issues raised about 2.1.0~rc1 in #6103 (comment) are resolved in 2.1.0~rc2. Still outstanding against 2.1.0~rc2:
|
|
No further concerns to point out. 100% of all testinfra tests pass on my prod VMs, which is mostly due to the key clobbering mentioned in #6103 (comment), but again, not a release-blocker. 2.1.0 is looking good to me! Will focus on LM tasks over the weekend to see if we can't drum up a bit more coverage. Thereafter, it's by the numbers. |
I'm confused as to why we weren't seeing this all the time in QA, it looks like the only possibly-relevant change was the upgrade added in
I don't think it merits another RC if there's a workaround, but we should fix this for the next release, as it means clean install test scenarios aren't exactly representative of reality. |
|
I've updated #6103 (comment) to log some surprising testinfra failures in the VM upgrade scenario, which I'll investigate further on Monday. |
Initial investigations follow. FAILED app/test_apparmor.py::test_apparmor_pkg[paramiko:/app-apparmor-utils]
FAILED app/test_apparmor.py::test_apparmor_pkg[paramiko:/app-apparmor] - para...
FAILED app/test_apparmor.py::test_apparmor_apache_capabilities[paramiko:/app-dac_override]
FAILED app/test_ossec_agent.py::test_hosts_files[paramiko:/app] - AssertionEr...Seems to be looking for default hostname amnesia@amnesia:~/Persistent/securedrop$ ssh app cat /etc/hosts
127.0.0.1 localhost
127.0.1.1 app-prod app-prod
# The following lines are desirable for IPv6 capable hosts
::1 localhost ip6-localhost ip6-loopback
ff02::1 ip6-allnodes
ff02::2 ip6-allrouters
192.168.121.58 mon-prod securedrop-monitor-server-aliasFAILED common/test_fpf_apt_repo.py::test_fpf_apt_repo_present[paramiko:/app]
FAILED common/test_fpf_apt_repo.py::test_fpf_apt_repo_present[paramiko:/mon]Expected per #6103 (comment). FAILED common/test_automatic_updates.py::test_unattended_upgrades_functional[paramiko:/app]Looks like a change in E assert 'No packages found that can be upgraded unattended and no pending auto-removals' in "Starting unattended upgrades script\nAllowed origins are: origin=Ubuntu,archive=focal, origin=Ubuntu,archive=focal-se...ades installed\nInstCount=0 DelCount=0 BrokenCount=0\nThe list of kept packages can't be calculated in dry-run mode.\n"
E + where "Starting unattended upgrades script\nAllowed origins are: origin=Ubuntu,archive=focal, origin=Ubuntu,archive=focal-se...ades installed\nInstCount=0 DelCount=0 BrokenCount=0\nThe list of kept packages can't be calculated in dry-run mode.\n" = CommandResult(command=b'sudo unattended-upgrades --dry-run --debug', exit_status=0, stdout=b"Starting unattended upgra.../usr/bin/dpkg --force-confdef --force-confold --force-confdef --force-confold --status-fd 10 --configure --pending \n').stdoutFAILED mon/test_ossec_server.py::test_ossec_connectivity[paramiko:/mon] - Ass...
FAILED mon/test_ossec_server.py::test_hosts_files[paramiko:/mon] - AssertionE...
FAILED mon/test_postfix.py::test_postfix_generic_maps[paramiko:/mon] - Assert...Looking for default hostnames |
|
Thanks @cfm:
It would be good to get a clean run if possible on the unattended-upgrades one (immediately after a non-dry-run one should be cool), but otherwise I think we're ok here. |
|
@zenmonkeykstop in #6103 (comment):
Thanks for this suggestion. Confirmed that amnesia@amnesia:~/Persistent/securedrop$ ssh app "sudo unattended-upgrades -d && sudo reboot"
amnesia@amnesia:~/Persistent/securedrop$ ssh mon "sudo unattended-upgrades -d && sudo reboot"
amnesia@amnesia:~/Persistent/securedrop$ ./securedrop-admin verifySo all of #6103 (comment) is safe to ignore for QA and release purposes. |
Basic Server Testing
Command Line User Generation
Administration
Application Acceptance TestingSource Interface SKIPPEDJournalist Interface SKIPPEDLogin base cases
2.1.0 release-specific changesWeb Applications
|
3 tasks
|
Updated an Admin Workstation on Tails 4.22 from SecureDrop 2.0.2 to SecureDrop 2.1.0 successfully using the graphical updater. |
2 tasks
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
This is a tracking issue for the release of SecureDrop 2.1.0
Scheduled as follows:
Feature / string freeze: 2021-09-28
Pre-release announcement: 2021-10-12
Release date: 2021-10-19
Release manager: @zenmonkeykstop
Deputy release manager: @conorsch
Communications manager: @eloquence
Localization manager: @conorsch
Deputy LM: @cfm [tentative]
QA team: @creviera @tesitura @cfm @conorsch @zenmonkeykstop
SecureDrop maintainers and testers: As you QA 2.1.0, please report back your testing results as comments on this ticket. File GitHub issues for any problems found, tag them "QA: Release", and associate them with the 2.1.0 milestone for tracking (or ask a maintainer to do so).
Test debian packages will be posted on https://apt-test.freedom.press signed with the test key
QA Matrix for 2.1.0
Test Plan for 2.1.0
Prepare release candidate (2.1.0~rc1)
2.1.0~rc1on test apt serverPrepare release candidate (2.1.0~rc2)
2.1.0~rc2on test apt server - Add SecureDrop 2.1.0~rc2 debs securedrop-apt-test#125After each test, please update the QA matrix and post details for Basic Server Testing, Application Acceptance Testing and release-specific testing below in comments to this ticket.
Final release
releasebranch in the LFS repo)releasebranch in the LFS repo for the debs)mainin the LFS repo)mainand verify new docs build in securedrop-docs repoPost release
securedrop-docs(version information in Wagtail is updated automatically)developThe text was updated successfully, but these errors were encountered: