search

freedomofpress / securedrop-workstation

Qubes-based SecureDrop Journalist Workstation environment for submission handling
GNU Affero General Public License v3.0
138 stars 43 forks source link

`dev` environment should be configured to use only `nightly` apt component #1106

Open eloquence opened 3 months ago

eloquence commented 3 months ago

As of #970, dev is configured to use both main and nightly packages. This can result in behavior that's difficult to reason about, if a version on main is more recent than a nightly (e.g. during a release period), you won't be getting nightly updates anymore.

This is not desired behavior, but simply to ensure all the required packages are installable. To fix this, we'll need to copy those packages to the nightly component; then we can update the logic & test to drop main if the environment is set to dev.

Once that's done, developers will again need to switch to staging to get manually published RCs only available in main.

eloquence commented 3 months ago

Discussed a bit more; Kunal made the point that the layered behavior is desirable and that (in the current case) we should bump the version number in the securedrop-client main branch to ensure users of dev still get nightlies.

Leaving this open for a bit longer, but if that sounds reasonable, I'll add it to the RM docs and put in a PR to bump said version.