freedomofpress / securedrop-workstation

Qubes-based SecureDrop Journalist Workstation environment for submission handling
GNU Affero General Public License v3.0
138 stars 43 forks source link

Updater should refresh list of target VMs after dom0 update #758

Open eloquence opened 2 years ago

eloquence commented 2 years ago

Currently, the list of VMs the updater will target is hardcoded here: https://github.com/freedomofpress/securedrop-workstation/blob/356b289390005d59eaa0efd2cd7647c4f75e3b9d/launcher/sdw_updater_gui/Updater.py#L40-L49

As a result, if during an update, the list changes, the updater will happily continue on its run using the old list. For example, I just updated on old system that hadn't received a Whonix template update yet. The updater downloaded Whonix 16, but continued to update Whonix 15 instead. Of course, this will be cleared up on the next run, but it would seem to be preferable to refresh the list after the dom0 update (e.g., via qvm-prefs approach as suggested in the code comment).

zenmonkeykstop commented 2 months ago

Flagging for @deeplow's attention - if possible we should update the list of non-dom0 target VMs after any potential dom0 chnages, maybe using VM tags instead of an explicit list.

deeplow commented 2 months ago

Yep. I'm aware. This is one of the things that stood out to me while redoing the updater. However, I kept it the same way structurally because we do not yet have a canonical definition of all the VMs that the workstation is managing. I think we need to figure that part out before tackling this.

The closest thing we have I think is in this test. Ideally we converge on having VM data in one single place, clearly distinguishing:

edit: I have created https://github.com/freedomofpress/securedrop-workstation/issues/1158 to keep track of this conversation, since it's broader than just the updater.