This is a tracking issue for the release of SecureDrop 2.3.2

Tentatively scheduled as follows:

Pre-release announcement: 2022-05-03 Release date: 2022-05-05

Release manager: KOG Deputy release manager: TBD Communications manager:: TBD (As this is a hotfix release with no translated string changes, no LM is assigned.)

SecureDrop maintainers and testers: As you QA 2.3.2, please report back your testing results as comments on this ticket. File GitHub issues for any problems found, tag them "QA: Release".

Test debian packages will be posted on https://apt-test.freedom.press signed with the test key. An Ansible playbook testing the upgrade path is here.

QA Matrix for 2.3.2

Test Plan for 2.3.2

Prepare release candidate (2.3.2~rc1)

[x] Prepare 2.3.2~rc1 release changelog
[x] Branch off release/2.3.2 from release/2.3.1
[x] Prepare 2.3.2~rc1
[x] Build debs, preserving build log, and put up 2.3.2~rc1 on test apt server
[x] Commit build log.

After each test, please update the QA matrix and post details for Basic Server Testing, Application Acceptance Testing and release-specific testing below in comments to this ticket.

Final release

[x] Ensure builder in release branch is updated and/or update builder image
[x] Push signed tag
[x] Pre-Flight: Test updater logic in Tails (apt-qa tracks the release branch in the LFS repo)
[x] Build final Debian packages(and preserve build log)
[x] Commit package build log to https://github.com/freedomofpress/build-logs
[x] Upload Debian packages to apt-qa server
[x] Pre-Flight: Test that install and upgrade from 2.3.1 to 2.3.2 works w/ prod repo debs (apt-qa.freedom.press polls the release branch in the LFS repo for the debs)
[x] Flip apt QA server to prod status (merge to main in the LFS repo)
[x] Merge Docs branch changes to main and verify new docs build in securedrop-docs repo
[x] Prepare release messaging

Post release

[x] Create GitHub release object
[x] Once release object is created, update versions in securedrop-docs and Wagtail
[x] Build readthedocs and verify new docs show up on https://docs.securedrop.org
[x] Publish announcements
[x] Merge changelog back to develop
[x] Update roadmap wiki page: https://github.com/freedomofpress/securedrop/wiki/Development-Roadmap

Install target: NUC11s
Tails version: 4.29 → 5.0
Test Scenario: Tails upgrade
SSH over Tor: yes
Release candidate: 2.3.2-rc1
General notes: Some testinfra failures. Once the Tails environment is upgraded to Tails 5.0, the test plan itself is fragile around the Updater, but everything checks out as long as you don't (allow the Updater to) downgrade to 2.3.1.

Basic Server Testing

[x] After installing the testinfra dependencies, all tests in ./securedrop-admin verify are passing:
- Install dependencies on Admin Workstation with cd ~/Persistent/securedrop && ./securedrop-admin setup -t
- Run tests with ./securedrop-admin verify (this will take a while)
- Remove test dependencies: rm -rf admin/.venv3/ && ./securedrop-admin setup

Exceptions:

FAILED common/test_automatic_updates.py::test_automatic_updates_dependencies[paramiko:/mon]
FAILED common/test_automatic_updates.py::test_cron_apt_config[paramiko:/mon]
FAILED common/test_automatic_updates.py::test_unattended_upgrades_functional[paramiko:/app]

[x] QA Matrix checks pass

Command Line User Generation

[x] Can successfully add admin user and login

Administration

[x] I have backed up and successfully restored the app server following the backup documentation
[x] If doing upgrade testing, make a backup on 2.3.1 and restore this backup on this release candidate
[x] "Send Test OSSEC Alert" button in the journalist triggers an OSSEC alert and an email is sent
[x] Can successfully add journalist account with HOTP authentication

Application Acceptance Testing

Source Interface

Landing page base cases

[x] JS warning bar does not appear when using Security Slider high
[x] JS warning bar does appear when using Security Slider Low

First submission base cases

[x] On generate page, refreshing page produces a new 7-word codename
[x] On submit page, empty submissions produce flashed message
[x] On submit page, short message submitted successfully
[x] On submit page, file greater than 500 MB produces "The connection was reset" in Tor Browser quickly before the entire file is uploaded
[x] On submit page, file less than 500 MB submitted successfully

Returning source base cases

[x] Nonexistent codename cannot log in
[x] Empty codename cannot log in
[x] Legitimate codename can log in
[x] Returning user can view journalist replies - need to log into journalist interface to test

Journalist Interface

Login base cases

[x] Can log in with 2FA tokens
[x] incorrect password cannot log in
[x] invalid 2fa token cannot log in
[x] 2fa immediate reuse cannot log in
[x] Journalist account with HOTP can log in

Index base cases

[x] Filter by codename works
[x] Starring and unstarring works
[x] Click select all selects all submissions
[x] Selecting all and clicking "Download" works

Individual source page

[x] You can submit a reply and a flashed message and new row appears
[x] You cannot submit an empty reply
[x] Clicking "Delete Source Account" and the source and docs are deleted
[x] You can click on a document and successfully decrypt using application private key

Basic Tails Testing

After updating to this release candidate and running securedrop-admin tailsconfig

[x] The Updater GUI appears on boot
[x] Updating to 2.3.1 is successful

2.3.2 release-specific changes

#6408, #6424 - Tails 5.0 compatibility

Tails Upgrade, Tails 4.29 to Tails 5.0

on the 4.29 workstation with the 2.3.2 rc code deployed:
- [x] verify that the clean install cases above are passing

Except for securedrop-admin verify failures logged above.

perform a manual upgrade using a Tails 5.0 reference USB
- [x] reboot the admin workstation and verify that the upgrade completed successfully and the persistent volume is available
- [x] run cd Persistent/securedrop && ./securedrop-admin tailsconfig and verify that an error message indicating that a Tails 4 virtualenv was detected and deleted is displayed
- [x] run ./securedrop-admin setup and verify that it completes successfully
- [x] verify that the clean install cases above complete successfully
- [x] ./securedrop-admin setup completed successfully
- [x] apt-cache policy ccontrol shows that ccontrol is not installed
- [x] the admin sdconfig, install, and tailsconfig commands completed successfully
- [x] the servers are accessible over ssh and the SI and JI are available via desktop shortcuts
- [x] backup and restore work correctly
- [x] the JI and SSH services are still available after restarting the network connection.

For application testing, repeated only those cases involving the Admin Workstation:

[x] After installing the testinfra dependencies, all tests in ./securedrop-admin verify are passing:


FAILED common/test_automatic_updates.py::test_all_packages_updated[paramiko:/app]
FAILED common/test_automatic_updates.py::test_unattended_upgrades_functional[paramiko:/mon]
FAILED common/test_automatic_updates.py::test_all_packages_updated[paramiko:/mon]
FAILED common/test_automatic_updates.py::test_unattended_upgrades_functional[paramiko:/app]

``` =================================== FAILURES =================================== __________________ test_all_packages_updated[paramiko://app] ___________________ [gw1] linux -- Python 3.9.2 /home/amnesia/Persistent/securedrop/admin/.venv3/bin/python host = def test_all_packages_updated(host): """ Ensure a safe-upgrade has already been run, by checking that no packages are eligible for upgrade currently. The Ansible config installs a specific, out-of-date version of Firefox for use with Selenium. Therefore apt will report it's possible to upgrade Firefox, which we'll need to mark as "OK" in terms of the tests. """ c = host.run('apt-get dist-upgrade --simulate') assert c.rc == 0 # Staging hosts will have locally built deb packages, marked as held. # Staging and development will have a version-locked Firefox pinned for # Selenium compatibility; if the holds are working, they shouldn't be # upgraded. # Example output: # 0 upgraded, 0 newly installed, 0 to remove and 1 not upgraded. # Don't test for the "not upgraded" because those map to held packages. > assert "0 upgraded, 0 newly installed, 0 to remove" in c.stdout E assert '0 upgraded, 0 newly installed, 0 to remove' in 'NOTE: This is only a simulation!\n apt-get needs root privileges for real execution.\n Keep also in mind th...l-security [all])\nConf openssl (1.1.1f-1ubuntu2.13 Ubuntu:20.04/focal-updates, Ubuntu:20.04/focal-security [amd64])\n' E + where 'NOTE: This is only a simulation!\n apt-get needs root privileges for real execution.\n Keep also in mind th...l-security [all])\nConf openssl (1.1.1f-1ubuntu2.13 Ubuntu:20.04/focal-updates, Ubuntu:20.04/focal-security [amd64])\n' = CommandResult(command=b'apt-get dist-upgrade --simulate', exit_status=0, stdout=b"NOTE: This is only a simulation!\n ...l])\nConf openssl (1.1.1f-1ubuntu2.13 Ubuntu:20.04/focal-updates, Ubuntu:20.04/focal-security [amd64])\n", stderr=None).stdout common/test_automatic_updates.py:206: AssertionError _____________ test_unattended_upgrades_functional[paramiko://mon] ______________ [gw1] linux -- Python 3.9.2 /home/amnesia/Persistent/securedrop/admin/.venv3/bin/python host = def test_unattended_upgrades_functional(host): """ Ensure unatteded-upgrades completes successfully and ensures all packages are up-to-date. """ c = host.run('sudo unattended-upgrades --dry-run --debug') assert c.rc == 0 expected_origins = ( "Allowed origins are: origin=Ubuntu,archive=focal, origin=Ubuntu,archive=focal-security" ", origin=Ubuntu,archive=focal-updates, origin=SecureDrop,codename=focal" ) expected_result = ( "No packages found that can be upgraded unattended and no pending auto-removals" ) assert expected_origins in c.stdout > assert expected_result in c.stdout E assert 'No packages found that can be upgraded unattended and no pending auto-removals' in "Starting unattended upgrades script\nAllowed origins are: origin=Ubuntu,archive=focal, origin=Ubuntu,archive=focal-se...ades installed\nInstCount=0 DelCount=0 BrokenCount=0\nThe list of kept packages can't be calculated in dry-run mode.\n" E + where "Starting unattended upgrades script\nAllowed origins are: origin=Ubuntu,archive=focal, origin=Ubuntu,archive=focal-se...ades installed\nInstCount=0 DelCount=0 BrokenCount=0\nThe list of kept packages can't be calculated in dry-run mode.\n" = CommandResult(command=b'sudo unattended-upgrades --dry-run --debug', exit_status=0, stdout=b"Starting unattended upgra.../usr/bin/dpkg --force-confdef --force-confold --force-confdef --force-confold --status-fd 10 --configure --pending \n').stdout common/test_automatic_updates.py:130: AssertionError __________________ test_all_packages_updated[paramiko://mon] ___________________ [gw1] linux -- Python 3.9.2 /home/amnesia/Persistent/securedrop/admin/.venv3/bin/python host = def test_all_packages_updated(host): """ Ensure a safe-upgrade has already been run, by checking that no packages are eligible for upgrade currently. The Ansible config installs a specific, out-of-date version of Firefox for use with Selenium. Therefore apt will report it's possible to upgrade Firefox, which we'll need to mark as "OK" in terms of the tests. """ c = host.run('apt-get dist-upgrade --simulate') assert c.rc == 0 # Staging hosts will have locally built deb packages, marked as held. # Staging and development will have a version-locked Firefox pinned for # Selenium compatibility; if the holds are working, they shouldn't be # upgraded. # Example output: # 0 upgraded, 0 newly installed, 0 to remove and 1 not upgraded. # Don't test for the "not upgraded" because those map to held packages. > assert "0 upgraded, 0 newly installed, 0 to remove" in c.stdout E assert '0 upgraded, 0 newly installed, 0 to remove' in 'NOTE: This is only a simulation!\n apt-get needs root privileges for real execution.\n Keep also in mind th...l-security [all])\nConf openssl (1.1.1f-1ubuntu2.13 Ubuntu:20.04/focal-updates, Ubuntu:20.04/focal-security [amd64])\n' E + where 'NOTE: This is only a simulation!\n apt-get needs root privileges for real execution.\n Keep also in mind th...l-security [all])\nConf openssl (1.1.1f-1ubuntu2.13 Ubuntu:20.04/focal-updates, Ubuntu:20.04/focal-security [amd64])\n' = CommandResult(command=b'apt-get dist-upgrade --simulate', exit_status=0, stdout=b"NOTE: This is only a simulation!\n ...l])\nConf openssl (1.1.1f-1ubuntu2.13 Ubuntu:20.04/focal-updates, Ubuntu:20.04/focal-security [amd64])\n", stderr=None).stdout common/test_automatic_updates.py:206: AssertionError _____________ test_unattended_upgrades_functional[paramiko://app] ______________ [gw0] linux -- Python 3.9.2 /home/amnesia/Persistent/securedrop/admin/.venv3/bin/python host = def test_unattended_upgrades_functional(host): """ Ensure unatteded-upgrades completes successfully and ensures all packages are up-to-date. """ c = host.run('sudo unattended-upgrades --dry-run --debug') assert c.rc == 0 expected_origins = ( "Allowed origins are: origin=Ubuntu,archive=focal, origin=Ubuntu,archive=focal-security" ", origin=Ubuntu,archive=focal-updates, origin=SecureDrop,codename=focal" ) expected_result = ( "No packages found that can be upgraded unattended and no pending auto-removals" ) assert expected_origins in c.stdout > assert expected_result in c.stdout E assert 'No packages found that can be upgraded unattended and no pending auto-removals' in "Starting unattended upgrades script\nAllowed origins are: origin=Ubuntu,archive=focal, origin=Ubuntu,archive=focal-se...ades installed\nInstCount=0 DelCount=0 BrokenCount=0\nThe list of kept packages can't be calculated in dry-run mode.\n" E + where "Starting unattended upgrades script\nAllowed origins are: origin=Ubuntu,archive=focal, origin=Ubuntu,archive=focal-se...ades installed\nInstCount=0 DelCount=0 BrokenCount=0\nThe list of kept packages can't be calculated in dry-run mode.\n" = CommandResult(command=b'sudo unattended-upgrades --dry-run --debug', exit_status=0, stdout=b"Starting unattended upgra.../usr/bin/dpkg --force-confdef --force-confold --force-confdef --force-confold --status-fd 10 --configure --pending \n').stdout common/test_automatic_updates.py:130: AssertionError =========================== short test summary info ============================ FAILED common/test_automatic_updates.py::test_all_packages_updated[paramiko:/app] FAILED common/test_automatic_updates.py::test_unattended_upgrades_functional[paramiko:/mon] FAILED common/test_automatic_updates.py::test_all_packages_updated[paramiko:/mon] FAILED common/test_automatic_updates.py::test_unattended_upgrades_functional[paramiko:/app] = 4 failed, 433 passed, 7 skipped, 3 xfailed, 1 xpassed, 10 warnings in 781.33s (0:13:01) = ```

[x] QA Matrix checks pass

...

[x] I have backed up and successfully restored the app server following the backup documentation
[x] If doing upgrade testing, make a backup on 2.3.1 and restore this backup on this release candidate

...

[x] Can successfully add journalist account with HOTP authentication
restart the network connection
- [x] verify that the GUI updater is displayed
- [x] verify that the update can be performed and the current release code (2.3.1) is deployed.

Yup, and breaks the 2.3.2-rc1 virtualenv! ;-) Required to recover:

amnesia@amnesia:~/Persistent/securedrop$ rm -rf admin/.venv3
amnesia@amnesia:~/Persistent/securedrop$ git checkout 2.3.2-rc1
amnesia@amnesia:~/Persistent/securedrop$ ./securedrop-admin setup
amnesia@amnesia:~/Persistent/securedrop$ ./securedrop-admin tailsconfig

Then a network bounce triggers the SecureDrop Updater prompt as expected.

2.3.2 QA Checklist

Environment

Install target: VMs
Tails version: 4.29
Test Scenario: fresh install
SSH over Tor: no
Release candidate: rc1
General notes:

Basic Server Testing

[x] After installing the testinfra dependencies, all tests in ./securedrop-admin verify are passing:
- Install dependencies on Admin Workstation with cd ~/Persistent/securedrop && ./securedrop-admin setup -t
- Run tests with ./securedrop-admin verify (this will take a while)
- Remove test dependencies: rm -rf admin/.venv3/ && ./securedrop-admin setup
[x] QA Matrix checks pass

Command Line User Generation

[x] Can successfully add admin user and login

Administration

[x] I have backed up and successfully restored the app server following the backup documentation
[ ] If doing upgrade testing, make a backup on 2.3.1 and restore this backup on this release candidate
[x] "Send Test OSSEC Alert" button in the journalist triggers an OSSEC alert and an email is sent
[ ] Can successfully add journalist account with HOTP authentication

Application Acceptance Testing

Source Interface

Landing page base cases

[x] JS warning bar does not appear when using Security Slider high
[x] JS warning bar does appear when using Security Slider Low

First submission base cases

[x] On generate page, refreshing page produces a new 7-word codename
[x] On submit page, empty submissions produce flashed message
[x] On submit page, short message submitted successfully
[x] On submit page, file greater than 500 MB produces "The connection was reset" in Tor Browser quickly before the entire file is uploaded
[x] On submit page, file less than 500 MB submitted successfully

Returning source base cases

[x] Nonexistent codename cannot log in
[x] Empty codename cannot log in
[x] Legitimate codename can log in
[x] Returning user can view journalist replies - need to log into journalist interface to test

Journalist Interface

Login base cases

[x] Can log in with 2FA tokens
[x] incorrect password cannot log in
[x] invalid 2fa token cannot log in
[x] 2fa immediate reuse cannot log in
[x] Journalist account with HOTP can log in

Index base cases

[x] Filter by codename works
[x] Starring and unstarring works
[x] Click select all selects all submissions
[x] Selecting all and clicking "Download" works

Individual source page

[x] You can submit a reply and a flashed message and new row appears
[x] You cannot submit an empty reply
[x] Clicking "Delete Source Account" and the source and docs are deleted
[x] You can click on a document and successfully decrypt using application private key

Basic Tails Testing

After updating to this release candidate and running securedrop-admin tailsconfig

[x] The Updater GUI appears on boot

2.3.2 release-specific changes

#6408, #6424 - Tails 5.0 compatibility
Clean install, Tails 4.29 or Tails 5.0

On the admin workstation with the 2.3.2 rc code deployed, verify that:
- [x] ./securedrop-admin setup completed successfully
- [x] apt-cache policy ccontrol shows that ccontrol is not installed
- [x] the admin sdconfig, install, and tailsconfig commands completed successfully
- [x] the servers are accessible over ssh and the SI and JI are available via desktop shortcuts
- [x] backup and restore work correctly
- [x] the JI and SSH services are still available after restarting the network connection.

Tails Upgrade, Tails 4.29 to Tails 5.0

on the 4.29 workstation with the 2.3.2 rc code deployed:
- [ ] verify that the clean install cases above are passing
- perform a manual upgrade using a Tails 5.0 reference USB
- [ ] reboot the admin workstation and verify that the upgrade completed successfully and the persistent volume is available
- [ ] run cd Persistent/securedrop && ./securedrop-admin tailsconfig and verify that an error message indicating that a Tails 4 virtualenv was detected and deleted is displayed
- [ ] run ./securedrop-admin setup and verify that it completes successfully
- [ ] verify that the clean install cases above complete successfully
- restart the network connection
- [ ] verify that the GUI updater is displayed

Preflight testing

Basic testing

[ ] Install or upgrade occurs without error
[ ] Source interface is available and version string indicates it is 2.3.2
[ ] A message can be successfully submitted

Tails

[ ] The updater GUI appears on boot
[ ] The update successfully occurs to 2.3.2
[ ] After reboot, updater GUI no longer appears

Environment

Install target: VMs (Qubes)
Tails version: 5
Test Scenario: clean install
SSH over Tor: Yes
Release candidate: RC1

Basic Server Testing

[x] After installing the testinfra dependencies, all tests in ./securedrop-admin verify are passing:
- Install dependencies on Admin Workstation with cd ~/Persistent/securedrop && ./securedrop-admin setup -t
- Run tests with ./securedrop-admin verify (this will take a while)
- Remove test dependencies: rm -rf admin/.venv3/ && ./securedrop-admin setup
[x] QA Matrix checks pass

Command Line User Generation

[x] Can successfully add admin user and login

Administration

[x] I have backed up and successfully restored the app server following the backup documentation
[ ] ~If doing upgrade testing, make a backup on 2.3.1 and restore this backup on this release candidate~
[x] "Send Test OSSEC Alert" button in the journalist triggers an OSSEC alert and an email is sent
[ ] ~Can successfully add journalist account with HOTP authentication~

Application Acceptance Testing

Source Interface

Landing page base cases

[x] JS warning bar does not appear when using Security Slider high
[x] JS warning bar does appear when using Security Slider Low

First submission base cases

[x] On generate page, refreshing page produces a new 7-word codename
[x] On submit page, empty submissions produce flashed message
[x] On submit page, short message submitted successfully
[x] On submit page, file greater than 500 MB produces "The connection was reset" in Tor Browser quickly before the entire file is uploaded
[x] On submit page, file less than 500 MB submitted successfully

Returning source base cases

[x] Nonexistent codename cannot log in
[x] Empty codename cannot log in
[x] Legitimate codename can log in
[x] Returning user can view journalist replies - need to log into journalist interface to test

Journalist Interface

Login base cases

[x] Can log in with 2FA tokens
[x] incorrect password cannot log in
[x] invalid 2fa token cannot log in
[x] 2fa immediate reuse cannot log in
[x] Journalist account with HOTP can log in

Index base cases

[x] Filter by codename works
[x] Starring and unstarring works
[x] Click select all selects all submissions
[x] Selecting all and clicking "Download" works

Individual source page

[x] You can submit a reply and a flashed message and new row appears
[x] You cannot submit an empty reply
[x] Clicking "Delete Source Account" and the source and docs are deleted
[x] You can click on a document and successfully decrypt using application private key

Basic Tails Testing

After updating to this release candidate and running securedrop-admin tailsconfig

[x] The Updater GUI appears on boot

2.3.2 release-specific changes

#6408, #6424 - Tails 5.0 compatibility
Clean install, Tails 4.29 or Tails 5.0

On the admin workstation with the 2.3.2 rc code deployed, verify that:
- [x] ./securedrop-admin setup completed successfully
- [x] apt-cache policy ccontrol shows that ccontrol is not installed
- [x] the admin sdconfig, install, and tailsconfig commands completed successfully
- [x] the servers are accessible over ssh and the SI and JI are available via desktop shortcuts
- [x] backup and restore work correctly
- [x] the JI and SSH services are still available after restarting the network connection.

Tested preflight upgrade scenario against 2.3.2 prod packages:

[x] upgrade occurs without error
[x] Source interface is available and version string indicates it is 2.3.2
[x] A message can be successfully submitted
[x] The updater GUI appears on boot
[x] The update successfully occurs to 2.3.2
[x] After reboot, updater GUI no longer appears

Preflight testing

Install target: VMs
Tails version: 5.0
Test Scenario: clean install
SSH over Tor: yes

Basic testing

[x] Install or upgrade occurs without error (from apt-qa.freedom.press per preflight procedure)
[x] Source interface is available and version string indicates it is 2.3.2
[x] A message can be successfully submitted

freedomofpress / securedrop

Release SecureDrop 2.3.2 #6426

QA Matrix for 2.3.2

Test Plan for 2.3.2

Prepare release candidate (2.3.2~rc1)

Final release

Post release

Basic Server Testing

Command Line User Generation

Administration

Application Acceptance Testing

Source Interface

Landing page base cases

First submission base cases

Returning source base cases

Journalist Interface

Login base cases

Index base cases

Individual source page

Basic Tails Testing

2.3.2 release-specific changes

Tails Upgrade, Tails 4.29 to Tails 5.0

2.3.2 QA Checklist

Environment

Basic Server Testing

Command Line User Generation

Administration

Application Acceptance Testing

Source Interface

Landing page base cases

First submission base cases

Returning source base cases

Journalist Interface

Login base cases

Index base cases

Individual source page

Basic Tails Testing

2.3.2 release-specific changes

Clean install, Tails 4.29 or Tails 5.0

Tails Upgrade, Tails 4.29 to Tails 5.0

Preflight testing

Basic testing

Tails

Environment

Basic Server Testing

Command Line User Generation

Administration

Application Acceptance Testing

Source Interface

Landing page base cases

First submission base cases

Returning source base cases

Journalist Interface

Login base cases

Index base cases

Individual source page

Basic Tails Testing

2.3.2 release-specific changes

Clean install, Tails 4.29 or Tails 5.0

Preflight testing

Basic testing