Release Securedrop 2.6.1

[zenmonkeykstop]

This is a tracking issue for the release of SecureDrop 2.6.1. 2.6.1 will be a "git-only" release - as it affects only the code deployed to Tails workstations via git, no packages will be built. This simplifies the release and testing procedure with a potential cost to admin confusion, which we'll address in support updates.

Tentatively scheduled as follows:

Pre-release announcement: n/a
Release date: 08-17-2023

Release manager: @zenmonkeykstop
Deputy release manager: n/a
Localization manager: n/a
Communications manager: TK

SecureDrop maintainers and testers: As you QA 2.6.1, please report back your testing results as comments on this ticket. File GitHub issues for any problems found, tag them "QA: Release".

Test Plan for 2.6.1

Prepare release candidate (2.6.1~rc1)

• Link to latest version of Tails, including release candidates, to test against during QA
• Prepare 2.6.1~rc1 release changelog
• Branch off release/2.6.1 from release/2.6.0
• Prepare 2.6.1
• Build debs, preserving build log, and put up 2.6.1~rc1 on test apt server
• Commit build log.

After each test, please update the QA matrix and post details for Basic Server Testing, Application Acceptance Testing and release-specific testing below in comments to this ticket.

Final release

• Ensure builder in release branch is updated and/or update builder image
• Push signed tag
• Pre-Flight: Test updater logic in Tails (apt-qa tracks the release branch in the LFS repo)
• Build final Debian packages(and preserve build log)
• Commit package build log to https://github.com/freedomofpress/build-logs
• Pre-Flight: Test that install and upgrade from 2.6.0 to 2.6.1 works w/ prod repo debs (apt-qa.freedom.press polls the release branch in the LFS repo for the debs)
• Flip apt QA server to prod status (merge to main in the LFS repo)
• Merge Docs branch changes to main and verify new docs build in securedrop-docs repo
• Prepare release messaging

Post release

• update monitoring config to continue to check for 2.6.0 on instances
• Create GitHub release object
• update versions in securedrop-docs and Wagtail
• Verify new docs show up on https://docs.securedrop.org
• Publish announcements
• Merge changelog back to develop
• Update roadmap wiki page: https://github.com/freedomofpress/securedrop/wiki/Development-Roadmap

[cfm]

Environment

• Install target: NUC11s (but really n/a)
• Tails version: 5.13
• Test Scenario: upgrade
• SSH over Tor: yes
• Release candidate: 4b28622
• General notes: Nothing of note; everything looks good!

2.6.1 release-specific changes

• #6905 Update shell extension tasks to check for site-specific file
  Using an existing production instance and Admin Workstation USB:
  • Follow the documentation to configure a Journalist Workstation using the current RC branch, making sure to only copy the 2 listed files and not site-specific, and verify that:
    • the ./securedrop-admin tailsconfig step completes successfully
    • the Journalist and Source Interfaces are available via desktop icons and the Gnome SecureDrop menu
    • server SSH options are not configured
  • Follow the documentation to configure an additional Admin Workstation using the current RC branch, and verify that:
    • the Journalist and Source Interfaces are available via desktop icons and the Gnome SecureDrop menu
    • server SSH options are also configured, and servers can be reached via SSH either directly via terminal commands or via the Gnome SecureDrop menu
    • when run from the terminal in ~/Persistent/securedrop/, the ./securedrop-admin tailsconfig command completes successfully

[rocodes]

Environment

• Install target: staging servers
• Tails version: 5.16.1
• Test Scenario: There Can Be Only One (?)
• SSH over Tor: yes
• Release candidate: 2.6.1~rc1 aka 4b28622
• General notes: Will complete Journalist Workstation testing tomorrow

2.6.1 release-specific changes

• Follow the documentation to configure an additional Admin Workstation using the current RC branch, and verify that:
  • the Journalist and Source Interfaces are available via desktop icons and the Gnome SecureDrop menu
  • server SSH options are also configured, and servers can be reached via SSH either directly via terminal commands or via the Gnome SecureDrop menu
  • when run from the terminal in ~/Persistent/securedrop/, the ./securedrop-admin tailsconfig command completes successfully

[nathandyer]

Environment

• Install target: NUC12 (App) / NUC11 (Mon) [But really just living in Tails land]
• Tails version: 5.16.1
• Test Scenario: https://github.com/freedomofpress/securedrop/wiki/2.6.1-Test-Plan/
• SSH over Tor: yes
• Release candidate: 4b28622
• General notes: No issues - to use a local idiom, "smooth as apple butter!"

2.6.1 release-specific changes

• #6905 Update shell extension tasks to check for site-specific file
  Using an existing production instance and Admin Workstation USB:
  • Follow the documentation to configure a Journalist Workstation using the current RC branch, making sure to only copy the 2 listed files and not site-specific, and verify that:
    • the ./securedrop-admin tailsconfig step completes successfully
    • the Journalist and Source Interfaces are available via desktop icons and the Gnome SecureDrop menu
    • server SSH options are not configured
  • Follow the documentation to configure an additional Admin Workstation using the current RC branch, and verify that:
    • the Journalist and Source Interfaces are available via desktop icons and the Gnome SecureDrop menu
    • server SSH options are also configured, and servers can be reached via SSH either directly via terminal commands or via the Gnome SecureDrop menu
    • when run from the terminal in ~/Persistent/securedrop/, the ./securedrop-admin tailsconfig command completes successfully

[zenmonkeykstop]

Thanks all, proceeding with the 2.6.1 tag.

[zenmonkeykstop]

Tag pushed, preflight checks are TBD

[nathandyer]

Verified on my production Admin Workstation drive that it:

• Saw the update
• Downloaded the update
• Completed successfully
• Everything is functional on reboot, HEAD detached at 2.6.1

[cfm]

Verified on my production Admin Workstation drive that it:

• Saw the update
• Downloaded the update
• Completed successfully
• Everything is functional on reboot, HEAD detached at 2.6.1