Release Securedrop 0.13.0

[zenmonkeykstop]

This is a tracking issue for the upcoming release of SecureDrop 0.13.0 - tasks may get added or modified.

Feature freeze: EOD Pacific time, Wednesday, May 15
String freeze: Wednesday, May 15
Pre-release announcement: Wednesday, May 22
Release date: Wednesday, May 29

Release manager: @zenmonkeykstop
Deputy release manager: @emkll

SecureDrop maintainers and testers: As you QA 0.13.0, please report back your testing results as comments on this ticket. File GitHub issues for any problems found, tag them "QA: Release", and associate them with the 0.13.0 milestone for tracking (or ask a maintainer to do so).

Test debian packages will be posted on https://apt-test.freedom.press signed with the test key. An Ansible playbook testing the upgrade path is here.

Prepare release candidate (0.13.0~rc1)

• Prepare 0.13.0-rc1 release changelog - @zenmonkeykstop
• Branch off 0.13.0~rc1 into release/0.13.0 - @zenmonkeykstop
• Build debs and put up 0.13.0~rc1 on test apt server - @emkll

QA Matrix for 0.13.0

Test Plan for 0.13.0

After each test, please update the QA matrix and post details for Basic Server Testing, Application Acceptance Testing and 0.13.0-specific testing below in comments to this ticket.

Final release

• Ensure builder in release branch is updated and/or update builder image - @emkll
• Merge final translations - @kushaldas, @rmol
• Push signed tag -
• Build final Debian packages for 0.13.0 - @conorsch
• Upload Debian packages to apt test - @conorsch
• Pre-Flight: Test install and upgrade (both cron-apt on Trusty, and Ansible on Xenial) of 0.13.0 works w/ prod repo debs, test updater logic in Tails
• Prepare and distribute pre-release messaging - @eloquence
• Prepare and distribute release messaging - @eloquence

Post release

• Merge changelog back to develop - @zenmonkeykstop via Backport 0.13.0 changelog and bump versions #4488
• Bump version on develop in prep for 0.14.0 release - @zenmonkeykstop via Backport 0.13.0 changelog and bump versions #4488
• Run translation tests nightly or weekly - @redshiftzero via ci: run deb and translation tests every week #4489
• Run deb-tests nightly or weekly - @redshiftzero via ci: run deb and translation tests every week #4489
• Update upgrade testing boxes - @conorsch
• Update roadmap wiki page - @eloquence

[eloquence]

Draft pre-release messaging here: https://docs.google.com/document/d/1oDqDRs7hOV-fnRWMXVxxQdt8IBUvvX_PCbAunU8a7Is/edit#

[rmol]

Clean install of 0.13.0 on NUC7

Environment

• Install target: NUC7i5BNH
• Tails version: 3.13.1
• Test Scenario: installation of 0.13.0 on Xenial
• SSH over Tor: only as needed for specific tests
• Release candidate: 0.13.0~rc1
• General notes:

Basic Server Testing

• I can access both the source and journalist interfaces
• I can SSH into both machines over Tor
• AppArmor is loaded on app
  • 0 processes are running unconfined
• AppArmor is loaded on mon
  • 0 processes are running unconfined
• Both servers are running grsec kernels
• iptables rules loaded
• OSSEC emails begin to flow after install
• OSSEC emails are decrypted to correct key and I am able to decrypt them
• QA Matrix checks pass

Command Line User Generation

• Can successfully add admin user and login

Administration

• I have backed up and successfully restored the app server following the documentation here: https://docs.securedrop.org/en/latest/backup_and_restore.html
• If doing upgrade testing, make a backup on 0.12.2 and restore this backup on 0.13.0

Application Acceptance Testing

Source Interface

Landing page base cases

• JS warning bar does not appear when using Security Slider high
• JS warning bar does appear when using Security Slider Low (#4211)

First submission base cases

• On generate page, refreshing codename produces a new 7-word codename
• On submit page, empty submissions produce flashed message
• On submit page, short message submitted successfully
• On submit page, file greater than 500 MB produces "The connection was reset" in Tor Browser quickly before the entire file is uploaded
• On submit page, file less than 500 MB submitted successfully

Returning source base cases

• Nonexistent codename cannot log in
• Empty codename cannot log in
• Legitimate codename can log in
• Returning user can view journalist replies - need to log into journalist interface to test

Journalist Interface

Login base cases

• Can log in with 2FA tokens
• incorrect password cannot log in
• invalid 2fa token cannot log in
• 2fa immediate reuse cannot log in

Index base cases

• Filter by codename works
• Starring and unstarring works
• Click select all selects all submissions
• Selecting all and clicking "Download" works

Individual source page

• You can submit a reply and a flashed message and new row appears
• You cannot submit an empty reply
• Clicking "Delete Source And Submissions" and the source and docs are deleted
• You can click on a document and successfully decrypt using application private key

Basic Tails Testing

Updater GUI

After updating to this release candidate and running securedrop-admin tailsconfig

• The Updater GUI appears on boot
• Updating occurs without issue

0.13.0-specific changes

• The message to sources that have been flagged for reply has been updated as implemented in #4428. Verify this by changing line 201 in /var/www/securedrop/source_app/main.py from if entropy_avail >= 2400: to if entropy_avail >= 2400 and False:, restarting Apache, creating a source, flagging the source in the Journalist Interface, and logging back in as the source.
• When a user attempts to log in twice on the source interface, the user is logged out and a 500 error is not returned, as per #4391. Verify this by opening a browser tab and visiting /generate, then opening a second tab and logging in or creating a new codename via /create, then returning to the first tab and attempting to log in.
• The sha256 checksum of a given encrypted submission or reply is returned as the ETag header value in API download responses, as per #4314:
  • Upgrade Only: BEFORE upgrade, run the QA loader (https://docs.securedrop.org/en/release-0.12.2/development/database_migrations.html#release-testing-migrations) and also upload a few very large files (~100 MB+). Following the postinst migration task, the checksum field in the submissions and replies tables is populated with the sha256 hash of the corresponding files. Verify this by checking the Application Servers sqlite database and comparing values.
  • After a submission has been uploaded and the checksum field has been asynchronously updated, the ETag header value in the response to an API request for a file contains the sha256 hash of the file. Verify this by comparing the ETag value of a response to the value in the database
  • Immediately after a large submission has been uploaded, before the checksum field has been updated, the Etag header value in the response to an API request for a file contains the sha256 hash of the file. Verify this by comparing the ETag value of a response to the sha256 hash of the encrypted submission.

(API-specific):

• API responses to /api/v1/sources include the GPG fingerprint for sources' reply keys in their respective key objects, as implemented in #4436.
• Calling /api/v1/logout invalidates the user's current authorization token, causing subsequent calls using the same token to fail, as implemented in #4349.
• After the time set in TOKEN_EXPIRATION_MINS in securedrop/journalist_app/api.py, an unused authorization token is invalidated, causing subsequent calls to fail, as implemented in #4349. Verify this by setting TOKEN_EXPIRATION_MINS to a low value, restarting Apache, creating an auth token, and waiting for the timeout before using it in a call
• API calls using the HTTP DELETE method to the /api/v1/sources/$UUID endpoint successfully delete the source with uuid $UUID, along with all related files, as implemented in #4023.

[zenmonkeykstop]

QA plan

• NUC5s
• NUC7s
• Mac Minis
• 1U servers in SF

0.13.0 QA Checklist

For both upgrades and fresh installs, here is a list of functionality that requires testing. You can use this for copy/pasting into your QA report. Feel free to edit this message to update the plan as appropriate.

If you have submitted a QA report already for a 0.13.0 release candidate with successful basic server testing and application acceptance testing sections, then you can skip these sections in subsequent reports, unless otherwise indicated by the Release Manager. This is to ensure that you focus your QA effort on the 0.13.0-specific changes as well as changes since the previous release candidate.

Note: if you are testing an upgrade scenario, you should create several sources and submit a large number of files of varying sizes up to the 500MB limit before performing the upgrade. A large dataset is required in order to test the long-running database migration task implemented in #4134.

Environment

• Install target: Mac Mini
• Tails version: 3.13.2
• Test Scenario: fresh install
• SSH over Tor: yes
• Release candidate: 0.13.0-rc1
• General notes:

Basic Server Testing

• I can access both the source and journalist interfaces
• I can SSH into both machines over Tor
• AppArmor is loaded on app
  • 0 processes are running unconfined
• AppArmor is loaded on mon
  • 0 processes are running unconfined
• Both servers are running grsec kernels
• iptables rules loaded
• OSSEC emails begin to flow after install
• OSSEC emails are decrypted to correct key and I am able to decrypt them
• QA Matrix checks pass

Command Line User Generation

• Can successfully add admin user and login

Administration

• I have backed up and successfully restored the app server following the documentation here: https://docs.securedrop.org/en/latest/backup_and_restore.html
• If doing upgrade testing, make a backup on 0.12.2 and restore this backup on 0.13.0 n/a

Application Acceptance Testing

Source Interface

Landing page base cases

• JS warning bar does not appear when using Security Slider high
• JS warning bar does appear when using Security Slider Low (#4211)

First submission base cases

• On generate page, refreshing codename produces a new 7-word codename
• On submit page, empty submissions produce flashed message
• On submit page, short message submitted successfully
• On submit page, file greater than 500 MB produces "The connection was reset" in Tor Browser quickly before the entire file is uploaded
• On submit page, file less than 500 MB submitted successfully

Returning source base cases

• Nonexistent codename cannot log in
• Empty codename cannot log in
• Legitimate codename can log in
• Returning user can view journalist replies - need to log into journalist interface to test

Journalist Interface

Login base cases

• Can log in with 2FA tokens
• incorrect password cannot log in
• invalid 2fa token cannot log in
• 2fa immediate reuse cannot log in

Index base cases

• Filter by codename works
• Starring and unstarring works
• Click select all selects all submissions
• Selecting all and clicking "Download" works

Individual source page

• You can submit a reply and a flashed message and new row appears
• You cannot submit an empty reply
• Clicking "Delete Source And Submissions" and the source and docs are deleted
• You can click on a document and successfully decrypt using application private key

Basic Tails Testing

Updater GUI

After updating to this release candidate and running securedrop-admin tailsconfig

• The Updater GUI appears on boot
• Updating occurs without issue had to revert unstaged changes first

0.13.0-specific changes

• The message to sources that have been flagged for reply has been updated as implemented in #4428. Verify this by changing line 201 in /var/www/securedrop/source_app/main.py from if entropy_avail >= 2400: to if entropy_avail >= 2400 and False:, restarting Apache, creating a source, flagging the source in the Journalist Interface, and logging back in as the source.
• When a user attempts to log in twice on the source interface, the user is logged out, a single 500 error is returned, and the user can then log in, as per #4391. Verify this by opening a browser tab and visiting /generate, then opening a second tab and logging in or creating a new codename via /create, then returning to the first tab and attempting to log in.
• The sha256 checksum of a given encrypted submission or reply is returned as the ETag header value in API download responses, as per #4314:
  • Upgrade Only: BEFORE upgrade, run the QA loader (https://docs.securedrop.org/en/release-0.12.2/development/database_migrations.html#release-testing-migrations) and also upload a few very large files (~100 MB+). Following the postinst migration task, the checksum field in the submissions and replies tables is populated with the sha256 hash of the corresponding files. Verify this by checking the Application Servers sqlite database and comparing values. n/a - clean install
  • After a submission has been uploaded and the checksum field has been asynchronously updated, the ETag header value in the response to an API request for a file contains the sha256 hash of the file. Verify this by comparing the ETag value of a response to the value in the database
  • Immediately after a large submission has been uploaded, before the checksum field has been updated, the Etag header value in the response to an API request for a file contains the sha256 hash of the file. Verify this by comparing the ETag value of a response to the sha256 hash of the encrypted submission. couldn't test - sha256sum takes ~2s for a 400MB file

(API-specific):

• API responses to /api/v1/sources include the GPG fingerprint for sources' reply keys in their respective key objects, as implemented in #4436.
• Calling /api/v1/logout invalidates the user's current authorization token, causing subsequent calls using the same token to fail, as implemented in #4349.
• After the time set in TOKEN_EXPIRATION_MINS in securedrop/journalist_app/api.py, an unused authorization token is invalidated, causing subsequent calls to fail, as implemented in #4349. Verify this by setting TOKEN_EXPIRATION_MINS to a low value, restarting Apache, creating an auth token, and waiting for the timeout before using it in a call
• API calls using the HTTP DELETE method to the /api/v1/sources/$UUID endpoint successfully delete the source with uuid $UUID, along with all related files, as implemented in #4023.

Preflight

• Ensure the builder image is up-to-date on release day

These tests should be performed the day of release prior to live debian packages on apt.freedom.press

Basic testing

• Install or upgrade occurs without error
• Source interface is available and version string indicates it is 0.13.0
• A message can be successfully submitted

Tails

• The updater GUI appears on boot
• The update successfully occurs to 0.13.0
• After reboot, updater GUI no longer appears

[zenmonkeykstop]

QA plan

• NUC5s
• NUC7s
• Mac Minis
• 1U servers in SF

0.13.0 QA Checklist

For both upgrades and fresh installs, here is a list of functionality that requires testing. You can use this for copy/pasting into your QA report. Feel free to edit this message to update the plan as appropriate.

If you have submitted a QA report already for a 0.13.0 release candidate with successful basic server testing and application acceptance testing sections, then you can skip these sections in subsequent reports, unless otherwise indicated by the Release Manager. This is to ensure that you focus your QA effort on the 0.13.0-specific changes as well as changes since the previous release candidate.

Note: if you are testing an upgrade scenario, you should create several sources and submit a large number of files of varying sizes up to the 500MB limit before performing the upgrade. A large dataset is required in order to test the long-running database migration task implemented in #4134.

Environment

• Install target: Mac Mini
• Tails version: 3.14
• Test Scenario: upgrade from 0.12.2
• SSH over Tor: yes
• Release candidate: RC1
• General notes:

Basic Server Testing

• I can access both the source and journalist interfaces
• I can SSH into both machines over Tor
• AppArmor is loaded on app
  • 0 processes are running unconfined
• AppArmor is loaded on mon
  • 0 processes are running unconfined
• Both servers are running grsec kernels
• iptables rules loaded
• OSSEC emails begin to flow after install
• OSSEC emails are decrypted to correct key and I am able to decrypt them
• QA Matrix checks pass

Command Line User Generation

• Can successfully add admin user and login

Administration

• I have backed up and successfully restored the app server following the documentation here: https://docs.securedrop.org/en/latest/backup_and_restore.html
• If doing upgrade testing, make a backup on 0.12.2 and restore this backup on 0.13.0 skipped due to tester error

Application Acceptance Testing

Source Interface

Landing page base cases

• JS warning bar does not appear when using Security Slider high
• JS warning bar does appear when using Security Slider Low (#4211)

First submission base cases

• On generate page, refreshing codename produces a new 7-word codename
• On submit page, empty submissions produce flashed message
• On submit page, short message submitted successfully
• On submit page, file greater than 500 MB produces "The connection was reset" in Tor Browser quickly before the entire file is uploaded
• On submit page, file less than 500 MB submitted successfully

Returning source base cases

• Nonexistent codename cannot log in
• Empty codename cannot log in
• Legitimate codename can log in
• Returning user can view journalist replies - need to log into journalist interface to test

Journalist Interface

Login base cases

• Can log in with 2FA tokens
• incorrect password cannot log in
• invalid 2fa token cannot log in
• 2fa immediate reuse cannot log in

Index base cases

• Filter by codename works
• Starring and unstarring works
• Click select all selects all submissions
• Selecting all and clicking "Download" works

Individual source page

• You can submit a reply and a flashed message and new row appears
• You cannot submit an empty reply
• Clicking "Delete Source And Submissions" and the source and docs are deleted
• You can click on a document and successfully decrypt using application private key

Basic Tails Testing

Updater GUI

After updating to this release candidate and running securedrop-admin tailsconfig

• The Updater GUI appears on boot
• Updating occurs without issue

0.13.0-specific changes

• The message to sources that have been flagged for reply has been updated as implemented in #4428. Verify this by changing line 201 in /var/www/securedrop/source_app/main.py from if entropy_avail >= 2400: to if entropy_avail >= 2400 and False:, restarting Apache, creating a source, flagging the source in the Journalist Interface, and logging back in as the source.
• When a user attempts to log in twice on the source interface, the user is logged out and a 500 error is not returned, as per #4391. Verify this by opening a browser tab and visiting /generate, then opening a second tab and logging in or creating a new codename via /create, then returning to the first tab and attempting to log in.
• The sha256 checksum of a given encrypted submission or reply is returned as the ETag header value in API download responses, as per #4314:
  • Upgrade Only: BEFORE upgrade, run the QA loader (https://docs.securedrop.org/en/release-0.12.2/development/database_migrations.html#release-testing-migrations) and also upload a few very large files (~100 MB+). Following the postinst migration task, the checksum field in the submissions and replies tables is populated with the sha256 hash of the corresponding files. Verify this by checking the Application Servers sqlite database and comparing values. ran cron-apt, rebooted, checked after a few mins - spot-checked values correct
  • After a submission has been uploaded and the checksum field has been asynchronously updated, the ETag header value in the response to an API request for a file contains the sha256 hash of the file. Verify this by comparing the ETag value of a response to the value in the database
  • Immediately after a large submission has been uploaded, before the checksum field has been updated, the Etag header value in the response to an API request for a file contains the sha256 hash of the file. Verify this by comparing the ETag value of a response to the sha256 hash of the encrypted submission.

(API-specific):

• API responses to /api/v1/sources include the GPG fingerprint for sources' reply keys in their respective key objects, as implemented in #4436.
• Calling /api/v1/logout invalidates the user's current authorization token, causing subsequent calls using the same token to fail, as implemented in #4349.
• After the time set in TOKEN_EXPIRATION_MINS in securedrop/journalist_app/api.py, an unused authorization token is invalidated, causing subsequent calls to fail, as implemented in #4349. Verify this by setting TOKEN_EXPIRATION_MINS to a low value, restarting Apache, creating an auth token, and waiting for the timeout before using it in a call
• API calls using the HTTP DELETE method to the /api/v1/sources/$UUID endpoint successfully delete the source with uuid $UUID, along with all related files, as implemented in #4023. - FAIL without playbook run, no changes in Apache config, passes otherwise

Preflight

• Ensure the builder image is up-to-date on release day

These tests should be performed the day of release prior to live debian packages on apt.freedom.press

Basic testing

• Install or upgrade occurs without error
• Source interface is available and version string indicates it is 0.13.0
• A message can be successfully submitted

Tails

• The updater GUI appears on boot
• The update successfully occurs to 0.13.0
• After reboot, updater GUI no longer appears

[rmol]

Upgrade from 0.12.2 on NUC7

Environment

• Install target: NUC7i5BNH
• Tails version: 3.14
• Test Scenario: cron-apt upgrade of 0.12.2 to 0.13.0
• SSH over Tor: only as needed for specific tests
• Release candidate: 0.13.0~rc1
• General notes:

Basic Server Testing

• I can access both the source and journalist interfaces
• I can SSH into both machines over Tor
• AppArmor is loaded on app
  • 0 processes are running unconfined
• AppArmor is loaded on mon
  • 0 processes are running unconfined
• Both servers are running grsec kernels
• iptables rules loaded
• OSSEC emails begin to flow after install
• OSSEC emails are decrypted to correct key and I am able to decrypt them
• QA Matrix checks pass

Command Line User Generation

• Can successfully add admin user and login

Administration

• I have backed up and successfully restored the app server following the documentation here: https://docs.securedrop.org/en/latest/backup_and_restore.html
• If doing upgrade testing, make a backup on 0.12.2 and restore this backup on 0.13.0

Application Acceptance Testing

Source Interface

Landing page base cases

• JS warning bar does not appear when using Security Slider high
• JS warning bar does appear when using Security Slider Low (#4211)

First submission base cases

• On generate page, refreshing codename produces a new 7-word codename
• On submit page, empty submissions produce flashed message
• On submit page, short message submitted successfully
• On submit page, file greater than 500 MB produces "The connection was reset" in Tor Browser quickly before the entire file is uploaded
• On submit page, file less than 500 MB submitted successfully

Returning source base cases

• Nonexistent codename cannot log in
• Empty codename cannot log in
• Legitimate codename can log in
• Returning user can view journalist replies - need to log into journalist interface to test

Journalist Interface

Login base cases

• Can log in with 2FA tokens
• incorrect password cannot log in
• invalid 2fa token cannot log in
• 2fa immediate reuse cannot log in

Index base cases

• Filter by codename works
• Starring and unstarring works
• Click select all selects all submissions
• Selecting all and clicking "Download" works

Individual source page

• You can submit a reply and a flashed message and new row appears
• You cannot submit an empty reply
• Clicking "Delete Source And Submissions" and the source and docs are deleted
• You can click on a document and successfully decrypt using application private key

Basic Tails Testing

Updater GUI

After updating to this release candidate and running securedrop-admin tailsconfig

• The Updater GUI appears on boot
• Updating occurs without issue

0.13.0-specific changes

• The message to sources that have been flagged for reply has been updated as implemented in #4428. Verify this by changing line 201 in /var/www/securedrop/source_app/main.py from if entropy_avail >= 2400: to if entropy_avail >= 2400 and False:, restarting Apache, creating a source, flagging the source in the Journalist Interface, and logging back in as the source.
• When a user attempts to log in twice on the source interface, the user is logged out and a 500 error is not returned, as per #4391. Verify this by opening a browser tab and visiting /generate, then opening a second tab and logging in or creating a new codename via /create, then returning to the first tab and attempting to log in.
• The sha256 checksum of a given encrypted submission or reply is returned as the ETag header value in API download responses, as per #4314:
  • Upgrade Only: BEFORE upgrade, run the QA loader (https://docs.securedrop.org/en/release-0.12.2/development/database_migrations.html#release-testing-migrations) and also upload a few very large files (~100 MB+). Following the postinst migration task, the checksum field in the submissions and replies tables is populated with the sha256 hash of the corresponding files. Verify this by checking the Application Servers sqlite database and comparing values.
  • After a submission has been uploaded and the checksum field has been asynchronously updated, the ETag header value in the response to an API request for a file contains the sha256 hash of the file. Verify this by comparing the ETag value of a response to the value in the database
  • Immediately after a large submission has been uploaded, before the checksum field has been updated, the Etag header value in the response to an API request for a file contains the sha256 hash of the file. Verify this by comparing the ETag value of a response to the sha256 hash of the encrypted submission.

(API-specific):

• API responses to /api/v1/sources include the GPG fingerprint for sources' reply keys in their respective key objects, as implemented in #4436.
• Calling /api/v1/logout invalidates the user's current authorization token, causing subsequent calls using the same token to fail, as implemented in #4349.
• After the time set in TOKEN_EXPIRATION_MINS in securedrop/journalist_app/api.py, an unused authorization token is invalidated, causing subsequent calls to fail, as implemented in #4349. Verify this by setting TOKEN_EXPIRATION_MINS to a low value, restarting Apache, creating an auth token, and waiting for the timeout before using it in a call
• API calls using the HTTP DELETE method to the /api/v1/sources/$UUID endpoint successfully delete the source with uuid $UUID, along with all related files, as implemented in #4023.

[emkll]

Upgrade from 0.12.2 on NUC5PYH (Completed)

Environment

• Install target: NUC5
• Tails version: 3.14
• Test Scenario: 0.12.2 -> 0.13.0
• SSH over Tor: Yes
• Release candidate: RC1
• General notes:

Basic Server Testing

• I can access both the source and journalist interfaces
• I can SSH into both machines over Tor
• AppArmor is loaded on app
  • 0 processes are running unconfined
• AppArmor is loaded on mon
  • 0 processes are running unconfined
• Both servers are running grsec kernels
• iptables rules loaded
• OSSEC emails begin to flow after install
• OSSEC emails are decrypted to correct key and I am able to decrypt them
• QA Matrix checks pass

Command Line User Generation

• Can successfully add admin user and login

Administration

• I have backed up and successfully restored the app server following the documentation here: https://docs.securedrop.org/en/latest/backup_and_restore.html
• If doing upgrade testing, make a backup on 0.12.2 and restore this backup on 0.13.0

Application Acceptance Testing

Source Interface

Landing page base cases

• JS warning bar does not appear when using Security Slider high
• JS warning bar does appear when using Security Slider Low (#4211)

First submission base cases

• On generate page, refreshing codename produces a new 7-word codename
• On submit page, empty submissions produce flashed message
• On submit page, short message submitted successfully
• On submit page, file greater than 500 MB produces "The connection was reset" in Tor Browser quickly before the entire file is uploaded
• On submit page, file less than 500 MB submitted successfully

Returning source base cases

• Nonexistent codename cannot log in
• Empty codename cannot log in
• Legitimate codename can log in
• Returning user can view journalist replies - need to log into journalist interface to test

Journalist Interface

Login base cases

• Can log in with 2FA tokens
• incorrect password cannot log in
• invalid 2fa token cannot log in
• 2fa immediate reuse cannot log in

Index base cases

• Filter by codename works
• Starring and unstarring works
• Click select all selects all submissions
• Selecting all and clicking "Download" works

Individual source page

• You can submit a reply and a flashed message and new row appears
• You cannot submit an empty reply
• Clicking "Delete Source And Submissions" and the source and docs are deleted
• You can click on a document and successfully decrypt using application private key

Basic Tails Testing

Updater GUI (DID NOT TEST)

After updating to this release candidate and running securedrop-admin tailsconfig

• The Updater GUI appears on boot
• Updating occurs without issue

0.13.0-specific changes

• The message to sources that have been flagged for reply has been updated as implemented in #4428. Verify this by changing line 201 in /var/www/securedrop/source_app/main.py from if entropy_avail >= 2400: to if entropy_avail >= 2400 and False:, restarting Apache, creating a source, flagging the source in the Journalist Interface, and logging back in as the source.

• When a user attempts to log in twice on the source interface, a single 500 error is returned and the user is logged out, as per #4391. Verify this by opening a browser tab and visiting /generate, then opening a second tab and logging in or creating a new codename via /create, then returning to the first tab and attempting to log in.

• The sha256 checksum of a given encrypted submission or reply is returned as the ETag header value in API download responses, as per #4314:

  • Upgrade Only: BEFORE upgrade, run the QA loader (https://docs.securedrop.org/en/release-0.12.2/development/database_migrations.html#release-testing-migrations) and also upload a few very large files (~100 MB+). Following the postinst migration task, the checksum field in the submissions and replies tables is populated with the sha256 hash of the corresponding files. Verify this by checking the Application Servers sqlite database and comparing values.

• NOTE: 🤦‍♂️ forgot to run the migration before upgrading. I did have 2 files in the database, and they were hashes successfully.

  • After a submission has been uploaded and the checksum field has been asynchronously updated, the ETag header value in the response to an API request for a file contains the sha256 hash of the file. Verify this by comparing the ETag value of a response to the value in the database
  • Immediately after a large submission has been uploaded, before the checksum field has been updated, the Etag header value in the response to an API request for a file contains the sha256 hash of the file. Verify this by comparing the ETag value of a response to the sha256 hash of the encrypted submission.

(API-specific):

• API responses to /api/v1/sources include the GPG fingerprint for sources' reply keys in their respective key objects, as implemented in #4436.
• Calling /api/v1/logout invalidates the user's current authorization token, causing subsequent calls using the same token to fail, as implemented in #4349.
• After the time set in TOKEN_EXPIRATION_MINS in securedrop/journalist_app/api.py, an unused authorization token is invalidated, causing subsequent calls to fail, as implemented in #4349. Verify this by setting TOKEN_EXPIRATION_MINS to a low value, restarting Apache, creating an auth token, and waiting for the timeout before using it in a call
• API calls using the HTTP DELETE method to the /api/v1/sources/$UUID endpoint successfully delete the source with uuid $UUID, along with all related files, as implemented in #4023.

• requires an ansible run to update Apache config
• Unfortunately the error message is not great, because the error handers on the application side do not return 405 like other methods (for obvious reasons)

[zenmonkeykstop]

QA plan

• NUC5s
• NUC7s
• Mac Minis
• 1U servers in SF

0.13.0 QA Checklist

For both upgrades and fresh installs, here is a list of functionality that requires testing. You can use this for copy/pasting into your QA report. Feel free to edit this message to update the plan as appropriate.

If you have submitted a QA report already for a 0.13.0 release candidate with successful basic server testing and application acceptance testing sections, then you can skip these sections in subsequent reports, unless otherwise indicated by the Release Manager. This is to ensure that you focus your QA effort on the 0.13.0-specific changes as well as changes since the previous release candidate.

Note: if you are testing an upgrade scenario, you should create several sources and submit a large number of files of varying sizes up to the 500MB limit before performing the upgrade. A large dataset is required in order to test the long-running database migration task implemented in #4134.

Environment

• Install target: SF 1U servers
• Tails version: 3.14
• Test Scenario: upgrade
• SSH over Tor: yes
• Release candidate: RC1
• General notes:

Basic Server Testing

• I can access both the source and journalist interfaces
• I can SSH into both machines over Tor
• AppArmor is loaded on app
  • 0 processes are running unconfined
• AppArmor is loaded on mon
  • 0 processes are running unconfined
• Both servers are running grsec kernels
• iptables rules loaded
• OSSEC emails begin to flow after install no access to email but alerts triggered
• OSSEC emails are decrypted to correct key and I am able to decrypt them no access to check
• QA Matrix checks pass

Command Line User Generation

• Can successfully add admin user and login

Administration

• I have backed up and successfully restored the app server following the documentation here: https://docs.securedrop.org/en/latest/backup_and_restore.html
• If doing upgrade testing, make a backup on 0.12.2 and restore this backup on 0.13.0 not tested - servers were updated to 0.13.0~rc1 automatically

Application Acceptance Testing

Source Interface

Landing page base cases

• JS warning bar does not appear when using Security Slider high
• JS warning bar does appear when using Security Slider Low (#4211)

First submission base cases

• On generate page, refreshing codename produces a new 7-word codename
• On submit page, empty submissions produce flashed message
• On submit page, short message submitted successfully
• On submit page, file greater than 500 MB produces "The connection was reset" in Tor Browser quickly before the entire file is uploaded
• On submit page, file less than 500 MB submitted successfully

Returning source base cases

• Nonexistent codename cannot log in
• Empty codename cannot log in
• Legitimate codename can log in
• Returning user can view journalist replies - need to log into journalist interface to test

Journalist Interface

Login base cases

• Can log in with 2FA tokens
• incorrect password cannot log in
• invalid 2fa token cannot log in
• 2fa immediate reuse cannot log in

Index base cases

• Filter by codename works
• Starring and unstarring works
• Click select all selects all submissions
• Selecting all and clicking "Download" works

Individual source page

• You can submit a reply and a flashed message and new row appears
• You cannot submit an empty reply
• Clicking "Delete Source And Submissions" and the source and docs are deleted
• You can click on a document and successfully decrypt using application private key don't have SVS key to check

Basic Tails Testing

Updater GUI

After updating to this release candidate and running securedrop-admin tailsconfig

• The Updater GUI appears on boot
• Updating occurs without issue

0.13.0-specific changes

• The message to sources that have been flagged for reply has been updated as implemented in #4428. Verify this by changing line 201 in /var/www/securedrop/source_app/main.py from if entropy_avail >= 2400: to if entropy_avail >= 2400 and False:, restarting Apache, creating a source, flagging the source in the Journalist Interface, and logging back in as the source.
• When a user attempts to log in twice on the source interface, the user is logged out and a 500 error is not returned, as per #4391. Verify this by opening a browser tab and visiting /generate, then opening a second tab and logging in or creating a new codename via /create, then returning to the first tab and attempting to log in.
• The sha256 checksum of a given encrypted submission or reply is returned as the ETag header value in API download responses, as per #4314:
  • Upgrade Only: BEFORE upgrade, run the QA loader (https://docs.securedrop.org/en/release-0.12.2/development/database_migrations.html#release-testing-migrations) and also upload a few very large files (~100 MB+). Following the postinst migration task, the checksum field in the submissions and replies tables is populated with the sha256 hash of the corresponding files. Verify this by checking the Application Servers sqlite database and comparing values.
  • After a submission has been uploaded and the checksum field has been asynchronously updated, the ETag header value in the response to an API request for a file contains the sha256 hash of the file. Verify this by comparing the ETag value of a response to the value in the database
  • Immediately after a large submission has been uploaded, before the checksum field has been updated, the Etag header value in the response to an API request for a file contains the sha256 hash of the file. Verify this by setting the checksum field to null for a submission in the database, then comparing the ETag value of a response to the sha256 hash of the encrypted submission.

(API-specific):

• API responses to /api/v1/sources include the GPG fingerprint for sources' reply keys in their respective key objects, as implemented in #4436.
• Calling /api/v1/logout invalidates the user's current authorization token, causing subsequent calls using the same token to fail, as implemented in #4349.
• After the time set in TOKEN_EXPIRATION_MINS in securedrop/journalist_app/api.py, an unused authorization token is invalidated, causing subsequent calls to fail, as implemented in #4349. Verify this by setting TOKEN_EXPIRATION_MINS to a low value, restarting Apache, creating an auth token, and waiting for the timeout before using it in a call
• API calls using the HTTP DELETE method to the /api/v1/sources/$UUID endpoint successfully delete the source with uuid $UUID, along with all related files, as implemented in #4023.

Preflight

• Ensure the builder image is up-to-date on release day

These tests should be performed the day of release prior to live debian packages on apt.freedom.press

Basic testing

• Install or upgrade occurs without error
• Source interface is available and version string indicates it is 0.13.0
• A message can be successfully submitted

Tails

• The updater GUI appears on boot
• The update successfully occurs to 0.13.0
• After reboot, updater GUI no longer appears

[emkll]

Clean install in VMs (In progress)

Environment

• Install target: Xenial Vagrant VMs
• Tails version: 3.14
• Test Scenario: Clean install
• SSH over Tor: Yes
• Release candidate: RC1
• General notes:

Basic Server Testing

• I can access both the source and journalist interfaces
• I can SSH into both machines over Tor
• AppArmor is loaded on app
  • 0 processes are running unconfined
• AppArmor is loaded on mon
  • 0 processes are running unconfined
• Both servers are running grsec kernels
• iptables rules loaded
• OSSEC emails begin to flow after install
• OSSEC emails are decrypted to correct key and I am able to decrypt them
• QA Matrix checks pass

Command Line User Generation

• Can successfully add admin user and login

Administration

• I have backed up and successfully restored the app server following the documentation here: https://docs.securedrop.org/en/latest/backup_and_restore.html
• If doing upgrade testing, make a backup on 0.12.2 and restore this backup on 0.13.0
• "Send Test OSSEC Alert" button in the journalist triggers an OSSEC alert and an email is sent.

Application Acceptance Testing

Source Interface

Landing page base cases

• JS warning bar does not appear when using Security Slider high
• JS warning bar does appear when using Security Slider Low (#4211)

First submission base cases

• On generate page, refreshing codename produces a new 7-word codename
• On submit page, empty submissions produce flashed message
• On submit page, short message submitted successfully
• On submit page, file greater than 500 MB produces "The connection was reset" in Tor Browser quickly before the entire file is uploaded
• On submit page, file less than 500 MB submitted successfully

Returning source base cases

• Nonexistent codename cannot log in
• Empty codename cannot log in
• Legitimate codename can log in
• Returning user can view journalist replies - need to log into journalist interface to test

Journalist Interface

Login base cases

• Can log in with 2FA tokens
• incorrect password cannot log in
• invalid 2fa token cannot log in
• 2fa immediate reuse cannot log in

Index base cases

• Filter by codename works
• Starring and unstarring works
• Click select all selects all submissions
• Selecting all and clicking "Download" works

Individual source page

• You can submit a reply and a flashed message and new row appears
• You cannot submit an empty reply
• Clicking "Delete Source And Submissions" and the source and docs are deleted
• You can click on a document and successfully decrypt using application private key

Basic Tails Testing

Updater GUI

After updating to this release candidate and running securedrop-admin tailsconfig

• The Updater GUI appears on boot
• Updating occurs without issue

0.13.0-specific changes

• The message to sources that have been flagged for reply has been updated as implemented in #4428. Verify this by changing line 201 in /var/www/securedrop/source_app/main.py from if entropy_avail >= 2400: to if entropy_avail >= 2400 and False:, restarting Apache, creating a source, flagging the source in the Journalist Interface, and logging back in as the source.
• When a user attempts to log in twice on the source interface, a single 500 error is returned and the user is logged out, as per #4391. Verify this by opening a browser tab and visiting /generate, then opening a second tab and logging in or creating a new codename via /create, then returning to the first tab and attempting to log in.
• The sha256 checksum of a given encrypted submission or reply is returned as the ETag header value in API download responses, as per #4314:
  • Upgrade Only: BEFORE upgrade, run the QA loader (https://docs.securedrop.org/en/release-0.12.2/development/database_migrations.html#release-testing-migrations) and also upload a few very large files (~100 MB+). Following the postinst migration task, the checksum field in the submissions and replies tables is populated with the sha256 hash of the corresponding files. Verify this by checking the Application Servers sqlite database and comparing values.
  • After a submission has been uploaded and the checksum field has been asynchronously updated, the ETag header value in the response to an API request for a file contains the sha256 hash of the file. Verify this by comparing the ETag value of a response to the value in the database
  • After a submission has been uploaded, but before the checksum field has been asynchronously updated, the ETag header value in the response to an API request for a file contains the sha256 hash of the file. Verify this by setting the checksum field of a submission to null in the database, then dowloading via the API comparing the ETag value of a response to the value in the database after the download.

(API-specific):

• API responses to /api/v1/sources include the GPG fingerprint for sources' reply keys in their respective key objects, as implemented in #4436.
• Calling /api/v1/logout invalidates the user's current authorization token, causing subsequent calls using the same token to fail, as implemented in #4349.
• After the time set in TOKEN_EXPIRATION_MINS in securedrop/journalist_app/api.py, an unused authorization token is invalidated, causing subsequent calls to fail, as implemented in #4349. Verify this by setting TOKEN_EXPIRATION_MINS to a low value, restarting Apache, creating an auth token, and waiting for the timeout before using it in a call
• API calls using the HTTP DELETE method to the /api/v1/sources/$UUID endpoint successfully delete the source with uuid $UUID, along with all related files, as implemented in #4023.

[eloquence]

Draft release messaging here:
https://docs.google.com/document/d/1C9KaHslvGxk_3bjV0jgqj-MUQ6t6EVpJEWUaTNPGzZk/edit#

Compared with pre-release messaging, mainly tense changes, pointer to workstation upgrade docs, and the new acknowledgments section.

[eloquence]

Release notes live:

• https://securedrop.org/news/securedrop-0130-released/

Tweet live:

• https://twitter.com/SecureDrop/status/1133886922781220864

Roadmap updated:

• https://github.com/freedomofpress/securedrop/wiki/Development-Roadmap#most-recent-release

Support portal comms completed.