Release SDW template and dom0-config for Qubes 4.1

[sssoleileraaa]

Description

Towards freedomofpress/securedrop-workstation#600

This release includes the following changes:

• Fedora 32 securedrop-workstation-dom0-config 0.6.2 RPM for Qubes 4.1
• Fedora 32 qubes-template-securedrop-workstation RPM for Qubes 4.1

Release Manager(s):

• @creviera/ @rocodes

QA Tester(s):

• @rocodes/ @creviera

QA Test Plan

Phase 1

• Merge Release qubes-template-securedrop-workstation for Qubes 4.1 securedrop-yum-test#34 so we can begin phase 1 testing being tracked in https://github.com/freedomofpress/securedrop-debian-packages-lfs/issues/84

(securedrop-workstation-dom0-config will be built manually off the tip of main in securedrop-workstation during this phase as described in https://github.com/freedomofpress/securedrop-debian-packages-lfs/issues/84.)

Phase 2 - template

Once the following packages are on prod, we can stage a prod build of the template and begin phase 2 testing:

• https://apt.freedom.press/pool/main/s/securedrop-keyring/securedrop-keyring_0.1.6%2Bbullseye_all.deb exists
• https://apt.freedom.press/pool/main/s/securedrop-workstation-config/securedrop-workstation-config_0.2.0%2Bbullseye_all.deb exists
• https://apt.freedom.press/pool/main/l/linux-upstream/linux-headers-5.15.41-grsec-workstation_5.15.41-grsec-workstation-1_amd64.deb exists
• https://apt.freedom.press/pool/main/l/linux-upstream/linux-image-5.15.41-grsec-workstation_5.15.41-grsec-workstation-1_amd64.deb exists
• https://apt.freedom.press/pool/main/s/securedrop-workstation-grsec/securedrop-workstation-grsec_5.15.41-1~bullseye_amd64.deb exists

In phase 1, we already QA'd https://yum-test.securedrop.org/workstation/dom0/f32/qubes-template-securedrop-workstation-bullseye-4.0.6-202206132300.noarch.rpm. Unfortunately, we can't just promote the package because there were some small modifications to the packaging code in order to allow a test signature instead of prod, and to point it to apt-test instead of apt (see freedomofpress/qubes-template-securedrop-workstation@main...0.3.0-rc1). We will have to rebuild the template off the tip of main in the qubes-template-securedrop-workstation repo with a new 0.3.0 tag. Here is a list of tasks that need to be done before we can enter phase 2 testing:

• Add a prod-signed tag off the tip of main: https://github.com/freedomofpress/qubes-template-securedrop-workstation/releases/tag/0.3.0
• Build new template, sign it with the test key, save build logs, and open PR in https://github.com/freedomofpress/securedrop-workstation-dev-rpm-packages-lfs

Now you can test following the plan below:

• Set up your workstation for staging, install, and run the client to confirm basic acceptance testing (@rocodes and @creviera to pair on this - remember that the template has already been tested for the most part, but since we're rebuilding it, we'll want to run through some additional testing)
• Promote template to prod, resign, verify the checksums match between dev and prod

Phase 2 - dom0 config

Once phase 1 QA is complete in https://github.com/freedomofpress/securedrop-debian-packages-lfs/issues/84, we can stage the securedrop-workstation-dom0-config 0.7.0 package for a final round of QA (knowing that it is unlikely that we'll have to make any more changes in the provisioning logic in the securedrop-workstation repo).

To test:

Once https://yum-test.securedrop.org/workstation/dom0/f32/securedrop-workstation-dom0-config-0.7.0-1.fc32.noarch.rpm exists...

• Follow phase 2 QA in https://github.com/freedomofpress/securedrop-debian-packages-lfs/issues/84
• Promote securedrop-workation-dom0-config 0.7.0 to prod, prod-sign the Release file, verify the checksums match between dev and prod

Phase 3

• Follow phase 3 QA in https://github.com/freedomofpress/securedrop-debian-packages-lfs/issues/84