Release qubes-template-securedrop-workstation (build tag: 0.3.0)

[sssoleileraaa]

Note that I am using a similar PR structure as we are aiming to introduce in the prod lfs repo (see freedomofpress/securedrop-yum-prod#31)

Description

Package being released: qubes-template-securedrop-workstation
Package tag: https://github.com/freedomofpress/qubes-template-securedrop-workstation/releases/tag/0.3.0
Build logs: freedomofpress/build-logs@cd13710 (note that I had to rebuild the template so it's easier to look at the files without the diff view: https://github.com/freedomofpress/build-logs/blob/cd137103c2af006692e7e65561473a49c706139e/workstation/qubes-template-securedrop-workstation-bullseye-4.0.6-202206302135/)
Test signing key used to sign package and tag: https://github.com/freedomofpress/securedrop-workstation-dev-rpm-packages-lfs/blob/HEAD/pubkeys/test.key

Release tracking issue: freedomofpress/securedrop-yum-prod#33

Checklist for PR owner

• Links in this PR template have been updated as required
• https://github.com/freedomofpress/securedrop-workstation-dev-rpm-packages-lfs/blob/HEAD/pubkeys/test.key points to the correct test signing key

Checklist for reviewer

• CI is passing
• The changes to the template builder are what you expect (see freedomofpress/qubes-template-securedrop-workstation@0.2.3...0.3.0)
• The RPM is signed with the test signing key

  • Download the signed RPM from this PR
  • Run rpm -qi <signed-rpm> to get the KEY ID
  • Run gpg -k <KEY ID> to verify that it matches the test signing key (make sure you have the test signing key referenced in the PR description in your GPG keyring)

• The Unsigned RPM checksum matches what's in the build logs (see https://github.com/freedomofpress/build-logs/blob/cd137103c2af006692e7e65561473a49c706139e/workstation/qubes-template-securedrop-workstation-bullseye-4.0.6-202206302135/Makefile.out)

  • Download the signed RPM from this PR (if you haven't already)
  • Run rpm --delsign <signed-rpm> to remove the signature (do this on fedora 33 or 34, see last line in build logs for rpm version)
  • Run sha256sum <unsigned-rpm> and compare

QA

Follow QA test plan in tracking issue

[rocodes]

Notes: I installed this template manually by sticking it into dom0 and running sudo dnf install. I attempted to install via qvm-template install path/to/rpm, as the source code for that tool would seem to support, but encountered an error: ERROR: Signature Verification Failed: -: digests SIGNATURES NOT OK. [Edit for anyone trying to repro: I just realized maybe this is cause the signing key needs to also be in another directory besides /etc/pki/rpm-gpg/, istr keys in 2 locations in early 4.1 rcs. To revisit later.]
I had already verified in a fedora vm with the test key that the rpm was signed correctly and that the sha256sum of the file I was installing in dom0 matched the hash of the file in that vm, so I proceeded with the dnf install and it worked fine. Just a heads up to our future selves since I'm pretty sure dnf install (and dnf remove) are not recommended in 4.1.

Checklist for reviewer

• CI is passing
• The commits being released are what you expect (see freedomofpress/qubes-template-securedrop-workstation@0.2.3...0.3.0-rc1)
• The RPM is signed with the test signing key

  • Download the signed RPM from this PR
  • Run rpm -qi <signed-rpm> to get the KEY ID
  • Run gpg -k <KEY ID> to verify that it matches the test signing key (make sure you have the test signing key referenced in the PR description in your GPG keyring)

• The Unsigned RPM checksum matches what's in the build logs (see https://github.com/freedomofpress/build-logs/blob/cd137103c2af006692e7e65561473a49c706139e/workstation/qubes-template-securedrop-workstation-bullseye-4.0.6-202206302135/Makefile.out)

  • Download the signed RPM from this PR (if you haven't already)
  • Run rpm --delsign <signed-rpm> to remove the signature (do this on fedora 33 or 34, see last line in build logs for rpm version)
  • Run sha256sum <unsigned-rpm> and compare

QA

• Template installs
• Updater runs succesfully
• Template and associated VMs are using 5.14.41-grsec-workstation kernel, 0.2.0 securedrop-workstation-config package, and pointing at apt repo
• Client runs and basic client functionality is successful

[rocodes]

See review comment - lgtm, thank you @creviera for putting all the pieces together <3