Repository: freedomofpress/securedrop

Issue:
Release SecureDrop 0.5.2
This is a tracking issue for the upcoming release of SecureDrop 0.5.2 - tasks may get added or modified. Note that this is a hotfix release and translation updates will not be required. 

_SecureDrop maintainers and testers:_ As you QA 0.5.2, please report back your testing results as comments on this ticket. File GitHub issues for any problems found, tag them "QA: Release", and associate them with the 0.5.2 milestone for tracking. 

# Prepare first release candidate (0.5.2~rc1)
- [x] Branch `release/0.5.2` off `master`
- [x] Bring in changes for the release (done by cherry-picking changes into backported branches, then merging these branches into the release branch (except #2935)):
  - [x] Add new languages to `sdconfig` prompt (#2894) - backported changes in branch `backport-pr-2894`
  - [x] Replace Travis CI with Circle CI, use `xenial` version of `gettext` (#2796) - backported changes in `backport-pr-2796`
  - [x] Replacement of `PyCrypto` (#2903) - backported changes in branch `backport-pr-2903`
  - [x] Dynamically open firewall during OSSEC registration (#2748) - backported changes in `backport-pr-2748`
  - [x] Force immediate Ansible exits (#2922) - backported changes in `backport-pr-2922`
  - [x] Disabling of pip `safety` check in release branch due to use of Ansible <2.4 (#2928) - backported changes in `backport-pr-2928`
  - [x] Followup to #2922, ensuring Ansible will fail fast for all plays (#2935) - cherry picked directly
- [x] Prepare `0.5.2~rc1` tag
- [x] Build debs and put up `0.5.2~rc1` on test apt server

# QA (0.5.2~rc1)

- [x] Test upgrade from 0.5.1 works on prod w/ test repo debs
- [x] Test fresh install (not upgrade) of 0.5.2 works on prod w/ test repo debs

# Release

- [x] Push signed tag
- [x] Build final Debian packages for 0.5.2
- [x] Pre-Flight: Test install (not upgrade) of 0.5.2 works w/ prod repo debs
- [x] Publish blog post about 0.5.2 Debian package release and instructions for admins

# Post-release

- [x] Merge release changes into master branch
- [ ] Merge release changes into development branch


Discussion:

Resolving patch:
diff --git a/docs/conf.py b/docs/conf.py
--- a/docs/conf.py
+++ b/docs/conf.py
@@ -57,9 +57,9 @@
 # built documents.
 #
 # The short X.Y version.
-version = '0.5.1'
+version = '0.5.2'
 # The full version, including alpha/beta/rc tags.
-release = '0.5.1'
+release = '0.5.2'
 
 # The language for content autogenerated by Sphinx. Refer to documentation
 # for a list of supported languages.
diff --git a/securedrop/version.py b/securedrop/version.py
--- a/securedrop/version.py
+++ b/securedrop/version.py
@@ -1 +1 @@
-__version__ = '0.5.1'
+__version__ = '0.5.2'


Test patch:
diff --git a/molecule/aws/securedrop_test.pub b/molecule/aws/securedrop_test.pub
new file mode 100644
--- /dev/null
+++ b/molecule/aws/securedrop_test.pub
@@ -0,0 +1,30 @@
+-----BEGIN PGP PUBLIC KEY BLOCK-----
+
+mQENBFhPGZsBCACzn00s3+i5HdGIldDGYXxY2HKL9Qhk0DhiRrNPaQemhNijuFlC
+geCeKN/smDAUyM5mfEoxmWy3V7n8SEQUpqI4dIS2AohReLkyKEKiIpTuXW7F9kO3
+vcXHgrTka+8B4ZQxDuTHNFJLmBwJnP24LrL6BzkDIUNeQFwM0EFTDOJlW1QV6qkm
+9WGizo2sR0VBJJabfRWrTWd8llYOVcc+LptErVNADPaX6iqb+QnZVJ/nYmCTgABj
+lD3aZ4EPZ+ioVOcOxbgBkAX76COObUUw/XahBGwj4fJ5kyzvDSBCHHlRzN39LKpM
+Y+HfSc1scAOWN+Dd0N/joIa0j0U4SGHo1NdzABEBAAG0MVNlY3VyZURyb3AgVEVT
+VElORyBrZXkgPHNlY3VyZWRyb3BAZnJlZWRvbS5wcmVzcz6JAU4EEwEIADgWIQRO
+15zDNi19EoNwRgJKO+SpIhGwPAUCWE8ZmwIbAwULCQgHAgYVCAkKCwIEFgIDAQIe
+AQIXgAAKCRBKO+SpIhGwPCb9B/9SuVoxbe3nLlU0bHDQtoq5P7adyTZK+5gKIiAo
+mtAkc/EuiF6jYIDLo+DBB1GBJVjyD5igTt14XR3JpMe6nLtztD5zgGk47gYQk3y5
+6f5ydd7zRo9OxulRYDvU1mXMUc0EmqfzuSxY55HJy5KQvjeKIU0fTvwbPYXdhFCC
+42iyBIkp4e4/C5oO4lNrNY2DJEZ+a8H5LHasJ4g9A78f/D5q0HWO1HutzfDeiMvq
+WFwlGMD2OzTEQA2MGlVRIYvLHAG1aV9fXY8kjCFT8ri5hxlQeTkKISfbW3pFSq6s
+Ow4r975zWLTPJNm+WTbBpfIOFBVAW34EHkcb/QmntlvqkNM+uQENBFhPGZsBCAC4
+VEtCQEuZ3WzCNL/0yQFih1EjT/AsS3j3++xvSOYWF+c7AjR9X0MkJFTnUZBHs6MX
+PM33bbkWbBBE2ILdDCEF72Uc5HyyC2lW2DvPY9ZLVSGcMCUsKARv5rbeNdgiLVP5
+8AMkmG48q0Pxrr6UVX14M34Jm5G91c/dj9zHtVwkLg4RG/rcumQdlpQhNmMycB2X
+lat48atmEkutfLEQizXIlgiCdNEpgfUBy/jZZcCOjwr8PUPmSUWjKOVMv6CSLx8K
+z2cP4We7tyq4qhc0cWjJOWOmJpu5tbmi6XEEWGaIJyN+POhHEcb0tI1rTJ88nrMb
+DI/NF/35kuWIIkADOb2vABEBAAGJATYEGAEIACAWIQRO15zDNi19EoNwRgJKO+Sp
+IhGwPAUCWE8ZmwIbDAAKCRBKO+SpIhGwPC3fB/0TfuScS718FiEcVRI3F2wBbzTQ
+VARhGzEvPSU5Z3Cur/EB8ihpWvwi39tUMeg5HTheDl/8A7f1QCjIFSVEr1slGNLh
+YFF07XGWhy837z6kiihK2z6/w6Q9QJqjE+QVZCKr97aIPejvEoHoslZTU5pJ52qF
+J7KQd1hEvVs00DxY6VlyK0FzXqByKYq6Arl2tzlCZ6RPEHKXV2xSP06jLEagzgYe
+DylVo9Xahenj4n/Mtq7Am6tGgU9Vy9cGbWNBdUND/mFQEEZSh9RJabPeluH12sir
+5/tfsDr4DGHSz7ws+5M6Zbk6oNJEwQZ4cR+81qCfXE5X5LW1KlAL8wDl7dfS
+=fYUi
+-----END PGP PUBLIC KEY BLOCK-----
\ No newline at end of file
diff --git a/molecule/aws/tor_apt_test.yml b/molecule/aws/tor_apt_test.yml
new file mode 100644
--- /dev/null
+++ b/molecule/aws/tor_apt_test.yml
@@ -0,0 +1,39 @@
+---
+- name: Add apt SD test public key
+  apt_key:
+    data: "{{ lookup('file','securedrop_test.pub') }}"
+    state: present
+
+- name: Temporary fix for GH issue 2938
+  file:
+    state: absent
+    path: "/etc/apt/sources.list.d/tor_apt_freedom_press.list"
+
+- name: Switch apt repo URLs to staging.
+  replace:
+    dest: "/etc/apt/sources.list.d/tor.apt.freedom.press.list"
+    replace: "tor-apt-test.freedom.press"
+    regexp: '//tor-apt\.freedom\.press'
+  ignore_errors: "yes"
+  notify: update tor
+
+- name: Force possible tor update
+  meta: flush_handlers
+
+- name: Squash testinfra failure for packages needing update
+  apt:
+    upgrade: safe
+
+- name: Extract latest tor version
+  shell: |
+    apt-cache policy tor | sed -e 's/^\s*Installed:\ \(\S*\)/\1/g;tx;d;:x'
+  changed_when: false
+  register: extract_tor_version
+
+- name: Dump Tor version to file (for reporting)
+  copy:
+    dest: "{{ playbook_dir }}/../../.tor_version"
+    content: "{{ extract_tor_version.stdout }}"
+  delegate_to: localhost
+  run_once: true
+  become: "no"
diff --git a/molecule/builder/tests/vars.yml b/molecule/builder/tests/vars.yml
--- a/molecule/builder/tests/vars.yml
+++ b/molecule/builder/tests/vars.yml
@@ -1,5 +1,5 @@
 ---
-securedrop_version: "0.5.1"
+securedrop_version: "0.5.2"
 ossec_version: "2.8.2"
 keyring_version: "0.1.1"
 config_version: "0.1.0"
diff --git a/testinfra/common/test_tor_mirror.py b/testinfra/common/test_tor_mirror.py
--- a/testinfra/common/test_tor_mirror.py
+++ b/testinfra/common/test_tor_mirror.py
@@ -1,6 +1,10 @@
+import os
 import pytest
 
 
+@pytest.mark.skipif(
+        os.environ.get('CIRCLE_BRANCH', 'na').startswith('release'),
+        reason="Release branches will use tor-apt-test repo")
 def test_tor_mirror_present(host):
     """
     Ensure the FPF mirror of the Tor apt repo, tor-apt.freedom.press,