Repository: freedomofpress/securedrop

Issue:
Release Securedrop 0.13.0
This is a tracking issue for the upcoming release of SecureDrop 0.13.0 - tasks may get added or modified. 

**Feature freeze:** EOD Pacific time, Wednesday, May 15
**String freeze:** Wednesday, May 15
**Pre-release announcement:** Wednesday, May 22
**Release date:** Wednesday, May 29

**Release manager:** @zenmonkeykstop 
**Deputy release manager:** @emkll
 
_SecureDrop maintainers and testers:_ As you QA 0.13.0, please report back your testing results as comments on this ticket. File GitHub issues for any problems found, tag them "QA: Release", and associate them with the 0.13.0 milestone for tracking (or ask a maintainer to do so). 

Test debian packages will be posted on https://apt-test.freedom.press signed with [the test key](https://gist.githubusercontent.com/conorsch/ec4008b111bc3142fca522693f3cce7e/raw/2968621e8ad92db4505a31fcc5776422d7d26729/apt-test%2520apt%2520pubkey). An Ansible playbook testing the upgrade path is [here](https://gist.github.com/conorsch/e7556624df59b2a0f8b81f7c0c4f9b7d).

# Prepare release candidate (0.13.0~rc1)
- [x] Prepare 0.13.0-rc1 release changelog - @zenmonkeykstop  
- [x] Branch off 0.13.0~rc1 into release/0.13.0 - @zenmonkeykstop 
- [x] Build debs and put up `0.13.0~rc1` on test apt server - @emkll

# [QA Matrix for 0.13.0](https://docs.google.com/spreadsheets/d/1SFGDrsMAw6X-I4v6ZC7ZkmHl3eS9peh5xfuP-JtPOB8/edit#gid=0)

# [Test Plan for 0.13.0](https://github.com/freedomofpress/securedrop/wiki/0.13.0-Test-Plan)

After each test, please update the QA matrix and post details for Basic Server Testing, Application Acceptance Testing and 0.13.0-specific testing below in comments to this ticket.

# Final release
- [x] Ensure builder in release branch is updated and/or update builder image - @emkll 
- [x] Merge final translations - @kushaldas, @rmol 
- [x] Push signed tag -
- [x] Build final Debian packages for 0.13.0 - @conorsch 
- [x] Upload Debian packages to apt test - @conorsch 
- [x] Pre-Flight: Test install and upgrade (both cron-apt on Trusty, and Ansible on Xenial) of 0.13.0 works w/ prod repo debs, test updater logic in Tails
- [x] Prepare and distribute pre-release messaging  - @eloquence 
- [x] Prepare and distribute release messaging - @eloquence 

# Post release

- [x] Merge changelog back to `develop` - @zenmonkeykstop  via #4488
- [x] Bump version on `develop` in prep for 0.14.0 release -  @zenmonkeykstop  via #4488
- [x] Run translation tests nightly or weekly - @redshiftzero via https://github.com/freedomofpress/securedrop/pull/4489
- [x] Run deb-tests nightly or weekly - @redshiftzero via https://github.com/freedomofpress/securedrop/pull/4489
- [x] Update upgrade testing boxes - @conorsch
- [x] Update roadmap wiki page - @eloquence


Discussion:
Draft pre-release messaging here: https://docs.google.com/document/d/1oDqDRs7hOV-fnRWMXVxxQdt8IBUvvX_PCbAunU8a7Is/edit#
## Clean install of 0.13.0 on NUC7

### Environment

- Install target: NUC7i5BNH
- Tails version: 3.13.1
- Test Scenario: installation of 0.13.0 on Xenial
- SSH over Tor: only as needed for specific tests
- Release candidate: 0.13.0~rc1
- General notes:

### Basic Server Testing

- [x] I can access both the source and journalist interfaces
- [x] I can SSH into both machines over Tor
- [x] AppArmor is loaded on app
    - [x] 0 processes are running unconfined
- [x] AppArmor is loaded on mon
    - [x] 0 processes are running unconfined
- [x] Both servers are running grsec kernels
- [x] iptables rules loaded
- [x] OSSEC emails begin to flow after install
- [x] OSSEC emails are decrypted to correct key and I am able to decrypt them
- [x] [QA Matrix](https://docs.google.com/spreadsheets/d/1SFGDrsMAw6X-I4v6ZC7ZkmHl3eS9peh5xfuP-JtPOB8/edit#gid=0) checks pass

#### Command Line User Generation

- [x] Can successfully add admin user and login

#### Administration

- [x] I have backed up and successfully restored the app server following the documentation here: https://docs.securedrop.org/en/latest/backup_and_restore.html
- [ ] If doing upgrade testing, make a backup on 0.12.2 and restore this backup on 0.13.0

### Application Acceptance Testing

#### Source Interface

##### Landing page base cases
- [x] JS warning bar does not appear when using Security Slider high
- [x] JS warning bar does appear when using Security Slider Low ([#4211](https://github.com/freedomofpress/securedrop/pull/4211))

##### First submission base cases
- [x] On generate page, refreshing codename produces a new 7-word codename
- [x] On submit page, empty submissions produce flashed message
- [x] On submit page, short message submitted successfully
- [x] On submit page, file greater than 500 MB produces "The connection was reset" in Tor Browser _quickly_ before the entire file is uploaded
- [x] On submit page, file less than 500 MB submitted successfully

##### Returning source base cases

- [x] Nonexistent codename cannot log in
- [x] Empty codename cannot log in
- [x] Legitimate codename can log in
- [x] Returning user can view journalist replies - need to log into journalist interface to test

#### Journalist Interface

##### Login base cases
- [x] Can log in with 2FA tokens
- [x] incorrect password cannot log in
- [x] invalid 2fa token cannot log in
- [x] 2fa immediate reuse cannot log in

##### Index base cases
- [x] Filter by codename works
- [x] Starring and unstarring works
- [x] Click select all selects all submissions
- [x] Selecting all and clicking "Download" works

##### Individual source page
- [x] You can submit a reply and a flashed message and new row appears
- [x] You cannot submit an empty reply
- [x] Clicking "Delete Source And Submissions" and the source and docs are deleted
- [x] You can click on a document and successfully decrypt using application private key

### Basic Tails Testing

#### Updater GUI

After updating to this release candidate and running `securedrop-admin tailsconfig`

- [x] The Updater GUI appears on boot
- [x] Updating occurs without issue

### 0.13.0-specific changes

- [x] The message to sources that have been flagged for reply has been updated as implemented in [#4428](https://github.com/freedomofpress/securedrop/pull/4428). Verify this by changing line 201 in `/var/www/securedrop/source_app/main.py` from `if entropy_avail >= 2400:` to `if entropy_avail >= 2400 and False:`, restarting Apache, creating a source, flagging the source in the Journalist Interface, and logging back in as the source.
- [x] When a user attempts to log in twice on the source interface, the user is logged out and a 500 error is not returned, as per [#4391](https://github.com/freedomofpress/securedrop/pull/4391). Verify this by opening a browser tab and visiting `/generate`, then opening a second tab and logging in or creating a new codename via `/create`, then returning to the first tab and attempting to log in.
- [x] The sha256 checksum of a given encrypted submission or reply is returned as the ETag header value in API download responses, as per [#4314](https://github.com/freedomofpress/securedrop/pull/4314):
    - [ ] **Upgrade Only:** BEFORE upgrade, run the QA loader (https://docs.securedrop.org/en/release-0.12.2/development/database_migrations.html#release-testing-migrations) and also upload a few _very_ large files (~100 MB+). Following the postinst migration task, the `checksum` field in the `submissions` and `replies` tables is populated with the sha256 hash of the corresponding files. Verify this by checking the Application Servers sqlite database and comparing values.
    - [x] After a submission has been uploaded and the `checksum` field has been asynchronously updated, the ETag header value in the response to an API request for a file contains the sha256 hash of the file. Verify this by comparing the ETag value of a response to the value in the database
    - [x] Immediately after a large submission has been uploaded, *before* the `checksum` field has been updated, the Etag header value in the response to an API request for a file contains the sha256 hash of the file. Verify this by comparing the ETag value of a response to the sha256 hash of the encrypted submission.

(API-specific):

- [x] API responses to `/api/v1/sources` include the GPG fingerprint for sources' reply keys in their respective `key` objects, as implemented in [#4436](https://github.com/freedomofpress/securedrop/pull/4436).
- [x] Calling `/api/v1/logout` invalidates the user's current authorization token, causing subsequent calls using the same token to fail, as implemented in [#4349](https://github.com/freedomofpress/securedrop/pull/4349).
- [x] After the time set in `TOKEN_EXPIRATION_MINS` in `securedrop/journalist_app/api.py`, an unused authorization token is invalidated, causing subsequent calls to fail, as implemented in [#4349](https://github.com/freedomofpress/securedrop/pull/4349). Verify this by setting `TOKEN_EXPIRATION_MINS` to a low value, restarting Apache, creating an auth token, and waiting for the timeout before using it in a call
- [x] API calls using the HTTP DELETE method to the `/api/v1/sources/$UUID` endpoint successfully delete the source with uuid `$UUID`, along with all related files, as implemented in [#4023](https://github.com/freedomofpress/securedrop/pull/4023).

# QA plan

- NUC5s
- NUC7s
- Mac Minis
- 1U servers in SF


## 0.13.0 QA Checklist

For both upgrades and fresh installs, here is a list of functionality that requires testing. You can use this for copy/pasting into your QA report. Feel free to edit this message to update the plan as appropriate.

If you have submitted a QA report already for a 0.13.0 release candidate with successful basic server testing and application acceptance testing sections, then you can skip these sections in subsequent reports, unless otherwise indicated by the Release Manager. This is to ensure that you focus your QA effort on the 0.13.0-specific changes as well as changes since the previous release candidate.

**Note:** if you are testing an upgrade scenario, you should create several sources and submit a large number of files of varying sizes up to the 500MB limit before performing the upgrade. A large dataset is required in order to test the long-running database migration task implemented in [#4134](https://github.com/freedomofpress/securedrop/pull/4314).

### Environment

- Install target: Mac Mini
- Tails version: 3.13.2
- Test Scenario: fresh install
- SSH over Tor: yes
- Release candidate: 0.13.0-rc1
- General notes:

### Basic Server Testing

- [x] I can access both the source and journalist interfaces
- [x] I can SSH into both machines over Tor
- [x] AppArmor is loaded on app
    - [x] 0 processes are running unconfined
- [x] AppArmor is loaded on mon
    - [x] 0 processes are running unconfined
- [x] Both servers are running grsec kernels
- [x] iptables rules loaded
- [x] OSSEC emails begin to flow after install
- [x] OSSEC emails are decrypted to correct key and I am able to decrypt them
- [x] [QA Matrix](https://docs.google.com/spreadsheets/d/1SFGDrsMAw6X-I4v6ZC7ZkmHl3eS9peh5xfuP-JtPOB8/edit#gid=0) checks pass

#### Command Line User Generation

- [x] Can successfully add admin user and login

#### Administration

- [x] I have backed up and successfully restored the app server following the documentation here: https://docs.securedrop.org/en/latest/backup_and_restore.html
- [x] If doing upgrade testing, make a backup on 0.12.2 and restore this backup on 0.13.0 **n/a**

### Application Acceptance Testing

#### Source Interface

##### Landing page base cases
- [x] JS warning bar does not appear when using Security Slider high
- [x] JS warning bar does appear when using Security Slider Low ([#4211](https://github.com/freedomofpress/securedrop/pull/4211))

##### First submission base cases
- [x] On generate page, refreshing codename produces a new 7-word codename
- [x] On submit page, empty submissions produce flashed message
- [x] On submit page, short message submitted successfully
- [x] On submit page, file greater than 500 MB produces "The connection was reset" in Tor Browser _quickly_ before the entire file is uploaded
- [x] On submit page, file less than 500 MB submitted successfully

##### Returning source base cases

- [x] Nonexistent codename cannot log in
- [x] Empty codename cannot log in
- [x] Legitimate codename can log in
- [x] Returning user can view journalist replies - need to log into journalist interface to test

#### Journalist Interface

##### Login base cases
- [x] Can log in with 2FA tokens
- [x] incorrect password cannot log in
- [x] invalid 2fa token cannot log in
- [x] 2fa immediate reuse cannot log in

##### Index base cases
- [x] Filter by codename works
- [x] Starring and unstarring works
- [x] Click select all selects all submissions
- [x] Selecting all and clicking "Download" works

##### Individual source page
- [x] You can submit a reply and a flashed message and new row appears
- [x] You cannot submit an empty reply
- [x] Clicking "Delete Source And Submissions" and the source and docs are deleted
- [x] You can click on a document and successfully decrypt using application private key

### Basic Tails Testing

#### Updater GUI

After updating to this release candidate and running `securedrop-admin tailsconfig`

- [x] The Updater GUI appears on boot 
- [x] Updating occurs without issue **had to revert unstaged changes first**

### 0.13.0-specific changes

- [x] The message to sources that have been flagged for reply has been updated as implemented in [#4428](https://github.com/freedomofpress/securedrop/pull/4428). Verify this by changing line 201 in `/var/www/securedrop/source_app/main.py` from `if entropy_avail >= 2400:` to `if entropy_avail >= 2400 and False:`, restarting Apache, creating a source, flagging the source in the Journalist Interface, and logging back in as the source.
- [x] When a user attempts to log in twice on the source interface, the user is logged out, a single 500 error is returned, and the user can then log in, as per [#4391](https://github.com/securedrop/freedomofpress/securedrop/pull/4391). Verify this by opening a browser tab and visiting `/generate`, then opening a second tab and logging in or creating a new codename via `/create`, then returning to the first tab and attempting to log in.
- [x] The sha256 checksum of a given encrypted submission or reply is returned as the ETag header value in API download responses, as per [#4314](https://github.com/freedomofpress/securedrop/pull/4314):
    - [x] **Upgrade Only:** BEFORE upgrade, run the QA loader (https://docs.securedrop.org/en/release-0.12.2/development/database_migrations.html#release-testing-migrations) and also upload a few _very_ large files (~100 MB+). Following the postinst migration task, the `checksum` field in the `submissions` and `replies` tables is populated with the sha256 hash of the corresponding files. Verify this by checking the Application Servers sqlite database and comparing values. **n/a - clean install**
    - [x] After a submission has been uploaded and the `checksum` field has been asynchronously updated, the ETag header value in the response to an API request for a file contains the sha256 hash of the file. Verify this by comparing the ETag value of a response to the value in the database
    - [x] Immediately after a large submission has been uploaded, *before* the `checksum` field has been updated, the Etag header value in the response to an API request for a file contains the sha256 hash of the file. Verify this by comparing the ETag value of a response to the sha256 hash of the encrypted submission. **couldn't test - sha256sum takes ~2s for a 400MB file**

(API-specific):

- [x] API responses to `/api/v1/sources` include the GPG fingerprint for sources' reply keys in their respective `key` objects, as implemented in [#4436](https://github.com/freedomofpress/securedrop/pull/4436).
- [x] Calling `/api/v1/logout` invalidates the user's current authorization token, causing subsequent calls using the same token to fail, as implemented in [#4349](https://github.com/freedomofpress/securedrop/pull/4349).
- [x] After the time set in `TOKEN_EXPIRATION_MINS` in `securedrop/journalist_app/api.py`, an unused authorization token is invalidated, causing subsequent calls to fail, as implemented in [#4349](https://github.com/freedomofpress/securedrop/pull/4349). Verify this by setting `TOKEN_EXPIRATION_MINS` to a low value, restarting Apache, creating an auth token, and waiting for the timeout before using it in a call
- [x] API calls using the HTTP DELETE method to the `/api/v1/sources/$UUID` endpoint successfully delete the source with uuid `$UUID`, along with all related files, as implemented in [#4023](https://github.com/freedomofpress/securedrop/pull/4023).

### Preflight 

- [ ] Ensure the builder image is up-to-date on release day

These tests should be performed the day of release prior to live debian packages on apt.freedom.press

#### Basic testing

- [ ] Install or upgrade occurs without error
- [ ] Source interface is available and version string indicates it is 0.13.0
- [ ] A message can be successfully submitted 

#### Tails

- [ ] The updater GUI appears on boot
- [ ] The update successfully occurs to 0.13.0
- [ ] After reboot, updater GUI no longer appears

# QA plan

- NUC5s
- NUC7s
- Mac Minis
- 1U servers in SF


## 0.13.0 QA Checklist

For both upgrades and fresh installs, here is a list of functionality that requires testing. You can use this for copy/pasting into your QA report. Feel free to edit this message to update the plan as appropriate.

If you have submitted a QA report already for a 0.13.0 release candidate with successful basic server testing and application acceptance testing sections, then you can skip these sections in subsequent reports, unless otherwise indicated by the Release Manager. This is to ensure that you focus your QA effort on the 0.13.0-specific changes as well as changes since the previous release candidate.

**Note:** if you are testing an upgrade scenario, you should create several sources and submit a large number of files of varying sizes up to the 500MB limit before performing the upgrade. A large dataset is required in order to test the long-running database migration task implemented in [#4134](https://github.com/freedomofpress/securedrop/pull/4314).

### Environment

- Install target: Mac Mini
- Tails version: 3.14
- Test Scenario: upgrade from 0.12.2
- SSH over Tor: yes
- Release candidate: RC1
- General notes: 

### Basic Server Testing

- [x] I can access both the source and journalist interfaces
- [x] I can SSH into both machines over Tor
- [x] AppArmor is loaded on app
    - [x] 0 processes are running unconfined
- [x] AppArmor is loaded on mon
    - [x] 0 processes are running unconfined
- [x] Both servers are running grsec kernels
- [x] iptables rules loaded
- [x] OSSEC emails begin to flow after install
- [x] OSSEC emails are decrypted to correct key and I am able to decrypt them
- [x] [QA Matrix](https://docs.google.com/spreadsheets/d/1SFGDrsMAw6X-I4v6ZC7ZkmHl3eS9peh5xfuP-JtPOB8/edit#gid=0) checks pass

#### Command Line User Generation

- [x] Can successfully add admin user and login

#### Administration

- [x] I have backed up and successfully restored the app server following the documentation here: https://docs.securedrop.org/en/latest/backup_and_restore.html
- [ ] If doing upgrade testing, make a backup on 0.12.2 and restore this backup on 0.13.0 **skipped due to tester error**

### Application Acceptance Testing

#### Source Interface

##### Landing page base cases
- [x] JS warning bar does not appear when using Security Slider high
- [x] JS warning bar does appear when using Security Slider Low ([#4211](https://github.com/freedomofpress/securedrop/pull/4211))

##### First submission base cases
- [x] On generate page, refreshing codename produces a new 7-word codename
- [x] On submit page, empty submissions produce flashed message
- [x] On submit page, short message submitted successfully
- [x] On submit page, file greater than 500 MB produces "The connection was reset" in Tor Browser _quickly_ before the entire file is uploaded
- [x] On submit page, file less than 500 MB submitted successfully

##### Returning source base cases

- [x] Nonexistent codename cannot log in
- [x] Empty codename cannot log in
- [x] Legitimate codename can log in
- [x] Returning user can view journalist replies - need to log into journalist interface to test

#### Journalist Interface

##### Login base cases
- [x] Can log in with 2FA tokens
- [x] incorrect password cannot log in
- [x] invalid 2fa token cannot log in
- [x] 2fa immediate reuse cannot log in

##### Index base cases
- [x] Filter by codename works
- [x] Starring and unstarring works
- [x] Click select all selects all submissions
- [x] Selecting all and clicking "Download" works

##### Individual source page
- [x] You can submit a reply and a flashed message and new row appears
- [x] You cannot submit an empty reply
- [x] Clicking "Delete Source And Submissions" and the source and docs are deleted
- [x] You can click on a document and successfully decrypt using application private key

### Basic Tails Testing

#### Updater GUI

After updating to this release candidate and running `securedrop-admin tailsconfig`

- [x] The Updater GUI appears on boot 
- [x] Updating occurs without issue

### 0.13.0-specific changes

- [x] The message to sources that have been flagged for reply has been updated as implemented in [#4428](https://github.com/freedomofpress/securedrop/pull/4428). Verify this by changing line 201 in `/var/www/securedrop/source_app/main.py` from `if entropy_avail >= 2400:` to `if entropy_avail >= 2400 and False:`, restarting Apache, creating a source, flagging the source in the Journalist Interface, and logging back in as the source.
- [x] When a user attempts to log in twice on the source interface, the user is logged out and a 500 error is not returned, as per [#4391](https://github.com/securedrop/freedomofpress/securedrop/pull/4391). Verify this by opening a browser tab and visiting `/generate`, then opening a second tab and logging in or creating a new codename via `/create`, then returning to the first tab and attempting to log in.
- [x] The sha256 checksum of a given encrypted submission or reply is returned as the ETag header value in API download responses, as per [#4314](https://github.com/freedomofpress/securedrop/pull/4314):
    - [x] **Upgrade Only:** BEFORE upgrade, run the QA loader (https://docs.securedrop.org/en/release-0.12.2/development/database_migrations.html#release-testing-migrations) and also upload a few _very_ large files (~100 MB+). Following the postinst migration task, the `checksum` field in the `submissions` and `replies` tables is populated with the sha256 hash of the corresponding files. Verify this by checking the Application Servers sqlite database and comparing values. **ran cron-apt, rebooted, checked after a few mins - spot-checked values correct**
    - [x] After a submission has been uploaded and the `checksum` field has been asynchronously updated, the ETag header value in the response to an API request for a file contains the sha256 hash of the file. Verify this by comparing the ETag value of a response to the value in the database
    - [x] Immediately after a large submission has been uploaded, *before* the `checksum` field has been updated, the Etag header value in the response to an API request for a file contains the sha256 hash of the file. Verify this by comparing the ETag value of a response to the sha256 hash of the encrypted submission.

(API-specific):

- [x] API responses to `/api/v1/sources` include the GPG fingerprint for sources' reply keys in their respective `key` objects, as implemented in [#4436](https://github.com/freedomofpress/securedrop/pull/4436).
- [x] Calling `/api/v1/logout` invalidates the user's current authorization token, causing subsequent calls using the same token to fail, as implemented in [#4349](https://github.com/freedomofpress/securedrop/pull/4349).
- [x] After the time set in `TOKEN_EXPIRATION_MINS` in `securedrop/journalist_app/api.py`, an unused authorization token is invalidated, causing subsequent calls to fail, as implemented in [#4349](https://github.com/freedomofpress/securedrop/pull/4349). Verify this by setting `TOKEN_EXPIRATION_MINS` to a low value, restarting Apache, creating an auth token, and waiting for the timeout before using it in a call
- [x] API calls using the HTTP DELETE method to the `/api/v1/sources/$UUID` endpoint successfully delete the source with uuid `$UUID`, along with all related files, as implemented in [#4023](https://github.com/freedomofpress/securedrop/pull/4023). - **FAIL without playbook run, no changes in Apache config, passes otherwise**

### Preflight 

- [ ] Ensure the builder image is up-to-date on release day

These tests should be performed the day of release prior to live debian packages on apt.freedom.press

#### Basic testing

- [ ] Install or upgrade occurs without error
- [ ] Source interface is available and version string indicates it is 0.13.0
- [ ] A message can be successfully submitted 

#### Tails

- [ ] The updater GUI appears on boot
- [ ] The update successfully occurs to 0.13.0
- [ ] After reboot, updater GUI no longer appears

## Upgrade from 0.12.2 on NUC7

### Environment

- Install target: NUC7i5BNH
- Tails version: 3.14
- Test Scenario: cron-apt upgrade of 0.12.2 to 0.13.0
- SSH over Tor: only as needed for specific tests
- Release candidate: 0.13.0~rc1
- General notes:

### Basic Server Testing

- [x] I can access both the source and journalist interfaces
- [x] I can SSH into both machines over Tor
- [x] AppArmor is loaded on app
    - [x] 0 processes are running unconfined
- [x] AppArmor is loaded on mon
    - [x] 0 processes are running unconfined
- [x] Both servers are running grsec kernels
- [x] iptables rules loaded
- [x] OSSEC emails begin to flow after install
- [x] OSSEC emails are decrypted to correct key and I am able to decrypt them
- [x] [QA Matrix](https://docs.google.com/spreadsheets/d/1SFGDrsMAw6X-I4v6ZC7ZkmHl3eS9peh5xfuP-JtPOB8/edit#gid=0) checks pass

#### Command Line User Generation

- [x] Can successfully add admin user and login

#### Administration

- [x] I have backed up and successfully restored the app server following the documentation here: https://docs.securedrop.org/en/latest/backup_and_restore.html
- [x] If doing upgrade testing, make a backup on 0.12.2 and restore this backup on 0.13.0

### Application Acceptance Testing

#### Source Interface

##### Landing page base cases
- [x] JS warning bar does not appear when using Security Slider high
- [x] JS warning bar does appear when using Security Slider Low ([#4211](https://github.com/freedomofpress/securedrop/pull/4211))

##### First submission base cases
- [x] On generate page, refreshing codename produces a new 7-word codename
- [x] On submit page, empty submissions produce flashed message
- [x] On submit page, short message submitted successfully
- [x] On submit page, file greater than 500 MB produces "The connection was reset" in Tor Browser _quickly_ before the entire file is uploaded
- [x] On submit page, file less than 500 MB submitted successfully

##### Returning source base cases

- [x] Nonexistent codename cannot log in
- [x] Empty codename cannot log in
- [x] Legitimate codename can log in
- [x] Returning user can view journalist replies - need to log into journalist interface to test

#### Journalist Interface

##### Login base cases
- [x] Can log in with 2FA tokens
- [x] incorrect password cannot log in
- [x] invalid 2fa token cannot log in
- [x] 2fa immediate reuse cannot log in

##### Index base cases
- [x] Filter by codename works
- [x] Starring and unstarring works
- [x] Click select all selects all submissions
- [x] Selecting all and clicking "Download" works

##### Individual source page
- [x] You can submit a reply and a flashed message and new row appears
- [x] You cannot submit an empty reply
- [x] Clicking "Delete Source And Submissions" and the source and docs are deleted
- [x] You can click on a document and successfully decrypt using application private key

### Basic Tails Testing

#### Updater GUI

After updating to this release candidate and running `securedrop-admin tailsconfig`

- [x] The Updater GUI appears on boot
- [x] Updating occurs without issue

### 0.13.0-specific changes

- [x] The message to sources that have been flagged for reply has been updated as implemented in [#4428](https://github.com/freedomofpress/securedrop/pull/4428). Verify this by changing line 201 in `/var/www/securedrop/source_app/main.py` from `if entropy_avail >= 2400:` to `if entropy_avail >= 2400 and False:`, restarting Apache, creating a source, flagging the source in the Journalist Interface, and logging back in as the source.
- [x] When a user attempts to log in twice on the source interface, the user is logged out and a 500 error is not returned, as per [#4391](https://github.com/freedomofpress/securedrop/pull/4391). Verify this by opening a browser tab and visiting `/generate`, then opening a second tab and logging in or creating a new codename via `/create`, then returning to the first tab and attempting to log in.
- [x] The sha256 checksum of a given encrypted submission or reply is returned as the ETag header value in API download responses, as per [#4314](https://github.com/freedomofpress/securedrop/pull/4314):
    - [x] **Upgrade Only:** BEFORE upgrade, run the QA loader (https://docs.securedrop.org/en/release-0.12.2/development/database_migrations.html#release-testing-migrations) and also upload a few _very_ large files (~100 MB+). Following the postinst migration task, the `checksum` field in the `submissions` and `replies` tables is populated with the sha256 hash of the corresponding files. Verify this by checking the Application Servers sqlite database and comparing values.
    - [x] After a submission has been uploaded and the `checksum` field has been asynchronously updated, the ETag header value in the response to an API request for a file contains the sha256 hash of the file. Verify this by comparing the ETag value of a response to the value in the database
    - [x] Immediately after a large submission has been uploaded, *before* the `checksum` field has been updated, the Etag header value in the response to an API request for a file contains the sha256 hash of the file. Verify this by comparing the ETag value of a response to the sha256 hash of the encrypted submission.

(API-specific):

- [x] API responses to `/api/v1/sources` include the GPG fingerprint for sources' reply keys in their respective `key` objects, as implemented in [#4436](https://github.com/freedomofpress/securedrop/pull/4436).
- [x] Calling `/api/v1/logout` invalidates the user's current authorization token, causing subsequent calls using the same token to fail, as implemented in [#4349](https://github.com/freedomofpress/securedrop/pull/4349).
- [x] After the time set in `TOKEN_EXPIRATION_MINS` in `securedrop/journalist_app/api.py`, an unused authorization token is invalidated, causing subsequent calls to fail, as implemented in [#4349](https://github.com/freedomofpress/securedrop/pull/4349). Verify this by setting `TOKEN_EXPIRATION_MINS` to a low value, restarting Apache, creating an auth token, and waiting for the timeout before using it in a call
- [x] API calls using the HTTP DELETE method to the `/api/v1/sources/$UUID` endpoint successfully delete the source with uuid `$UUID`, along with all related files, as implemented in [#4023](https://github.com/freedomofpress/securedrop/pull/4023).

## Upgrade from 0.12.2 on NUC5PYH (Completed)

### Environment

- Install target: NUC5
- Tails version: 3.14
- Test Scenario: 0.12.2 -> 0.13.0
- SSH over Tor: Yes
- Release candidate: RC1
- General notes:

### Basic Server Testing

- [x] I can access both the source and journalist interfaces
- [x] I can SSH into both machines over Tor
- [x] AppArmor is loaded on app
    - [x] 0 processes are running unconfined
- [x] AppArmor is loaded on mon
    - [x] 0 processes are running unconfined
- [x] Both servers are running grsec kernels
- [x] iptables rules loaded
- [x] OSSEC emails begin to flow after install
- [x] OSSEC emails are decrypted to correct key and I am able to decrypt them
- [x] [QA Matrix](https://docs.google.com/spreadsheets/d/1SFGDrsMAw6X-I4v6ZC7ZkmHl3eS9peh5xfuP-JtPOB8/edit#gid=0) checks pass

#### Command Line User Generation

- [x] Can successfully add admin user and login

#### Administration

- [x] I have backed up and successfully restored the app server following the documentation here: https://docs.securedrop.org/en/latest/backup_and_restore.html
- [x] If doing upgrade testing, make a backup on 0.12.2 and restore this backup on 0.13.0

### Application Acceptance Testing

#### Source Interface

##### Landing page base cases
- [x] JS warning bar does not appear when using Security Slider high
- [x] JS warning bar does appear when using Security Slider Low ([#4211](https://github.com/freedomofpress/securedrop/pull/4211))

##### First submission base cases
- [x] On generate page, refreshing codename produces a new 7-word codename
- [x] On submit page, empty submissions produce flashed message
- [x] On submit page, short message submitted successfully
- [x] On submit page, file greater than 500 MB produces "The connection was reset" in Tor Browser _quickly_ before the entire file is uploaded
- [x] On submit page, file less than 500 MB submitted successfully

##### Returning source base cases

- [x] Nonexistent codename cannot log in
- [x] Empty codename cannot log in
- [x] Legitimate codename can log in
- [x] Returning user can view journalist replies - need to log into journalist interface to test

#### Journalist Interface

##### Login base cases
- [x] Can log in with 2FA tokens
- [x] incorrect password cannot log in
- [x] invalid 2fa token cannot log in
- [x] 2fa immediate reuse cannot log in

##### Index base cases
- [x] Filter by codename works
- [x] Starring and unstarring works
- [x] Click select all selects all submissions
- [x] Selecting all and clicking "Download" works

##### Individual source page
- [x] You can submit a reply and a flashed message and new row appears
- [x] You cannot submit an empty reply
- [x] Clicking "Delete Source And Submissions" and the source and docs are deleted
- [x] You can click on a document and successfully decrypt using application private key

### Basic Tails Testing

#### Updater GUI (DID NOT TEST)

After updating to this release candidate and running `securedrop-admin tailsconfig`

- [ ] The Updater GUI appears on boot 
- [ ] Updating occurs without issue

### 0.13.0-specific changes

- [x] The message to sources that have been flagged for reply has been updated as implemented in [#4428](https://github.com/freedomofpress/securedrop/pull/4428). Verify this by changing line 201 in `/var/www/securedrop/source_app/main.py` from `if entropy_avail >= 2400:` to `if entropy_avail >= 2400 and False:`, restarting Apache, creating a source, flagging the source in the Journalist Interface, and logging back in as the source.
- [x] When a user attempts to log in twice on the source interface, a single 500 error is returned and the user is logged out, as per [#4391](https://github.com/securedrop/freedomofpress/securedrop/pull/4391). Verify this by opening a browser tab and visiting `/generate`, then opening a second tab and logging in or creating a new codename via `/create`, then returning to the first tab and attempting to log in.
- [x]  The sha256 checksum of a given encrypted submission or reply is returned as the ETag header value in API download responses, as per [#4314](https://github.com/freedomofpress/securedrop/pull/4314):

    - [x] **Upgrade Only:** BEFORE upgrade, run the QA loader (https://docs.securedrop.org/en/release-0.12.2/development/database_migrations.html#release-testing-migrations) and also upload a few _very_ large files (~100 MB+). Following the postinst migration task, the `checksum` field in the `submissions` and `replies` tables is populated with the sha256 hash of the corresponding files. Verify this by checking the Application Servers sqlite database and comparing values. 
* NOTE: :man_facepalming: forgot to run the migration before upgrading. I did have 2 files in the database, and they were hashes successfully.

    - [x] After a submission has been uploaded and the `checksum` field has been asynchronously updated, the ETag header value in the response to an API request for a file contains the sha256 hash of the file. Verify this by comparing the ETag value of a response to the value in the database
    - [ ] Immediately after a large submission has been uploaded, *before* the `checksum` field has been updated, the Etag header value in the response to an API request for a file contains the sha256 hash of the file. Verify this by comparing the ETag value of a response to the sha256 hash of the encrypted submission.

(API-specific):

- [x] API responses to `/api/v1/sources` include the GPG fingerprint for sources' reply keys in their respective `key` objects, as implemented in [#4436](https://github.com/freedomofpress/securedrop/pull/4436).
- [x] Calling `/api/v1/logout` invalidates the user's current authorization token, causing subsequent calls using the same token to fail, as implemented in [#4349](https://github.com/freedomofpress/securedrop/pull/4349).
- [x] After the time set in `TOKEN_EXPIRATION_MINS` in `securedrop/journalist_app/api.py`, an unused authorization token is invalidated, causing subsequent calls to fail, as implemented in [#4349](https://github.com/freedomofpress/securedrop/pull/4349). Verify this by setting `TOKEN_EXPIRATION_MINS` to a low value, restarting Apache, creating an auth token, and waiting for the timeout before using it in a call
- [x] API calls using the HTTP DELETE method to the `/api/v1/sources/$UUID` endpoint successfully delete the source with uuid `$UUID`, along with all related files, as implemented in [#4023](https://github.com/freedomofpress/securedrop/pull/4023).
* requires an ansible run to update Apache config
* Unfortunately the error message is not great, because the error handers on the application side do not return 405 like other methods (for obvious reasons)
# QA plan

- NUC5s
- NUC7s
- Mac Minis
- 1U servers in SF


## 0.13.0 QA Checklist

For both upgrades and fresh installs, here is a list of functionality that requires testing. You can use this for copy/pasting into your QA report. Feel free to edit this message to update the plan as appropriate.

If you have submitted a QA report already for a 0.13.0 release candidate with successful basic server testing and application acceptance testing sections, then you can skip these sections in subsequent reports, unless otherwise indicated by the Release Manager. This is to ensure that you focus your QA effort on the 0.13.0-specific changes as well as changes since the previous release candidate.

**Note:** if you are testing an upgrade scenario, you should create several sources and submit a large number of files of varying sizes up to the 500MB limit before performing the upgrade. A large dataset is required in order to test the long-running database migration task implemented in [#4134](https://github.com/freedomofpress/securedrop/pull/4314).

### Environment

- Install target: SF 1U servers
- Tails version: 3.14
- Test Scenario: upgrade
- SSH over Tor: yes
- Release candidate: RC1
- General notes:

### Basic Server Testing

- [x] I can access both the source and journalist interfaces
- [x] I can SSH into both machines over Tor
- [x] AppArmor is loaded on app
    - [x] 0 processes are running unconfined
- [x] AppArmor is loaded on mon
    - [x] 0 processes are running unconfined
- [x] Both servers are running grsec kernels
- [x] iptables rules loaded
- [x] OSSEC emails begin to flow after install **no access to email but alerts triggered**
- [ ] OSSEC emails are decrypted to correct key and I am able to decrypt them **no access to check**
- [x] [QA Matrix](https://docs.google.com/spreadsheets/d/1SFGDrsMAw6X-I4v6ZC7ZkmHl3eS9peh5xfuP-JtPOB8/edit#gid=0) checks pass

#### Command Line User Generation

- [x] Can successfully add admin user and login

#### Administration

- [x] I have backed up and successfully restored the app server following the documentation here: https://docs.securedrop.org/en/latest/backup_and_restore.html
- [ ] If doing upgrade testing, make a backup on 0.12.2 and restore this backup on 0.13.0 **not tested - servers were updated to 0.13.0~rc1 automatically**

### Application Acceptance Testing

#### Source Interface

##### Landing page base cases
- [x] JS warning bar does not appear when using Security Slider high
- [x] JS warning bar does appear when using Security Slider Low ([#4211](https://github.com/freedomofpress/securedrop/pull/4211))

##### First submission base cases
- [x] On generate page, refreshing codename produces a new 7-word codename
- [x] On submit page, empty submissions produce flashed message
- [x] On submit page, short message submitted successfully
- [x] On submit page, file greater than 500 MB produces "The connection was reset" in Tor Browser _quickly_ before the entire file is uploaded
- [x] On submit page, file less than 500 MB submitted successfully

##### Returning source base cases

- [x] Nonexistent codename cannot log in
- [x] Empty codename cannot log in
- [x] Legitimate codename can log in
- [x] Returning user can view journalist replies - need to log into journalist interface to test

#### Journalist Interface

##### Login base cases
- [x] Can log in with 2FA tokens
- [x] incorrect password cannot log in
- [x] invalid 2fa token cannot log in
- [x] 2fa immediate reuse cannot log in

##### Index base cases
- [x] Filter by codename works
- [x] Starring and unstarring works
- [x] Click select all selects all submissions
- [x] Selecting all and clicking "Download" works

##### Individual source page
- [x] You can submit a reply and a flashed message and new row appears
- [x] You cannot submit an empty reply
- [x] Clicking "Delete Source And Submissions" and the source and docs are deleted
- [ ] You can click on a document and successfully decrypt using application private key **don't have SVS key to check**

### Basic Tails Testing

#### Updater GUI

After updating to this release candidate and running `securedrop-admin tailsconfig`

- [x] The Updater GUI appears on boot 
- [x] Updating occurs without issue

### 0.13.0-specific changes

- [x] The message to sources that have been flagged for reply has been updated as implemented in [#4428](https://github.com/freedomofpress/securedrop/pull/4428). Verify this by changing line 201 in `/var/www/securedrop/source_app/main.py` from `if entropy_avail >= 2400:` to `if entropy_avail >= 2400 and False:`, restarting Apache, creating a source, flagging the source in the Journalist Interface, and logging back in as the source.
- [x] When a user attempts to log in twice on the source interface, the user is logged out and a 500 error is not returned, as per [#4391](https://github.com/securedrop/freedomofpress/securedrop/pull/4391). Verify this by opening a browser tab and visiting `/generate`, then opening a second tab and logging in or creating a new codename via `/create`, then returning to the first tab and attempting to log in.
- [x] The sha256 checksum of a given encrypted submission or reply is returned as the ETag header value in API download responses, as per [#4314](https://github.com/freedomofpress/securedrop/pull/4314):
    - [x] **Upgrade Only:** BEFORE upgrade, run the QA loader (https://docs.securedrop.org/en/release-0.12.2/development/database_migrations.html#release-testing-migrations) and also upload a few _very_ large files (~100 MB+). Following the postinst migration task, the `checksum` field in the `submissions` and `replies` tables is populated with the sha256 hash of the corresponding files. Verify this by checking the Application Servers sqlite database and comparing values.
    - [x] After a submission has been uploaded and the `checksum` field has been asynchronously updated, the ETag header value in the response to an API request for a file contains the sha256 hash of the file. Verify this by comparing the ETag value of a response to the value in the database
    - [x] Immediately after a large submission has been uploaded, *before* the `checksum` field has been updated, the Etag header value in the response to an API request for a file contains the sha256 hash of the file. Verify this by setting the `checksum` field to `null` for a submission in the database, then comparing the ETag value of a response to the sha256 hash of the encrypted submission.

(API-specific):

- [x] API responses to `/api/v1/sources` include the GPG fingerprint for sources' reply keys in their respective `key` objects, as implemented in [#4436](https://github.com/freedomofpress/securedrop/pull/4436).
- [x] Calling `/api/v1/logout` invalidates the user's current authorization token, causing subsequent calls using the same token to fail, as implemented in [#4349](https://github.com/freedomofpress/securedrop/pull/4349).
- [x] After the time set in `TOKEN_EXPIRATION_MINS` in `securedrop/journalist_app/api.py`, an unused authorization token is invalidated, causing subsequent calls to fail, as implemented in [#4349](https://github.com/freedomofpress/securedrop/pull/4349). Verify this by setting `TOKEN_EXPIRATION_MINS` to a low value, restarting Apache, creating an auth token, and waiting for the timeout before using it in a call
- [x] API calls using the HTTP DELETE method to the `/api/v1/sources/$UUID` endpoint successfully delete the source with uuid `$UUID`, along with all related files, as implemented in [#4023](https://github.com/freedomofpress/securedrop/pull/4023).

### Preflight 

- [ ] Ensure the builder image is up-to-date on release day

These tests should be performed the day of release prior to live debian packages on apt.freedom.press

#### Basic testing

- [ ] Install or upgrade occurs without error
- [ ] Source interface is available and version string indicates it is 0.13.0
- [ ] A message can be successfully submitted 

#### Tails

- [ ] The updater GUI appears on boot
- [ ] The update successfully occurs to 0.13.0
- [ ] After reboot, updater GUI no longer appears

## Clean install in VMs (In progress)
### Environment

- Install target: Xenial Vagrant VMs
- Tails version: 3.14
- Test Scenario: Clean install
- SSH over Tor: Yes
- Release candidate: RC1
- General notes:

### Basic Server Testing

- [x] I can access both the source and journalist interfaces
- [x] I can SSH into both machines over Tor
- [x] AppArmor is loaded on app
    - [x] 0 processes are running unconfined
- [x] AppArmor is loaded on mon
    - [x] 0 processes are running unconfined
- [x] Both servers are running grsec kernels
- [x] iptables rules loaded
- [x] OSSEC emails begin to flow after install
- [x] OSSEC emails are decrypted to correct key and I am able to decrypt them
- [ ] [QA Matrix](https://docs.google.com/spreadsheets/d/1SFGDrsMAw6X-I4v6ZC7ZkmHl3eS9peh5xfuP-JtPOB8/edit#gid=0) checks pass

#### Command Line User Generation

- [ ] Can successfully add admin user and login

#### Administration

- [ ] I have backed up and successfully restored the app server following the documentation here: https://docs.securedrop.org/en/latest/backup_and_restore.html
- [ ] If doing upgrade testing, make a backup on 0.12.2 and restore this backup on 0.13.0
- [ ] "Send Test OSSEC Alert" button in the journalist triggers an OSSEC alert and an email is sent.

### Application Acceptance Testing

#### Source Interface

##### Landing page base cases
- [ ] JS warning bar does not appear when using Security Slider high
- [ ] JS warning bar does appear when using Security Slider Low ([#4211](https://github.com/freedomofpress/securedrop/pull/4211))

##### First submission base cases
- [ ] On generate page, refreshing codename produces a new 7-word codename
- [ ] On submit page, empty submissions produce flashed message
- [ ] On submit page, short message submitted successfully
- [ ] On submit page, file greater than 500 MB produces "The connection was reset" in Tor Browser _quickly_ before the entire file is uploaded
- [ ] On submit page, file less than 500 MB submitted successfully

##### Returning source base cases

- [ ] Nonexistent codename cannot log in
- [ ] Empty codename cannot log in
- [ ] Legitimate codename can log in
- [ ] Returning user can view journalist replies - need to log into journalist interface to test

#### Journalist Interface

##### Login base cases
- [ ] Can log in with 2FA tokens
- [ ] incorrect password cannot log in
- [ ] invalid 2fa token cannot log in
- [ ] 2fa immediate reuse cannot log in

##### Index base cases
- [ ] Filter by codename works
- [ ] Starring and unstarring works
- [ ] Click select all selects all submissions
- [ ] Selecting all and clicking "Download" works

##### Individual source page
- [ ] You can submit a reply and a flashed message and new row appears
- [ ] You cannot submit an empty reply
- [ ] Clicking "Delete Source And Submissions" and the source and docs are deleted
- [ ] You can click on a document and successfully decrypt using application private key

### Basic Tails Testing

#### Updater GUI

After updating to this release candidate and running `securedrop-admin tailsconfig`

- [ ] The Updater GUI appears on boot 
- [ ] Updating occurs without issue

### 0.13.0-specific changes

- [ ] The message to sources that have been flagged for reply has been updated as implemented in [#4428](https://github.com/freedomofpress/securedrop/pull/4428). Verify this by changing line 201 in `/var/www/securedrop/source_app/main.py` from `if entropy_avail >= 2400:` to `if entropy_avail >= 2400 and False:`, restarting Apache, creating a source, flagging the source in the Journalist Interface, and logging back in as the source.
- [ ] When a user attempts to log in twice on the source interface, a single 500 error is returned and the user is logged out, as per [#4391](https://github.com/freedomofpress/securedrop/pull/4391). Verify this by opening a browser tab and visiting `/generate`, then opening a second tab and logging in or creating a new codename via `/create`, then returning to the first tab and attempting to log in.
- [ ] The sha256 checksum of a given encrypted submission or reply is returned as the ETag header value in API download responses, as per [#4314](https://github.com/freedomofpress/securedrop/pull/4314):
    - [ ] **Upgrade Only:** BEFORE upgrade, run the QA loader (https://docs.securedrop.org/en/release-0.12.2/development/database_migrations.html#release-testing-migrations) and also upload a few _very_ large files (~100 MB+). Following the postinst migration task, the `checksum` field in the `submissions` and `replies` tables is populated with the sha256 hash of the corresponding files. Verify this by checking the Application Servers sqlite database and comparing values.
    - [ ] After a submission has been uploaded and the `checksum` field has been asynchronously updated, the ETag header value in the response to an API request for a file contains the sha256 hash of the file. Verify this by comparing the ETag value of a response to the value in the database
    - [ ] After a submission has been uploaded, but before the `checksum` field has been asynchronously updated, the ETag header value in the response to an API request for a file contains the sha256 hash of the file. Verify this by setting the `checksum` field of a submission to `null` in the database, then dowloading via the API comparing the ETag value of a response to the value in the database after the download.

(API-specific):

- [ ] API responses to `/api/v1/sources` include the GPG fingerprint for sources' reply keys in their respective `key` objects, as implemented in [#4436](https://github.com/freedomofpress/securedrop/pull/4436).
- [ ] Calling `/api/v1/logout` invalidates the user's current authorization token, causing subsequent calls using the same token to fail, as implemented in [#4349](https://github.com/freedomofpress/securedrop/pull/4349).
- [ ] After the time set in `TOKEN_EXPIRATION_MINS` in `securedrop/journalist_app/api.py`, an unused authorization token is invalidated, causing subsequent calls to fail, as implemented in [#4349](https://github.com/freedomofpress/securedrop/pull/4349). Verify this by setting `TOKEN_EXPIRATION_MINS` to a low value, restarting Apache, creating an auth token, and waiting for the timeout before using it in a call
- [ ] API calls using the HTTP DELETE method to the `/api/v1/sources/$UUID` endpoint successfully delete the source with uuid `$UUID`, along with all related files, as implemented in [#4023](https://github.com/freedomofpress/securedrop/pull/4023).
Draft release messaging here:
https://docs.google.com/document/d/1C9KaHslvGxk_3bjV0jgqj-MUQ6t6EVpJEWUaTNPGzZk/edit#

Compared with pre-release messaging, mainly tense changes, pointer to workstation upgrade docs, and the new acknowledgments section.

Resolving patch:
diff --git a/docs/conf.py b/docs/conf.py
--- a/docs/conf.py
+++ b/docs/conf.py
@@ -57,9 +57,9 @@
 # built documents.
 #
 # The short X.Y version.
-version = '0.12.2'
+version = '0.13.0'
 # The full version, including alpha/beta/rc tags.
-release = '0.12.2'
+release = '0.13.0'
 
 # The language for content autogenerated by Sphinx. Refer to documentation
 # for a list of supported languages.
diff --git a/securedrop/version.py b/securedrop/version.py
--- a/securedrop/version.py
+++ b/securedrop/version.py
@@ -1 +1 @@
-__version__ = '0.13.0~rc1'
+__version__ = '0.13.0'


Test patch:
diff --git a/molecule/builder-xenial/tests/vars.yml b/molecule/builder-xenial/tests/vars.yml
--- a/molecule/builder-xenial/tests/vars.yml
+++ b/molecule/builder-xenial/tests/vars.yml
@@ -1,5 +1,5 @@
 ---
-securedrop_version: "0.13.0~rc1"
+securedrop_version: "0.13.0"
 ossec_version: "3.0.0"
 keyring_version: "0.1.2"
 config_version: "0.1.3"