Repository: freedomofpress/securedrop

Issue:
Release SecureDrop 1.8.1
This is a tracking issue for the release of SecureDrop 1.8.1. This minor release will provide improvements to the restore functionality, and update OSSEC rules to support the transition to Ubuntu 20.04 Focal.

Tentatively scheduled as follows:

**String and feature freeze:** 2021-04-07
**Pre-release announcement:** 2021-04-08
**Release date:** 2021-04-14

**Release manager:** @kushaldas  
**Deputy release manager:** @emkll 
**Communications manager:**: @eloquence / @emkll 

_SecureDrop maintainers and testers:_ As you QA 1.8.1, please report back your testing results as comments on this ticket. File GitHub issues for any problems found, tag them "QA: Release", and associate them with the [1.8.1 milestone](https://github.com/freedomofpress/securedrop/milestone/71) for tracking (or ask a maintainer to do so).

Test debian packages will be posted on https://apt-test.freedom.press signed with [the test key](https://gist.githubusercontent.com/conorsch/ec4008b111bc3142fca522693f3cce7e/raw/2968621e8ad92db4505a31fcc5776422d7d26729/apt-test%2520apt%2520pubkey). An Ansible playbook testing the upgrade path is [here](https://gist.github.com/rmol/eb605e28e290e90f45347f3a2f1ad43e).

# [QA Matrix for 1.8.1](https://docs.google.com/spreadsheets/d/1JZZ6kozgfFSkMV2XWjajWoLDmABjnzUsmbMCOhUaAAg/edit?usp=sharing)
# [Test Plan for 1.8.1](https://github.com/freedomofpress/securedrop/wiki/1.8.1-Test-Plan)


# Prepare release candidate (1.8.1~rc1)
- [x] Cherry-pick changes to release/1.8.0 branch @zenmonkeykstop  https://github.com/freedomofpress/securedrop/pull/5890
- [ ] Link to latest version of Tails, including release candidates, to test against during QA
- [x] Prepare 1.8.1~rc1 release changelog
- [x] Prepare 1.8.1~rc1 Tag https://github.com/freedomofpress/securedrop/tree/1.8.1-rc1
- [x] Build debs and put up `1.8.1~rc1` on test apt server: https://github.com/freedomofpress/securedrop-dev-packages-lfs/pull/102
- [x] Commit build logs to https://github.com/freedomofpress/build-logs/commit/639b9f5d2c0aea1b03415ee1724d1f602ac017ed

# Final release
- [x] Ensure builder in release branch is updated and/or update builder image
- [x] Push signed tag https://github.com/freedomofpress/securedrop/releases/tag/1.8.1
- [x] Pre-Flight: Test updater logic in Tails (apt-qa tracks the `release` branch in the LFS repo)
- [x] Build final Debian packages for 1.8.0 (and preserve build logs)
- [x] Commit package build logs to https://github.com/freedomofpress/build-logs/commit/03a90fa69bbb8256cbb034675b09ddd60e17f25c
- [x] Upload Debian packages to apt-qa server 
- [x] Pre-Flight: Test that install and upgrade from 1.8.0 to 1.8.1 works w/ prod repo debs (apt-qa.freedom.press polls the `release` branch in the LFS repo for the debs)
- [x] Flip apt QA server to prod status (merge to `main` in the LFS repo)
- [x] Merge Docs branch changes to ``main`` and verify new docs build in securedrop-docs repo
- [x] Prepare release messaging

# Post release
- [x] Create GitHub release object https://github.com/freedomofpress/securedrop/releases/tag/1.8.0
- [x] Once release object is created, update versions in `securedrop-docs` and Wagtail
- [x] Build readthedocs and verify new docs show up on https://docs.securedrop.org
- [x] Publish announcements
- [ ] Merge changelog, https://github.com/freedomofpress/securedrop/pull/5899, and https://github.com/freedomofpress/securedrop/pull/5894/ back to `develop`
- [ ] Update upgrade testing boxes (might not be possible due to https://github.com/freedomofpress/securedrop/issues/5883)
- [x] Update roadmap wiki page: https://github.com/freedomofpress/securedrop/wiki/Development-Roadmap



Discussion:

Resolving patch:
diff --git a/install_files/ansible-base/roles/restore/files/disable_v2.py b/install_files/ansible-base/roles/restore/files/disable_v2.py
deleted file mode 100644
--- a/install_files/ansible-base/roles/restore/files/disable_v2.py
+++ /dev/null
@@ -1,89 +0,0 @@
-#!/usr/bin/env python3
-# To execute on prod:
-# python3 disable_v2.py /etc/tor/torrc /etc/tor/torrc
-# To execute for testing locally:
-# python3 disable_v2.py /etc/tor/torrc /tmp/dumytorrc
-import sys
-
-
-def filter_v2(filename):
-    # Read the file
-    with open(filename) as f:
-        data = f.readlines()
-    # We will store the filtered lines to result
-    result = []
-
-    i = 0
-    while i < len(data):
-        line = data[i]
-        if line == "HiddenServiceDir /var/lib/tor/services/source\n":
-            i += 1
-            while data[i].strip() == "":
-                i += 1
-            line = data[i]
-            if line == "HiddenServiceVersion 2\n":
-                i += 1
-                line = data[i]
-                while data[i].strip() == "":
-                    i += 1
-                line = data[i]
-                if line == "HiddenServicePort 80 127.0.0.1:80\n":
-                    i += 1
-                    continue
-        # Now check for journalist
-        if line == "HiddenServiceDir /var/lib/tor/services/journalist\n":
-            i += 1
-            while data[i].strip() == "":
-                i += 1
-            line = data[i]
-            if line == "HiddenServiceVersion 2\n":
-                i += 1
-                line = data[i]
-                while data[i].strip() == "":
-                    i += 1
-                line = data[i]
-                if line == "HiddenServicePort 80 127.0.0.1:8080\n":
-                    i += 1
-                    line = data[i]
-                    while data[i].strip() == "":
-                        i += 1
-                    line = data[i]
-                    if line == "HiddenServiceAuthorizeClient stealth journalist\n":
-                        i += 1
-                        continue
-        # Now the v2 ssh access
-        if line == "HiddenServiceDir /var/lib/tor/services/ssh\n":
-            i += 1
-            while data[i].strip() == "":
-                i += 1
-            line = data[i]
-            if line == "HiddenServiceVersion 2\n":
-                i += 1
-                line = data[i]
-                while data[i].strip() == "":
-                    i += 1
-                line = data[i]
-                if line == "HiddenServicePort 22 127.0.0.1:22\n":
-                    i += 1
-                    line = data[i]
-                    while data[i].strip() == "":
-                        i += 1
-                    line = data[i]
-                    if line == "HiddenServiceAuthorizeClient stealth admin\n":
-                        i += 1
-                        continue
-
-        result.append(line)
-        i += 1
-
-    # Now return the result
-    return result
-
-
-if __name__ == "__main__":
-    filename = sys.argv[1]
-    outputfilename = sys.argv[2]
-    result = filter_v2(filename)
-    with open(outputfilename, "w") as fobj:
-        for line in result:
-            fobj.write(line)


Test patch: