Prod keyring install #7
Conversation
Make it easier to set up configs for various environment types without duplicating code.
Follow the production production installation instructions at https://github.com/freedomofpress/securedrop-workstation-docs/blob/366c9c4663773556d5d75a5acd069f62e9124042/docs/admin/install/install.rst#download-securedrop-workstation-packages
Install dev by default but allow overriding via OpenQA test variables.
A test failed in the dev environment due to what looks like the securedrop-workstation-keyring key not yet being imported at the time of running "qubes-dom0-update securedrop-workstation-dom0-config" inside of "make dev".
No longer needed. See freedomofpress/securedrop-workstation-docs#352
|
I think this one is ready for review in a future sprint. I need to check on the OpenQA status. |
deeplow
force-pushed
the
prod-keyring-install
branch
from
d724327 to
e645c66
Compare
Controls the type of environment that is set up, enabling configuring various kinds of deployments for 'dev', 'staging' and 'prod'.
deeplow
force-pushed
the
prod-keyring-install
branch
from
c33819e to
c32538a
Compare
Adds an option to do the final testing prior to a release
Removes the 'defaults to dev' behavior and require that SECUREDROP_ENV is explicitly stated. It also adds validation to ensure a typo in that setting fails immediately.
deeplow
force-pushed
the
prod-keyring-install
branch
from
c32538a to
27bf324
Compare
Implements a change in the OpenQA securedrop jobs [1], which forces explicitly setting an OpenQA variable with the expected environment. The goal of making this explicit is to make it clear that this is dev environment and not something else. [1]: freedomofpress/openqa-tests-qubesos#7
|
Thanks for offering to review :) I've assigned you as an assignee, in the interest of being able to track the assignment temporarily, if that works for you. Could have been some permissions issue with this repo specifically (it was forked quite recently). I'd happy to guide you through all of this OpenQA stuff :) Maybe could use this one as part of the OpenQA onboarding session. In terms of viewering "CI" results of this branch, we unfortunately don't yet have OpenQA tests run automatically on them. (part of the problem is because we have this as a fork and every now and then need to push some changes to upstream). Currently I start them manually. This passing test is the result of running from this branch. |
|
Moving this back to "in progress" as I've noticed this has a mistake in how it's building the RPM (it diverges from dev instructions). |
The previous set up diverged a bit from the docs at dev.securedrop.org:
- it downloaded a repo via github's zip instead of 'make clone'
- it installed the bootstrap RPM which may no longer be necessary (at
least on the OpenQA side of things)
This PR addresses this limitations by using 'make clone' in 'dev'
environment, but while still downloading the repo for the makefile to
still be available in other environments.
deeplow
force-pushed
the
prod-keyring-install
branch
from
364ddd1 to
e4fc057
Compare
|
I've started a A job over with |
Yes, please! There's a lot to unpack here. In terms of the PR diff, lgtm, but I'd appreciate the opportunity to talk through the module structure with you to understand the OpenQA setup holistically. |
Implements a change in the OpenQA securedrop jobs [1], which forces explicitly setting an OpenQA variable with the expected environment. The goal of making this explicit is to make it clear that this is dev environment and not something else. [1]: freedomofpress/openqa-tests-qubesos#7
The 'staging' development environment via its make target [1] is already equipped with setting up the appropriate 'staging' keyring. In turn this staging keyring gives access to the staging version of keyring. with the inclusion of the keyring installation in 'make install-rpm' [2], this step in OpenQA's side is no longer necessary. [1]: https://github.com/freedomofpress/securedrop-workstation/pull/1500/files#diff-76ed074a9305c04054cdebb9e9aad2d818052b07091de1f20cad0bbac34ffb52R32-R33 [2]: https://github.com/freedomofpress/securedrop-workstation/pull/1500/files#diff-76ed074a9305c04054cdebb9e9aad2d818052b07091de1f20cad0bbac34ffb52R59-R61
|
I have sneaked in one more commit. It was tested here on a practically identical set up. But I don't mind running again directly from this branch, just to confirm this is still green. |
Fixes freedomofpress/securedrop-workstation#1459
Enables the parameterization of bootstrapping to enable setting up prod and staging as well. One must explicitly state the SECUREDROP_ENV openqa variable. The options are
devstagingprodandprod-qa.Makes install instructions closer to https://github.com/freedomofpress/securedrop-dev-docs/
Context: the previous set up diverged in two aspects:
Before merging
This needs to be merged in sync with freedomofpress/securedrop-workstation#1504, since it requires a target environment to be specified and on
securedrop-workstation'smainthat is not specified.