[xenial] Fetches upstream Tor debs via Molecule #4101
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Uses another Molecule-based build scenario that fetches the Xenial tor debs for inclusion in the FPF-maintained apt repository. The debs are fetched into the same `build/xenial/` dir as the SD debs. There's no corresponding logic for fetching Trusty debs, since Tor has stopped backporting tor for trusty. The major change here is the update to the Tor Project public key, which has expired since we last updated the pubkey stored in this repo. We haven't used the Tor pubkey directly since switching to an apt mirror for distributing tor debs. As of 0.12.0, we plan to use a single, consolidated apt repo, to distribute both SecureDrop and Tor deb packages.
kushaldas
reviewed
Feb 7, 2019
There was a problem hiding this comment.
-
make fetch-tor-packagescompletes without error - Inspect tor debs inside
build/xenial/via e.g.dpkg-deband confirm they're valid Xenial tor debs - Tor repo pubkey is current and correct
- Tor package versions match what's served up by https://apt-test.freedom.press/pool/main/t/tor/ currently
Don't know where and how to test the point 3, rest are okay.
redshiftzero
approved these changes
Feb 8, 2019
There was a problem hiding this comment.
thanks @conorsch and thanks @kushaldas for the testing, the final testing step is:
✅ verified tor public key is correct 0xEE8CBC9E886DDD89 (note that if you fetch it from the keyservers right now it will fail due to the issue described here)
eloquence
changed the title
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Status
Ready for review.
Description of Changes
Follow up to #3961.
Changes proposed in this pull request:
Uses another Molecule-based build scenario that fetches the Xenial tor debs
for inclusion in the FPF-maintained apt repository. The debs are fetched into
the same
build/xenial/dir as the SD debs. There's no corresponding logicfor fetching Trusty debs, since Tor has stopped backporting tor for trusty.
The major change here is the update to the Tor Project public key, which
has expired since we last updated the pubkey stored in this repo. We haven't used
the Tor pubkey directly since switching to an apt mirror for distributing tor debs.
As of 0.12.0, we plan to use a single, consolidated apt repo, to distribute both
SecureDrop and Tor deb packages.
Testing
make fetch-tor-packagescompletes without errorbuild/xenial/via e.g.dpkg-deband confirm they're valid Xenial tor debsDeployment
Starting with 0.12.0, we will use the tor debs fetched by this process for inclusion in the FPF-controlled apt repository at apt.freedom.press. Only the Xenial tor packages will be updated, since Tor no longer maintains packages for Trusty.
Checklist
If you made changes to the server application code:
make ci-lint) and tests (make -C securedrop test) pass in the development containerIf you made changes to
securedrop-admin:make -C admin test) pass in the admin development containerIf you made changes to the system configuration:
If you made non-trivial code changes:
If you made changes to documentation:
make docs-lint) passed locally