conorsch

FROM ubuntu:focal as builder
RUN apt-get update && DEBIAN_FRONTEND=noninteractive apt-get install -y \
        build-essential \
        clang \
        libssl-dev \
        pkg-config \
        git \
        curl

RUN curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y

conorsch

root@testnet2:~# docker logs 9ca2f2534fea | grep WARN
2022-12-05T22:43:55.208874Z  WARN unexpected content-length found, canceling
root@testnet2:~# docker logs 9ca2f2534fea | tail
2022-12-05T22:41:30.866346Z DEBUG grpc{remote_addr=149.102.146.79:40176}:compact_block_range{start_height=388 end_height=0 keep_alive=true}: finished request, client requested keep-alive, continuing to stream blocks cur_height=700
2022-12-05T22:41:38.891292Z DEBUG grpc{remote_addr=216.243.44.102:63613}:compact_block_range{start_height=388 end_height=0 keep_alive=true}: catching up from start height to current end height end_height=700
2022-12-05T22:41:38.895547Z DEBUG grpc{remote_addr=216.243.44.102:63613}:compact_block_range{start_height=388 end_height=0 keep_alive=true}: finished request, client requested keep-alive, continuing to stream blocks cur_height=700
2022-12-05T22:41:47.677073Z DEBUG grpc{remote_addr=216.243.44.102:63615}:compact_block_range{start_height=388 end_height=0 keep_alive=true}: catching up from start height to 

conorsch

Faking a slow network in Client dev

The SecureDrop Client is designed to connect over an Onion service. Tor can be slow: several-second latency is not uncommon. When working on the Client UI, it's easy to overlook how rendering will happen on a production install, if you're connecting to services on your location workstation (e.g. via make dev in the SecureDrop repo).

Enter toxiproxy. That tool will allow you to inject latency between the client and the server sockets on your workstation.

git clone https://github.com/shopify/toxiproxy
cd toxiproxy
make build # requires golang, otherwise fetch the artifacts from release page

conorsch

#!/bin/bash
# Utility script for Qubes OS, to prepare vidchat VMs.
# Handles attaching web & mic, also raises scheduling priority
# to ensure that the vidchat VM stays snappy (reduces jitter).
set -eu -o pipefail

# Default to vidchat, but support overriding
default_vm="${VIDCHAT_VM=vidchat}"
target_vm="${1:-$default_vm}"

conorsch

# Intentionally using an old tag, to test old Focal packages
# See here for options: https://quay.io/repository/freedomofpress/sd-docker-builder-focal?tab=tags
# See related expiry info for LE HTTPS certs here:
# https://letsencrypt.org/docs/dst-root-ca-x3-expiration-september-2021/
FROM quay.io/freedomofpress/sd-docker-builder-focal:2021_04_14

RUN apt-get update && apt-get install -y curl apt-transport-https gnupg2

# Uncomment the upgrade task below to see a working build!
# RUN apt-get upgrade -y

conorsch

#!/usr/bin/env python3
# Utility script to copy SecureDrop staging VM connection info
# from a "securedrop" repo to a "securedrop-workstation" repo,
# formatted for use in securedrop-workstation provisioning.
# The CWD where this script is run should contain:
#
#   * config.json - which will has its "hidserv.hostname" and "hidserv.key" overridden
#   * sd-journalist.sec - containing the private key whose pubkey is on SD Application Server
#
# Also make sure the fingerprint is correct (staging by default is 

conorsch

First, add the following to sys-net:/rw/config/suspend-module-blacklist:

iwlmvm
iwlwifi

Order is important. Then, copy this patch to sys-net, saving it as /home/user/prepare-suspend.patch:

conorsch

def test_spectre_meltdown_checker(host):
    """
    Runs the "spectre-meltdown-checker" script to evaluate
    vulnerability for CPU side-channel attacks.
    """
    if not host.exists("/usr/bin/spectre-meltdown-checker"):
        warnings.warn("Installing spectre-meltdown-checker to run CPU tests")
        with host.sudo():
            host.run("apt-get install -y spectre-meltdown-checker")
    try:

conorsch

diff --git a/scripts/build-debianpackage b/scripts/build-debianpackage
index 3b7e521..e697eeb 100755
--- a/scripts/build-debianpackage
+++ b/scripts/build-debianpackage
@@ -83,7 +83,7 @@ function build_source_tarball() {
     rm -rf "$build_dir"
     git clone "$repo_url" "$build_dir"
 
-    if [[ -n "$PKG_GITREF" ]]; then
+    if [[ -n "${PKG_GITREF:-}" ]]; then

conorsch

$ cat Dockerfile 
ARG DISTRO
FROM ubuntu:$DISTRO
ARG DISTRO
RUN apt-get update && apt-get install -y curl apt-transport-https gnupg2
RUN printf 'deb [arch=amd64] https://apt-test.freedom.press %s main\n' ${DISTRO} > /etc/apt/sources.list.d/apt-test.list
RUN curl -sL -o /tmp/apt-test.asc https://raw.githubusercontent.com/freedomofpress/securedrop/develop/install_files/ansible-base/roles/install-fpf-repo/files/apt-test-signing-key.pub
RUN apt-key add /tmp/apt-test.asc
RUN apt-get update
RUN apt-get download securedrop-config