securedrop-workstation | based SecureDrop Journalist Workstation environment

Installing this project is involved. It requires an up-to-date Qubes 4.0 installation running on a machine with at least 16GB of RAM (32 GB recommended). You'll need access to a SecureDrop staging server as well. The project is currently in a closed beta, and we do not recommend installing it for production purposes. Documentation for end users is being developed here. The instructions below are intended for developers.
Before trying to use this project, install Qubes 4.0.4 on your development machine. Accept the default VM configuration during the install process.
Finally, perform the final build. You should follow one of the sections below based on whether the subproject you are building is Debian or rpm packaged.
Clone the securedrop-debian-packaging repository.
Determine which version of the packaging logic and tarballs you want to use. You probably created the tag in the previous step, else inspect the tag annotation to determine which is the right version.
git tag -v VERSION and ensure the tag is signed with the official release key.
git checkout VERSION
Now you are ready to build. For good measure, you can also verify the signature of the tarball you want to use, although this will have been done by the reviewer of the PR adding the tarball.
Set PKG_DIR to point to the tarball you wish to package, and PKG_VERSION to the version you wish to package, then run the relevant makefile target in the securedrop-debian-packaging repository. For example to build version 0.1.1 of the securedrop-client:
Upload build logs in the build-logs repository in the workstation directory. Ensure that the sha256sum of the built package is included in the build log.
Next, add the package via PR to the private securedrop-debian-packages-lfs repository.
Regenerate reprepro repository metadata using the script in that repository: ./tools/publish. When you inspect the diff, you'll notice that the previous version of the subproject will no longer be served. This is expected.
Copy the Release file to signing environment.
Verify integrity of Release file.
Sign the Release file gpg --armor --detach-sign --output Release.gpg Release
Copy the detached signature into your working directory and commit along with the new package(s), and the modified repository metadata.
Open a PR for review.
Upon merge to master, ensure that changes deploy to apt.freedom.press without issue.
Verify the tag of the project you wish to build: git tag -v VERSION and ensure the tag is signed with the official release key.
git checkout VERSION
Now you are ready to build. Build RPMs following the documentation in an environment sufficient for building production artifacts. For securedrop-workstation you run make dom0-rpm to build the RPM.
sha256sum the built template (and store hash in the build logs/commit message).
Commit the (unsigned) version of this RPM to a branch in the securedrop-workstation-prod-rpm-packages-lfs repository.
Copy the RPM to the signing environment.
Verify integrity of RPM prior to signing (use sha256sums to compare).
Sign RPM in place (see Signing section below).
Move the signed RPM back to the environment for committing to the lfs repository.
Upload build logs directly to the build-logs repository in the workstation directory. Ensure that the sha256sum of the package before and after signing is included in the build log.
Commit the RPM in a second commit on the branch you began above in securedrop-workstation-prod-rpm-packages-lfs. Make a PR.
Upon merge to master, ensure that changes deploy to yum.securedrop.org without issue.
Verify the tag in the qubes-template-securedrop-workstation repository: git tag -v VERSION and ensure the tag is signed with the official release key.
git checkout VERSION
Rebuild template following documentation in qubes-template-securedrop-workstation.
sha256sum the built template (and store hash in the build logs/commit message).
Commit unsigned template for historical purposes.
Sign template RPM with test key (rpm --resign ) (see Signing section below).
Commit signed template.
Push those two commits to a PR in securedrop-workstation-dev-rpm-packages-lfs. Make the PR.
Upload build logs directly to the build-logs repository in the workstation directory.
Upon merge of the PR into securedrop-workstation-dev-rpm-packages-lfs, the template will be deployed to yum-test.securedrop.org.
Test template.
Once template is sufficiently tested, remove test sig: rpm --delsign <file>.
Verify unsigned template sha256sum from build logs/commit message.
Sign template with prod key: rpm --resign <file>
Push commit to a branch in the securedrop-workstation-prod-rpm-packages-lfs repository. Make a PR.
Upon merge to master, ensure that changes deploy to yum.securedrop.org without issue.