Standup Notes 2021 01 04

Participants (alphabetical): Allie, Conor, Erik, John, Kevin, Kushal, Mickael, Nina, Ro

Topics and Call-outs

apt.freedom.press cert expiry over the weekend

• Monitoring/impact
• Only website we use that still has a wildcard cert for DNS cutover. We knew it was coming up but didn't push through renewal before the break. Aiming for automatic renewal.
• Nightly updates would have been broken for nightly update window; new installs would have failed. Some OSSEC alerts as a result of that.
• Action: Brief advisory on securedrop.org, tweet / Erik to help draft

SecureDrop 1.7.0

• Aiming for QA kick-off next week (Tuesday)
• v2 messaging PR in progress: https://github.com/freedomofpress/securedrop/pull/5679 - Mickael to take a first pass today
• See milestone: https://github.com/freedomofpress/securedrop/milestone/66
• RM and other roles to be designated the next couple days

Sprint nominations welcome for Wednesday, bearing in mind QA period

• (Kev) Can we get Focal packages on apt-test to enable hardware testing?
• (Conor) Do we not already have those?
• (Mickael) We have a couple packages to unblock, but no SD packages yet.
• (Conor) Not blocked on anything, right? We could just build and upload
• (Mickael) Correct, just need to be careful to not confuse ourselves during QA
• We'll discuss more on issue and likely add to sprint https://github.com/freedomofpress/securedrop-dev-packages-lfs/issues/59

cryptopgraphy dependency

• (Mickael) Let's open issue to track CVE and add ignore rule if it does not impact us

Allie

Today:

• Qubes machine in broken state after break, will be updating and recovering today so that I have a test machine for pilot debugging and client feature work

Blockers or Asks:

• No

Conor

Yesterday:

• Holiday PTO

Today:

• Follow-up for apt HTTPS outage
• Grsec metapackage for Focal first steps https://github.com/freedomofpress/securedrop/issues/5507

Blockers or Asks:

• Reminder that cryptography is dropping support for Xenial (thanks for cal reminder, Erik)

Erik

Today:

• Advisory blog post for apt.freedom.press
• Backlog review & sprint prep
• UxR/next steps for Safe Deletion
• Catch up with Nina to discuss v2/v3 messaging
• PEO legal follow-up

Blockers or Asks: None

John

Yesterday:

Today:

• qubes restore
• Focal disable-v2-on-restore https://github.com/freedomofpress/securedrop/pull/5677
• Add simplified Chinese https://github.com/freedomofpress/securedrop/issues/5069

Blockers or Asks:

• None

Kev

Yesterday:

Today:

• Adding SecureDrop QA machine to hardware inventory
• Rebasing PR for v2/v3 messaging, marked as draft but ready for light review
• Poke at OSSEC v3 messaging

Blockers or Asks: None

Kushal

Today:

• Next steps for https://github.com/freedomofpress/securedrop-debian-packaging/pull/211

• Conor will mark ready for review

Tomorrow:

• looking at review etc as required Blockers or Asks:
• None

Mickael

Yesterday:

• Work on https://github.com/freedomofpress/securedrop/issues/5295 Today:
• review v2/v3 messaging PR https://github.com/freedomofpress/securedrop/pull/5679
• Writing tests for https://github.com/freedomofpress/securedrop/issues/5295, Blockers or Asks:
• None

Nina

Yesterday:

Today:

Blockers or Asks:

Ro

Today:

• Redmine catchup/support comms; expect some comms with new admins this week
• IVF and some followup with this instance
• DST standup + arrange Q1 planning session later this wk
• Documentation push this wk
• background/learning task this wk: improved streaming/live support setup
• see you next at Thursday's standup

Blockers or Asks:

• none