Release SecureDrop Client 0.5.0

[eloquence]

The last SecureDrop Client release was on March 17 and quite a few changes have landed since then, notably #1273, #1263, #1258 and #1241.

This issue tracks the next SecureDrop Client release, 0.5.0:

• Prepare changelog
• Cut release branch
• Create test plan
• Begin QA
• Production release

We will aim to issue releases of securedrop-proxy and securedrop-export at the same time; while not technically required, it is good practice push out recent dependency updates to prod.

[eloquence]

During the 8/4-8/18 sprint, we'll likely only be able to begin QA on this release, with the actual release targeted for the following sprint. Safe Deletion in particular is a big change which we should plan to put through its paces for a few days.

[sssoleileraaa]

just a note that this is ready for review: #1274, which will go into 0.5.0

[sssoleileraaa]

Test Plan

Deletion of conversations (#1263)

Basic test

1. Run the client as usual
2. Use the source menu to delete a conversation
3. Compare appearance and flow to the prototype linked from "Safe Delete" parity with JI #1202

• You can successfully delete a source conversation
• Appearance is what we expect based on prototypes
• Behaviour is what we expect based on prototypes

4. Now use the source menu to delete a source account

• You can successfully delete a source account
• Appearance is what we expect based on prototypes
• Behaviour is what we expect based on prototypes

Tear message

1. Run the client as usual
2. Open a conversation that consists of only one document submission (no messages and no replies)
3. Delete the document via the journalist interface and wait for a client sync
4. Compare appearance and flow to the prototype linked from "Safe Delete" parity with JI #1202

• Confirm the document disappears from the conversation
• Confirm the tear message appears
• Confirm tear message looks as expected: https://app.zeplin.io/project/5c807ea562f734bd2756b243/screen/6080e8b72293ab1e30f35d06

5. Send a reply as the source

• Confirm the reply follows the tear message
• Confirm tear message appearance changes to match: "Safe Delete" parity with JI #1202

6. Repeat steps from the beginning except instead of a reply send a message directly following the tear message

• Confirm the message follows the tear message
• Confirm tear message appearance changes to match: "Safe Delete" parity with JI #1202

7. Send a document at the end or somewhere in the middle of a conversation
8. Delete the document via the Journalist Interface

• Confirm the document disappears from the conversation
• Confirm the tear message does not appear

9. Open a conversation where the entire conversation consists of only two documents
10. Delete one of the documents via the Journalist Interface

• Confirm the document disappears from the conversation
• Confirm the tear message does not appear

11. Delete the remaining document

• Confirm the document disappears from the conversation
• Confirm the tear message appears
• Confirm tear message looks as expected: https://app.zeplin.io/project/5c807ea562f734bd2756b243/screen/6080e8b72293ab1e30f35d06

Try to break it

• Confirm this issue never occurs when you're attempting to break things in the next step (the preview animation of the rectangles is missing, which was reported during PR review but we've been unable to reproduce it): https://user-images.githubusercontent.com/4522213/127219938-19729ac6-7a57-4d91-949a-168cac4c91a2.png
• Everything continued to work after deleting multiple sources and conversations at the same time, while selecting other sources and using the client in various ways, and in different order
• Unable to break safe delete

Speed up deletion of accounts and conversations (#1273)

• Sync immediately happens after a source account is deleted from the client
• Sync immediately happens after a conversation is deleted from the client

Tighten file permissions (#1256)

1. Delete ~/.securedrop_client (you can manually copy config.json if you want but it's not necessary to test this change)
2. Start the client via command line by running: securedrop-client

• Confirm svs.sqlite and sync_flag now have 600 perms instead of 644

Bug fix for exporting document twice (#1241)

1. Export a file, any file, just press the Enter key (instead of clicking the Continue button) after typing in the password to unlock your luks-encrypted export device.

• Confirm the file is no longer exported twice

Scale left pane background image (#1210)

• Confirm scaling works as expected, as described in scale left pane background image #1209

[sssoleileraaa]

@eloquence feel free to update this test plan if you find anything critical missing, but there's also a "try to break it" section that i figured gives you plenty of room to have fun

[eloquence]

Thanks @creviera! I'm testing with Qubes 4.0.4, using a 0.5.0 package I manually built from the release/0.5.0 branch and installed in sd-small-buster-template.

Two initial issues I've noticed:

Content briefly re-appears on "Files and Messages" deletion

Steps to reproduce:

1. Select a source and delete "files and messages"
2. Wait for the deletion animation to run its course

Expected behavior:
"Files and messages deleted for this source" placeholder takes over conversation area

Actual behavior:
Conversation area content briefly re-appears, then disappears

NOTE: I saw this issue several times immediately after logging in and, and am now no longer able to reproduce it. It could be timing/connection dependent.

"Compose a reply" placeholder is styled incorrectly in both interaction flows, allows typing

The "Compose a reply" styling while either deletion animation is running does not match the prototypes; in both interaction flows, it looks like the reply box is enabled (but sitting on a grayed out background). After clicking repeatedly, I can sometimes type into the reply box.

Illustrated below, note how I can type into the reply box while a deletion operation is underway.

[eloquence]

I continued QA with the same build up to the "Try to break it" section today. I noticed a couple of issues, none as severe as the ones reported above. Otherwise, all scenarios in the test plan up to that point were passing.

Deletion dialog is sometimes not styled

During testing of the tear pattern today, I am noticing that the deletion dialog is sometimes, for some sources, not styled at all. This applies to both deletion dialogs, and I can consistently reproduce it for those sources where it occurs, while getting the styled dialogs for other sources in the same session.

I've not noticed any commonality yet for those sources where the dialog is unstyled (e.g., contents of conversation area).

Incorrect tear pattern sometimes appears after a reply

When sending a reply to a source with deleted files/messages, the empty-state tear pattern is sometimes displayed initially, until the next sync:

After sync:

I'm not able to consistently observe this behavior, and it may be related to the gpg key access that's shown in the screenshot above.

Very little whitespace between tear pattern and file widgets

This is more a cosmetic issue, but note how the two objects are clustered together:

I'm not sure if this is a regression yet, but I am generally noticing that file widgets for sources with no messages are very near the margin of the conversation area, without substantive padding.

[eloquence]

Try to break it

• ❓ Confirm this issue never occurs when you're attempting to break things in the next step (the preview animation of the rectangles is missing, which was reported during PR review but we've been unable to reproduce it): https://user-images.githubusercontent.com/4522213/127219938-19729ac6-7a57-4d91-949a-168cac4c91a2.png

I'm not sure if this is the same issue you noticed during review -- when I delete an entire source account, the skeleton pattern (gray rectangles) animation runs in the source list, but then it transitions to a state like shown in the screenshot, until it is finally removed. It doesn't necessarily look broken to me, but I've not compared it yet against the prototype animations.

• Everything continued to work after deleting multiple sources and conversations at the same time, while selecting other sources and using the client in various ways, and in different order
• Unable to break safe delete

(With the exception of issues already identified, everything seems to be working well.)

Speed up deletion of accounts and conversations (#1273)

• Sync immediately happens after a source account is deleted from the client
• Sync immediately happens after a conversation is deleted from the client

(Just going off the sync animation firing immediately after the GUI updates.)

Tighten file permissions (#1256)

1. Delete ~/.securedrop_client (you can manually copy config.json if you want but it's not necessary to test this change)
2. Start the client via command line by running: securedrop-client

• ❌ Confirm svs.sqlite and sync_flag now have 600 perms instead of 644

The permission on svs.sqlite is 700 (includes executable bit).

Bug fix for exporting document twice (#1241)

1. Export a file, any file, just press the Enter key (instead of clicking the Continue button) after typing in the password to unlock your luks-encrypted export device.

• Confirm the file is no longer exported twice

Scale left pane background image (#1210)

• Confirm scaling works as expected, as described in scale left pane background image #1209

[eloquence]

Some notes on the reproducibility of three issues reported above:

1) Deleted content briefly re-appears until the next sync

I am able to reproduce this one fairly easily, just by using "Files and messages" deletion after logging in.

2) Wrong "Files and messages deleted" placeholder is used after sending a reply

This one is difficult to catch, but I've been able to reproduce it three times by starting with a new source:

• Submit as a new source
• Wait for the client to sync & decrypt
• Delete "Files and Messages"
• Wait for deletion to complete
• Send a reply

Expected: smaller tear pattern "Earlier files and messages deleted" appears
Actual: "Files and messages deleted for this source" pattern remains in place until the next sync

It does not appear to be correlated with whether gpg access has been approved or not.

3) Unstyled deletion dialogs

Zero luck here, I saw this during a single session in the client yesterday, but have not been able to reproduce it before or since.

[sssoleileraaa]

Some notes on the reproducibility of three issues reported above:

1) Deleted content briefly re-appears until the next sync

I am able to reproduce this one fairly easily, just by using "Files and messages" deletion after logging in.

I can confirm your STR and see the same behaviour with the following STR (a much less likely scenario I'll admin, but it provides more insight into the issue):

1. Send a reply
2. Very quickly delete files and messages from the source

Expected

After the pending deletion animation, to see the tear and tear message

Actual

After the pending deletion animation, the reply remains. It takes one more sync before the tear and tear message are displayed.

[sssoleileraaa]

New finding...

Select a source message appears when a source is already selected

1. Select a source
2. Delete files and messages
3. Log out
4. Log back in

Expected

To continue to see the tear and tear message in the conversation view of the selected source

Actual

The "Select a source" message is displayed on top of the tear message until the next sync

[eloquence]

Issues for the confirmed findings above:
#1285, #1286, #1289, #1290

Findings that still need STRs:
#1287, #1288

[ninavizz]

That "knockout" of the Reply pane is really odd. Not sure why that was coded—if the "Reply" pane is active but the button is not active, that is also not how to ever do a windowshade-mode to suggest the above area being disabled.

Not sure what it is trying to communicate, but pls make sure to not release this with that in tact. It looks a wee sad and broken.

[eloquence]

That's #1286, which is already fixed, but we'll double-check the behavior as part of QA.

[eloquence]

Did a round of exploratory testing with today's nightly that has #1311 in it. So far, everything looks good:

• File/messages deletion is quick & reliable
• "Tear" patterns are as expected
• "Entire account" deletion works (files on disk deleted as expected as well)
• Basic export/open functionality still works
• Syncing and offline mode still work
• Draft replies that fail to send transition to failed replies

Other recently landed features are looking good as well:

• Ctrl+Q keyboard shortcut works as expected
• Tooltips for usernames work as expected
• Offline mode link fades during login as expected

Will step through full test cases as the QA plan comes together.

[sssoleileraaa]

Great! Thanks @eloquence.

We can use the previous test plan with one modification:

• Sync immediately happens after a conversation is deleted from the client

This check is no longer necessary now that we sped up "safe delete" even more, where no immediate sync is required. The new behavior is covered in the follow test:

Speed up deletion of conversations (#1311)

• The client no longer waits for a sync when you delete a conversation. Confirm that the deletion takes only a few seconds, give or take, depending on your tor network connection.

In addition to the safe-delete tests, also test new functionality with the following tests...

Tooltips for journalist badges (#1327)

• Login as journalist via client. Ensure that the tool-tip displays the default username of the reply badges.
• Configure the first name and last name in the web interface. Check that the tool-tip displays user's full name.
• Login in as dellsberg via client and update journalist's first name through the web interface. Ensure that the tool-tip displays the updated credentials.

Add keyboard shortcut to quit application (#1331)

• Confirm Ctrl+Q quits the client while logged in and in offline mode
• Confirm Esc quits the login dialog

Tabbing to the "Use offline" button (#1328)

• Confirm you can press tab to navigate to the "Use offline" button in the login dialog

Clear login error message on successful login attempt (#1321)

• Create a login error by typing in the wrong credentials, then confirm that the error message disappears when you log in successfully
  • Note that the original issue was only apparent when the network was slow enough to see that the error message persisted for a few seconds

[eloquence]

Stepping through deletion test plan one more time now.

[eloquence]

Environment: Qubes OS 4.0.4
Nightly version: 20211201-060641 / make staging
Server environment: prod 2.1.0

Test Plan

Deletion of conversations (#1263)

Basic test

1. Run the client as usual
2. Use the source menu to delete a conversation
3. Compare appearance and flow to the prototype linked from "Safe Delete" parity with JI #1202

• You can successfully delete a source conversation
• ❌ Appearance is what we expect based on prototypes (immediately and repeatedly got Deletion dialog is sometimes not styled #1287)
• Behaviour is what we expect based on prototypes

4. Now use the source menu to delete a source account

• You can successfully delete a source account
• ❌ Appearance is what we expect based on prototypes (as above)
• Behaviour is what we expect based on prototypes

Tear message

1. Run the client as usual
2. Open a conversation that consists of only one document submission (no messages and no replies)
3. Delete the document via the journalist interface and wait for a client sync
4. Compare appearance and flow to the prototype linked from "Safe Delete" parity with JI #1202

• Confirm the document disappears from the conversation
• Confirm the tear message appears
• Confirm tear message looks as expected: https://app.zeplin.io/project/5c807ea562f734bd2756b243/screen/6080e8b72293ab1e30f35d06

5. Send a reply as the source

• Confirm the reply follows the tear message
• Confirm tear message appearance changes to match: "Safe Delete" parity with JI #1202

6. Repeat steps from the beginning except instead of a reply send a message directly following the tear message

• Confirm the message follows the tear message
• Confirm tear message appearance changes to match: "Safe Delete" parity with JI #1202

7. Send a document at the end or somewhere in the middle of a conversation
8. Delete the document via the Journalist Interface

• Confirm the document disappears from the conversation
• Confirm the tear message does not appear

9. Open a conversation where the entire conversation consists of only two documents
10. Delete one of the documents via the Journalist Interface

• Confirm the document disappears from the conversation
• Confirm the tear message does not appear ("Earlier files and messages deleted" message does appear if I delete the first document, which is expected behavior)

11. Delete the remaining document

• Confirm the document disappears from the conversation
• Confirm the tear message appears
• Confirm tear message looks as expected: https://app.zeplin.io/project/5c807ea562f734bd2756b243/screen/6080e8b72293ab1e30f35d06

Try to break it

• Confirm this issue never occurs when you're attempting to break things in the next step (the preview animation of the rectangles is missing, which was reported during PR review but we've been unable to reproduce it): https://user-images.githubusercontent.com/4522213/127219938-19729ac6-7a57-4d91-949a-168cac4c91a2.png
• Everything continued to work after deleting multiple sources and conversations at the same time, while selecting other sources and using the client in various ways, and in different order
• Unable to break safe delete

Tighten file permissions (#1256)

1. Delete ~/.securedrop_client (you can manually copy config.json if you want but it's not necessary to test this change)
2. Start the client via command line by running: securedrop-client

• Confirm svs.sqlite and sync_flag now have 600 perms instead of 644

Bug fix for exporting document twice (#1241)

1. Export a file, any file, just press the Enter key (instead of clicking the Continue button) after typing in the password to unlock your luks-encrypted export device.

• Confirm the file is no longer exported twice

Scale left pane background image (#1210)

• Confirm scaling works as expected, as described in scale left pane background image #1209

[eloquence]

Speed up deletion of conversations (#1311)

• The client no longer waits for a sync when you delete a conversation. Confirm that the deletion takes only a few seconds, give or take, depending on your tor network connection. for files and messages

Tooltips for journalist badges (#1327)

• Login as journalist via client. Ensure that the tool-tip displays the default username of the reply badges.
• Configure the first name and last name in the web interface. Check that the tool-tip displays user's full name.
• Login in as dellsberg via client and update journalist's first name through the web interface. Ensure that the tool-tip displays the updated credentials.

(I ran equivalent tests with the users configured on my instance)

Add keyboard shortcut to quit application (#1331)

• Confirm Ctrl+Q quits the client while logged in and in offline mode
• Confirm Esc quits the login dialog

Tabbing to the "Use offline" button (#1328)

• Confirm you can press tab to navigate to the "Use offline" button in the login dialog (we may want to tweak the focus styling; it's not very obvious the link is highlighted when you tab over it)

Clear login error message on successful login attempt (#1321)

• Create a login error by typing in the wrong credentials, then confirm that the error message disappears when you log in successfully
  • Note that the original issue was only apparent when the network was slow enough to see that the error message persisted for a few seconds

[eloquence]

Based on the combination of exploratory testing and test plan testing, IMO this is good to go. #1287 is the most user-visible bug I keep hitting, but we've already agreed that it can be fixed post-release. I can't test printing (don't have our supported printer) so it'd be good if someone could give that a quick regression test at least with the HP.

[eloquence]

This was completed last week, followed by a 0.5.1 patch release to address a package build discrepancy - see #1366 for background.