Release SecureDrop Workstation 0.5.6

[eloquence]

0.5.5 provided the new signing key for RPMs, but it was still signed with the old key, which is now expired (see freedomofpress/securedrop-yum-prod#19). RPM still appears to successfully validate packages signed with expired keys, but to tidy up the install procedure (freedomofpress/securedrop-workstation-docs#82) and to avoid surprises, we should release a new package signed with the new key.

As part of a new RPM, we should be able to safely drop the migration flag in postinst (which causes an extra sdw-admin --apply run on each fresh install).

[eloquence]

@conorsch has committed to re-signing the existing RPM with the new release key, which should unblock us for docs updates & a cleaner fresh install story.

[conorsch]

Now that we have #722 merged, I propose we plan for a 0.5.6 release shipping those changes.

[conorsch]

Tagging up here. Now that #729 is merged, we're due for a release. I'm happy to prep changelog and version bumps for 0.5.6.

[sssoleileraaa]

@conorsch lemme know if you'd like any help :-)

[eloquence]

I can QA an upgrade & fresh install based on the RC later today.

[conorsch]

@eloquence I knocked together a test plan here: https://github.com/freedomofpress/securedrop-workstation/wiki/0.5.6-Test-Plan please edit freely as you see fit

[eloquence]

• Qubes 4.0.4
• Scenario: Fresh prod install using RC1 RPM
• tl;dr: Ship it!

buster template apt repo settings

• Observe that a clean install completes successfully, with no errors
• Double-check the SD desktop icon, and observe the updater completes successfully, with no errors

Whonix migration

• Observe that sys-whonix and sd-whonix are using whonix-gw-16 as their TemplateVM, e.g. qvm-prefs sd-whonix template
• Observe that anon-whonix is using whonix-ws-16 as its TemplateVM.
• When running the updater, confirm that no Whonix-related warning messages are displayed.

[conorsch]

Nice! Glad to hear it. I ended up performing a clean install of 0.5.6-rc1, as well, because I'd already uninstalled as part of review for #729. Tomorrow I'll do a bit more testing of the upgrade scenario, as described, but I'm pleased to report that the clean install scenario showed no problems whatsoever.

[conorsch]

Upgrade testing completed successfully, zero problems to report. I'm going to proceed with version bump to 0.5.6 final. Will prepare the necessary artifacts and PRs after that's approved, but hold off on prod release until early next week.

[eloquence]

(This was completed yesterday.)