The securedrop-admin setup command fails due to missing tor-0.x.x-experimental packages.

[zenmonkeykstop]

Description

Tails 3.9 apt sources lists include a reference to tor-0.3.4-experimental components, which are no longer available on the Tor Project repos. This breaks securedrop-admin setup and apt updates in general (including automatic installation of packages from the Persistent volume).

Steps to Reproduce

Start Tails 3.9 with an admin password.
In a terminal, run sudo apt-get update

Expected Behavior

sudo apt-get update completes without error.

Actual Behavior

sudo apt-get update fails with error:

...
Ign:7 tor+http://sdscoq7snqtznauu.onion/torproject.org tor-experimental-0.3.4.x-stretch/main amd64 Packages
Ign:9 tor+http://sdscoq7snqtznauu.onion/torproject.org tor-experimental-0.3.4.x-stretch/main Translation-en
Ign:5 tor+http://sdscoq7snqtznauu.onion/torproject.org tor-experimental-0.3.4.x-stretch/main all Packages
Ign:7 tor+http://sdscoq7snqtznauu.onion/torproject.org tor-experimental-0.3.4.x-stretch/main amd64 Packages
Ign:9 tor+http://sdscoq7snqtznauu.onion/torproject.org tor-experimental-0.3.4.x-stretch/main Translation-en
Ign:5 tor+http://sdscoq7snqtznauu.onion/torproject.org tor-experimental-0.3.4.x-stretch/main all Packages
Err:7 tor+http://sdscoq7snqtznauu.onion/torproject.org tor-experimental-0.3.4.x-stretch/main amd64 Packages
  404  Not Found
Ign:9 tor+http://sdscoq7snqtznauu.onion/torproject.org tor-experimental-0.3.4.x-stretch/main Translation-en
Fetched 61.9 kB in 13s (4,546 B/s)                                             
Reading package lists... Done
W: The repository 'tor+http://sdscoq7snqtznauu.onion/torproject.org tor-experimental-0.3.4.x-stretch Release' does not have a Release file.
N: Data from such a repository can't be authenticated and is therefore potentially dangerous to use.
N: See apt-secure(8) manpage for repository creation and user configuration details.
E: Failed to fetch tor+http://sdscoq7snqtznauu.onion/torproject.org/dists/tor-experimental-0.3.4.x-stretch/main/binary-amd64/Packages  404  Not Found
E: Some index files failed to download. They have been ignored, or old ones used instead.

Comments

One workaround someone's already tried is to update /etc/apt/sources.list.d/torproject.list to refer to 0.3.5 instead. This allows securedrop-admin setup to complete, but it's unclear how safe this is, or whether it would be possible to update to use 0.3.4-stable.

[redshiftzero]

Multiple SecureDrop users are reporting this as an issue. @zenmonkeykstop filed a ticket upstream with the Tails folks: https://labs.riseup.net/code/issues/15978

Until that is resolved upstream, we should encourage users to modify to 0.3.4-stable (so that we are using the version of tor that has been tested as part of the last review cycle)

[eloquence]

@zenmonkeykstop For a blog post, could you write me out the exact steps for working around this bug? I can then put together a draft.

[zenmonkeykstop]

Aye, will do.

[zenmonkeykstop]

Tails 3.9 /etc/apt/sources.list.d/torproject.list contents are as follows:

deb tor+http://sdscoq7snqtznauu.onion/torproject.org/ stretch main
deb tor+http://sdscoq7snqtznauu.onion/torproject.org/ tor-experimental-0.3.4.x-stretch main

If sudo apt-get update could run, the stable tor candidate version is in stretch main anyway (currently 0.3.4.8 I believe), so we don't need that second line at all (@redshiftzero correct me if I'm wrong here).

So instructions (assuming admins are using nano) are:

• Start Tails with persistence unlocked and an admin password set.
• Open a terminal and run the command sudo nano /etc/apt/sources.list.d/torproject.list
• Delete the second line with contents deb tor+http://sdscoq7snqtznauu.onion/torproject.org/ tor-experimental-0.3.4.x-stretch main
• Save changes and quit the text editor
• Run sudo apt-get update - it will complete without error

This change will not be persistent across reboots, so it will be necessary to run it before running ./securedrop-admin setup for the first time and before any other process running sudo apt-get update.

[redshiftzero]

Tails released Tails 3.9.1 which fixed this on October 2nd.

[eloquence]

This is occurring again with Tails 3.15:

W: The repository 'tor+http://sdscoq7snqtznauu.onion/torproject.org tor-experimental-0.4.0.x-stretch Release' does not have a Release file.
E: Failed to fetch tor+http://sdscoq7snqtznauu.onion/torproject.org/dists/tor-experimental-0.4.0.x-stretch/main/binary-amd64/Packages  404  Not Found
E: Some index files failed to download. They have been ignored, or old ones used instead.
ERROR: Failed to install apt dependencies. Check network connection and try again.

[eloquence]

Upstream issue:
https://redmine.tails.boum.org/code/issues/16883

[eloquence]

(This was resolved upstream a while ago.)