Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Validate-apt-version task may not be needed on Focal #5955

Closed
rocodes opened this issue May 19, 2021 · 2 comments
Closed

Validate-apt-version task may not be needed on Focal #5955

rocodes opened this issue May 19, 2021 · 2 comments

Comments

@rocodes
Copy link
Contributor

rocodes commented May 19, 2021

Description

validate-apt-version, which is named as a Xenial task, runs on Focal installs:
https://github.com/freedomofpress/securedrop/blob/012d30e8baeb8ffa7c10a56f4b43c464abf87cf7/install_files/ansible-base/roles/install-fpf-repo/tasks/validate_apt_version.yml

According to https://nvd.nist.gov/vuln/detail/CVE-2019-3462, the versions of apt that ship with Ubuntu 20.04 are not affected, so it looks like we can stop running this check.

Steps to Reproduce

./securedrop-admin install on Focal 20.04 servers

Comments

check when: ansible_distribution_release == 'focal' or remove entirely as we phase out xenial code

@conorsch
Copy link
Contributor

Thanks, @rocodes. You're right, we can safely remove that code now. Ideally we'd be able to use HTTPS across the board for all apt repos, to be a bit more defensive against similar vulnerabilities in the future, but many of the Canonical repos are still HTTP-only. The FPF apt repo is already HTTPS, and will remain so.

@eloquence eloquence added this to Next sprint candidates in SecureDrop Team Board May 20, 2021
@eloquence eloquence moved this from Next sprint candidates to Near Term - SecureDrop Core in SecureDrop Team Board May 20, 2021
@legoktm
Copy link
Member

legoktm commented Mar 1, 2022

This was done in #5911 / b8ef5d6.

@legoktm legoktm closed this as completed Mar 1, 2022
SecureDrop Team Board automation moved this from Near Term - SecureDrop Server to Done Mar 1, 2022
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
No open projects
Development

No branches or pull requests

3 participants