Re: [Tails-dev] Last steps toward enabling incremental upgrades by default [
intrigeri wrote (17 Dec 2013 17:13:41 GMT) : > I've just released Tails-IUK 0.13, that fixes all coding tasks left > for phase three. I'm giving it a manual testing session as we speak. > Please use this version (or later) for any further testing, > documentation work and comments. >From now on, please use Tails-IUK 0.14 (that has all improvements suggested by sajolida) for testing etc. #6014 says we're almost there! > If you want to test the incremental upgrader itself, install Tails > 0.22~rc2, set an admin password, retrieve the latest tails-iuk package > from our APT repo (http://deb.tails.boum.org/pool/main/t/tails-iuk/, > or preferably by adding our feature-incremental-upgrades-integration > suite to your APT sources), install it and run: >$ tails-upgrade-frontend-wrapper Still valid (note that I've only tested by installing the .deb with dpkg, not with APT that will suck way more memory). Please also install the latest version of the wrapper script (config/chroot_local-includes/usr/local/bin/tails-upgrade-frontend-wrapper) from the feature/incremental-upgrades-integration Git branch into /usr/local/bin/. Cheers, -- intrigeri | GnuPG key @ https://gaffer.ptitcanardnoir.org/intrigeri/intrigeri.asc | OTR fingerprint @ https://gaffer.ptitcanardnoir.org/intrigeri/otr.asc ___ tails-dev mailing list tails-dev@boum.org https://mailman.boum.org/listinfo/tails-dev
Re: [Tails-dev] Last steps toward enabling incremental upgrades by default [
On Tue, Dec 17, 2013 at 08:36:29PM +0100, intrigeri wrote: > Hi, > > berta...@ptitcanardnoir.org wrote (17 Dec 2013 18:10:18 GMT) : > > Congrats, I'm excited to see this coming in the wild! > > :) > > ... and I'm scared to discover the remaining bugs we've missed :] > > >> Next steps: > >> > >> * bertagaz reviews feature/incremental-upgrades-integration (but does > >>not merge it yet) and hopefully ACK's it; ETA? > > > I'll try to do that tomorrow if I have remaining time after the other > > review'n'merge I have planned to do, but that sounds unlikely, so if not I > > should be able to do that before the end of the week. I wanted to test > > this incremental upgrade feature since a while anyway. > > IMHO this review (without merge) is higher-priority than the other > ones you have on your plate (namely: #6477 and #6496). Ok, then I did test it the way you proposed, and it works great. So I've marked the ticket QA-Pass, and assigned it to sajolida. bert. ___ tails-dev mailing list tails-dev@boum.org https://mailman.boum.org/listinfo/tails-dev
Re: [Tails-dev] Last steps toward enabling incremental upgrades by default [Was: Please test incremental upgrades (from 0.22~rc1 to 0.22~rc2)]
intrigeri: > Sounds good, did I miss anything? > I would suggest including a small shell script and one utility to test the integrity of a tails release - something as simple as md5deep. Once we start to change the Tails disk, we really want to ensure that an attacker can't stick around past a reboot. I could write such a utility but I'd like some feedback - for example - should we run this after install and put the current state into the persistence? Should we keep a list of hashes of all possible updates, so that we can check a user's data set against a known good list? The easy bit is basically to write something to check the MBR, the partitions and then walk the file systems. It won't detect firmware changes to the disk drive (usb, sata, whatever) but it should be able to very easily detect any binaries that are changed. Obviously we'd need two tails disks to really be able to do this kind of basic forensics. Thoughts? All the best, Jacob ___ tails-dev mailing list tails-dev@boum.org https://mailman.boum.org/listinfo/tails-dev
Re: [Tails-dev] Last steps toward enabling incremental upgrades by default [
Hi, berta...@ptitcanardnoir.org wrote (17 Dec 2013 18:10:18 GMT) : > Congrats, I'm excited to see this coming in the wild! :) ... and I'm scared to discover the remaining bugs we've missed :] >> Next steps: >> >> * bertagaz reviews feature/incremental-upgrades-integration (but does >>not merge it yet) and hopefully ACK's it; ETA? > I'll try to do that tomorrow if I have remaining time after the other > review'n'merge I have planned to do, but that sounds unlikely, so if not I > should be able to do that before the end of the week. I wanted to test > this incremental upgrade feature since a while anyway. IMHO this review (without merge) is higher-priority than the other ones you have on your plate (namely: #6477 and #6496). Cheers, -- intrigeri | GnuPG key @ https://gaffer.ptitcanardnoir.org/intrigeri/intrigeri.asc | OTR fingerprint @ https://gaffer.ptitcanardnoir.org/intrigeri/otr.asc ___ tails-dev mailing list tails-dev@boum.org https://mailman.boum.org/listinfo/tails-dev
Re: [Tails-dev] Last steps toward enabling incremental upgrades by default [
Hi Jacob, Jacob Appelbaum wrote (17 Dec 2013 19:03:03 GMT) : > I would suggest including a small shell script and one utility to test > the integrity of a tails release - something as simple as md5deep. Once > we start to change the Tails disk, we really want to ensure that an > attacker can't stick around past a reboot. > I could write such a utility but I'd like some feedback - for example - > should we run this after install and put the current state into the > persistence? Should we keep a list of hashes of all possible updates, so > that we can check a user's data set against a known good list? > The easy bit is basically to write something to check the MBR, the > partitions and then walk the file systems. It won't detect firmware > changes to the disk drive (usb, sata, whatever) but it should be able to > very easily detect any binaries that are changed. Obviously we'd need > two tails disks to really be able to do this kind of basic forensics. > Thoughts? Thank you for suggesting this. My general take on this is that *if* you have another, trusted Tails device, which is required anyway to run any kind of integrity check, then you can as well "Clone and Upgrade" it, and make the untrusted one trusted again (modulo the MBR, that clone'n'upgrade does not touch, which could be a worthy problem to tackle in itself; checking the partition table could be worth it too, in case a *second*, corrupted Tails was installed by the attacker). So, unless I've missed something (which wouldn't be surprising, given no threat model this feature addresses was described yet AFAIK), such a feature would only be useful to answer the "was a given Tails device persistently corrupted by an attacker" question, no? Note that our #6397 ticket, and the temporary workaround I've proposed last in the "2.0 milestone += supporting USB devices exposed as non-removable?" thread, should be taking into account when reasoning on this topic. Cheers, -- intrigeri | GnuPG key @ https://gaffer.ptitcanardnoir.org/intrigeri/intrigeri.asc | OTR fingerprint @ https://gaffer.ptitcanardnoir.org/intrigeri/otr.asc ___ tails-dev mailing list tails-dev@boum.org https://mailman.boum.org/listinfo/tails-dev
Re: [Tails-dev] Last steps toward enabling incremental upgrades by default [Was: Please test incremental upgrades (from 0.22~rc1 to 0.22~rc2)]
On Tue, Dec 17, 2013 at 06:13:41PM +0100, intrigeri wrote: > Hi, > > I've just released Tails-IUK 0.13, that fixes all coding tasks left > for phase three. I'm giving it a manual testing session as we speak. > Please use this version (or later) for any further testing, > documentation work and comments. > > If you want to test the incremental upgrader itself, install Tails > 0.22~rc2, set an admin password, retrieve the latest tails-iuk package > from our APT repo (http://deb.tails.boum.org/pool/main/t/tails-iuk/, > or preferably by adding our feature-incremental-upgrades-integration > suite to your APT sources), install it and run: > >$ tails-upgrade-frontend-wrapper > > Given sajolida agreed and nobody objected, I'm now targetting to ship > Tails 0.22.1 with incremental upgrades enabled by default (that's the > stuff in feature/incremental-upgrades-integration), and I've flagged > the remaining phase three tickets accordingly: > >https://labs.riseup.net/code/issues/6014 > > Yay. Congrats, I'm excited to see this coming in the wild! > Next steps: > > * bertagaz reviews feature/incremental-upgrades-integration (but does >not merge it yet) and hopefully ACK's it; ETA? I'll try to do that tomorrow if I have remaining time after the other review'n'merge I have planned to do, but that sounds unlikely, so if not I should be able to do that before the end of the week. I wanted to test this incremental upgrade feature since a while anyway. > while, in parallel: > > 1. sajolida writes doc (based on the > feature/incremental-upgrades-integration branch!) and proposes > various phrasing changes to the UI > 2. I update the code accordingly. > > And then, we merge feature/incremental-upgrades-integration, I'll tag > a 0.22.1~beta1 or something, and I'll prepare a test IUK so that > anyone can try the latest stuff in realistic settings. > > And hopefully the Transifex situation improves soon enough... > > Sounds good, did I miss anything? You have a far better idea of the situation than me, so I'd say you're probably right. :) bert. ___ tails-dev mailing list tails-dev@boum.org https://mailman.boum.org/listinfo/tails-dev
[Tails-dev] Last steps toward enabling incremental upgrades by default [Was: Please test incremental upgrades (from 0.22~rc1 to 0.22~rc2)]
Hi, I've just released Tails-IUK 0.13, that fixes all coding tasks left for phase three. I'm giving it a manual testing session as we speak. Please use this version (or later) for any further testing, documentation work and comments. If you want to test the incremental upgrader itself, install Tails 0.22~rc2, set an admin password, retrieve the latest tails-iuk package from our APT repo (http://deb.tails.boum.org/pool/main/t/tails-iuk/, or preferably by adding our feature-incremental-upgrades-integration suite to your APT sources), install it and run: $ tails-upgrade-frontend-wrapper Given sajolida agreed and nobody objected, I'm now targetting to ship Tails 0.22.1 with incremental upgrades enabled by default (that's the stuff in feature/incremental-upgrades-integration), and I've flagged the remaining phase three tickets accordingly: https://labs.riseup.net/code/issues/6014 Yay. Next steps: * bertagaz reviews feature/incremental-upgrades-integration (but does not merge it yet) and hopefully ACK's it; ETA? while, in parallel: 1. sajolida writes doc (based on the feature/incremental-upgrades-integration branch!) and proposes various phrasing changes to the UI 2. I update the code accordingly. And then, we merge feature/incremental-upgrades-integration, I'll tag a 0.22.1~beta1 or something, and I'll prepare a test IUK so that anyone can try the latest stuff in realistic settings. And hopefully the Transifex situation improves soon enough... Sounds good, did I miss anything? Cheers, -- intrigeri | GnuPG key @ https://gaffer.ptitcanardnoir.org/intrigeri/intrigeri.asc | OTR fingerprint @ https://gaffer.ptitcanardnoir.org/intrigeri/otr.asc ___ tails-dev mailing list tails-dev@boum.org https://mailman.boum.org/listinfo/tails-dev
