We have released SecureDrop Workstation 1.2.1. This release applies a preemptive fix to SecureDrop Workstation so that future updates will not result in a broken fedora-41-xfce template.
Details
On July 10, a Qubes update was released that caused some Fedora 41 templates to no longer boot correctly, as discussed in a Qubes forum thread. On July 14, we learned about the issue and prepared this release with a work-around. The underlying issue is being tracked by the Qubes Team.
Due to this upstream issue, automatic updates to the fedora-41-xfce template have a chance of breaking it, resulting in error messages similar to the following:
This template is the default template for many app qubes in SecureDrop Workstation, including sys-net, which provides networking. Thus, without a working fedora-41-xfce template, SecureDrop Workstation cannot start or apply other necessary updates.
We’ve provided technical details about the bug to the Qubes team and once an upstream fix is available, we will revert our temporary change.
Instructions for admins and users
Users need to run the standard SecureDrop Workstation Updater to automatically apply all updates. SecureDrop will require you to run the updater before you can log in and check for new submissions.
Manual Fix
If your SecureDrop Workstation applied a broken update to the fedora-41-xfce template before this release, you can manually fix this issue with the following steps.
In a dom0 terminal, run the following two commands (without sudo):
To disable selinux in the fedora-41-xfce template:
qvm-features fedora-41-xfce selinux 0
To update the template again:
qubes-vm-update --targets fedora-41-xfce --force-update
Then, restart your SecureDrop Workstation and let the preflight updater run.
Additional Support
For additional support in fixing this issue, please don’t hesitate to reach out:
- via our Support Portal, if you are a member (membership is approved on a case-by-case basis)
- via securedrop@freedom.press (PGP encrypted) for sensitive security issues (please use judiciously)
Acknowledgments
We’d like to thank the Qubes team for providing advice and guidance.
This release incorporates Freedom of the Press Foundation (FPF) contributions by Giulio B, Nathan Dyer, Kunal Mehta, Erik Moeller, Cory Francis Myers, Vicki Niu, Kevin O’Gorman, Francisco Rocha, and Rowen S.