Pre-Release Announcement

SecureDrop 0.11.0: Pre-Release Announcement

December 4, 2018

The release of the next version of SecureDrop, 0.11.0, is scheduled for December 11, 2018. We will send out another notification through this blog, Twitter, and the support portal when the release is live. Changes that journalists and administrators should be aware of are summarized in this blog post. A complete list of changes can be found on GitHub.

What’s coming in SecureDrop 0.11.0?

For sources

  • User interface change: The “screensaver” feature on the source interface that hides screen contents after 2 minutes of inactivity will be removed, due to its potential to cause confusion with limited benefit. (Issue, Pull Request)
  • User interface change: The hard disk drive platter icon used to represent the action of uploading files to SecureDrop will be replaced with a more common cloud upload icon. (Issue, Pull Request)
  • User interface change: The Tor icon used to explain the use of the security slider will be updated to be consistent with the icon used in the latest version of the Tor browser. (Issue, Pull Request)

For administrators

  • Bugfix: You will be able to change your OSSEC public key after the initial install. Due to a bug, attempting to apply the change by running ./securedrop-admin install previously failed with a permission error. (Issue, Pull Request)
  • User interface change: The “Add user” screen in the admin interface will indicate that usernames are case-sensitive, and may contain spaces. (Issue, Pull Request)
  • Kernel upgrade / security: The Linux kernel on SecureDrop servers will be upgraded from version 4.4.144 to version 4.4.162. This upgrade includes L1TF and Spectre v4 mitigations and addresses other local privilege escalation vulnerabilities; these vulnerabilities can only be exploited by users who have the ability to execute code on the SecureDrop servers. (Issue, Pull Request)
  • Kernel removal: As previously announced, the 3.14.x series kernel, which has reached end-of-life, will be removed completely from SecureDrop servers. (Issue, Pull Request)
  • Security: As a precaution, this release will update Ansible from version 2.4.2 to version 2.6.8. Ansible is used for installing SecureDrop and for applying configuration changes. The previously installed version of Ansible has a security vulnerability which does not directly impact SecureDrop. (Issue, Pull Request)

For developers

  • Journalist Interface API behavior change: Posting a reply through the API will now return the UUID of the newly created reply. (Issue, Pull Request)
  • Journalist Interface API bugfix: The filenames of replies in API responses will no longer include the full path to the reply on the server filesystem. (Issue, Pull Request)

What administrators will need to do

SecureDrop Application and Monitor Server code will be updated automatically.

On a subsequent boot of your SecureDrop Journalist and Admin Workstations, the SecureDrop Workstation Updater will alert you to workstation updates. Choose "Update Now" on each of the workstations:

sdupdater.png

Please note that this only updates the SecureDrop code on the workstation. Tails upgrades must be performed separately.

If you have not yet updated to the graphical updater, you can update as follows:

cd ~/Persistent/securedrop
git fetch --tags
gpg --recv-key "2224 5C81 E3BA EB41 38B3 6061 310F 5612 00F4 AD77"
git tag -v 0.11.0

The output should include the following two lines:

gpg:                using RSA key 22245C81E3BAEB4138B36061310F561200F4AD77
gpg: Good signature from "SecureDrop Release Signing Key"

Please verify that each character of the fingerprint above matches what you see on the screen of your workstation. If it does, you can check out the new release:

git checkout 0.11.0

Important: Please verify that the output of this command does not contain the text "warning: refname '0.11.0' is ambiguous". If you do see this warning, we recommend that you contact us immediately at securedrop@freedom.press (GPG encrypted).

Finally, run the following command:

./securedrop-admin setup

Questions and comments

If you have questions or comments regarding this release, please don't hesitate to reach out:

  • Via our Support Portal, if you are a member (membership is approved on a case-by-case basis);
  • Via securedrop@freedom.press (GPG encrypted) for sensitive security issues (please use judiciously);
  • Via our community forums.

We also encourage you to file non-sensitive issues you encounter in our GitHub repository (issue report form).

Thank you for using SecureDrop!

Return to News