What’s new in SecureDrop Workstation 1.4.0?

We’re pleased to announce that SecureDrop Workstation 1.4.0, including SecureDrop Client 0.17.0, has been released.

The largest change in this release is the integration of Tor directly in the sd-proxy VM instead of using Whonix. For the most part, this change will be invisible to users, but we expect in the long term this will remove a number of nonactionable prompts, and improve the reliability and speed of system updates. There are slight changes in how to troubleshoot network connection issues; see our documentation for updates.

It also fixes an issue that prevented USB devices from being detected and selected during the export process, and improves the readability of printed conversation transcripts and plain text (*.txt) files.

User-facing features

• Connect to Tor directly in sd-proxy, using CTor, instead of through sd-whonix (#1414, #2561, #2644, #2676)
• sd-proxy is no longer marked as "internal", to allow user-initiated restarts (#1425, #1427)
• Fix bug where Fedora would unnecessarily be updated twice (#1280, #1400)
• Perform salt “migration” to fix device auto-attach (#1422)
• Word-wrap printed conversation transcripts to aid readability (#2510)

Internal and development

• Remove individual VM provisioning targets from Makefile (#1390)
• Display OpenQA Tests Results / Links as GitHub PR Checks (#1363)
• Remove obsolete project.json and add GHA for dependency review (#1401)
• Bump GitHub actions/checkout from 4 to 5 (#1403)
• Run launcher tests dom0 (#1362)
• Add nightly OpenQA run (#1407)
• Development dependencies (#2620, #2477)
• Dependency and review improvements (#2606, #2600)
• Simplify pull request template (#2578)
• Clean up client and proxy README files (#2563)
• Extend automatic generation of call/caller graphs via Paracelsus (#2485)
• Allow use of poetry 2.1.0 (#2472, #2461)
• Sync build-requirements.txt with rebuild of six, markupsafe, sqlalchemy (#2469)

Acknowledgments

We’d like to thank the Qubes team for providing advice and guidance.

Thanks to Localization Lab for continued support with our translations. Translations were updated thanks to the work of volunteers:

• Catalan: Victor Dargallo
• Chinese (Traditional Han script): Meng Pang Wang
• Croatian: Milo Ivir
• French: AO Localization Lab
• German: Curtis Baltimore
• Icelandic: Sveinn í Felli
• Polish: Adam Rak

This release incorporates Freedom of the Press Foundation (FPF) contributions by Giulio B; Nathan Dyer, communications manager; Kunal Mehta, deputy release manager; Erik Moeller; Cory Francis Myers; Vicki Niu; Kevin O’Gorman; Francisco Rocha, release manager; and Rowen S.

Questions and comments

If you have questions or comments regarding this release, please contact us:

• Via our Support Portal, if you are a member (membership is available to SecureDrop administrators on request)
• Via securedrop@freedom.press (PGP encrypted) for sensitive security issues (please use judiciously), or submit a report via Bugcrowd

We also encourage you to file nonsensitive issues via our GitHub repository.

Thank you for using SecureDrop!