Remove sd-whonix and whonix-gateway FPF packages and repos by deeplow · Pull Request #1415 · freedomofpress/securedrop-workstation

deeplow · 2025-08-22T19:46:36Z

Follow-up to #1414 (to be rebased after it is merged).

Removes sd-whonix and tries to remove all code tries between the workstation and its whonix dependency.
Added unofficial support for an installation where Whonix is not installed

TODO:

update threat model in README
remove sd-sys-whonix-vms.sls (including removing apparmor kernel arguments)
Conditional removal of packages from whonix templates, depending on presence of whonix VMs

Test plan

visual review
Ensure no other lingering references to Whonix exist
ensure FPF packages, repositories and keyring absent from sys-whonix or whonix-gateway-17
make dev does not run qvm.anon-whonix or other system default formulas

Checklist

This change accounts for:

any necessary RPM packaging updates (e.g., added/removed files, see MANIFEST.in and rpm-build/SPECS/securedrop-workstation-dom0-config.spec)
any required documentation

legoktm · 2025-09-12T21:44:14Z

I just rebased against main, didn't look at it or anything.

deeplow · 2025-09-24T15:05:57Z

Rebased again to pick the OpenQA fixes (now on FPF's fork of the openqa-tests-qubesos).

Sd-whonix will no longer present in the workstation code [1]. [1]: freedomofpress/securedrop-workstation#1415

deeplow · 2025-09-30T16:16:25Z

            FLAVOR=securedrop \
            NEEDLES_DIR="%%CASEDIR%%/needles" \
-            CASEDIR="https://github.com/freedomofpress/openqa-tests-qubesos.git#main"\
+            CASEDIR="https://github.com/freedomofpress/openqa-tests-qubesos.git#sd-whonix-removal"\


This must be removed before merging.

deeplow · 2025-09-30T18:04:54Z

All tests passed, but sadly the uploading of the sdw-admin --apply logs timed out. So I coudn't evaluate the result on a clean system. I've started it again here.

deeplow · 2025-09-30T18:06:51Z

~~Marking this as ready for review, possibly for @legoktm, but I'll do another pass tomorrow after reading the sdw-admin --apply output.~~ (Update: changed my mind as I needed to rebase from main. I'll wait for the test to run on the rebased to mark it as ready for review).

Try to remove the fpf packages and repo. Run this as the last step in configuration, adapted from the steps used to configure them in.

deeplow · 2025-10-01T13:29:32Z

(Marked as ready for review before confirmation from OpenQA, but the diff is minimal, so I assume it'll succeed)

deeplow · 2025-10-02T10:44:22Z

Also I think we can remove securedrop-qubesdb-tools from securedrop_salt/sd-base-template-packages.sls (IMO we don't need to actively clean it up right now).

I have included logic to remove it in sd-remove-whonix-packages.sls on an updater run. Are you suggesting we also remove that logic?

deeplow · 2025-10-02T10:46:10Z

Last thing, do you want to include a fix for #1410 in this? Or handle that separately?

Separately, I'd say. This PR is already trying to do too many changes at once.

deeplow · 2025-10-02T14:44:14Z

In case everything is addressed, prior to merging I'd like to:

do some light commit squashing
remove the OpenQA change here and have Remove sd-whonix set up openqa-tests-qubesos#3 approved

legoktm · 2025-10-02T16:34:27Z

I have included logic to remove it in sd-remove-whonix-packages.sls on an updater run. Are you suggesting we also remove that logic?

No, I got confused and thought it was being installed and it isn't.

legoktm

One more thing I think on the whonixless install and then we should be set

legoktm · 2025-10-02T16:32:22Z

        "Configure all SecureDrop Workstation VMs with service-specific configs",
        [q.name for q in Qubes().domains if "sd-workstation" in q.tags],
    )
+    configure("Disabling Whonix customizations", ["whonix-gateway-17"])


I still see a failure on a whonixless install, and I think this is the culprit, because configure() does run_cmd(["qvm-shutdown", "--wait", "--"] + targets), which fails with a non-zero exit because no such VM/template exists.

Maybe we can have configure learn some kind of skip_if_missing where it doesn't do anything if the target(s) don't exist?

(fwiw I commented out this line and then the install worked fine all the way through so this should be the last/only thing to fix)

I think this is kind off an edge-case that is going away pretty soon IMO. So my preference would be to just add an if before we go into that configure step. Once it goes away we just remove it. Otherwise we're adding logic to configure() to handle this specific situation, which we're unlikely to encounter in the future.

Works for me!

Because in general we do want the targets to exist, otherwise it may be doing something we don't want it to. But perhaps that's more on the testing territory.

Done in 4952035. Thanks for testing the code ahead of time :)

deeplow · 2025-10-02T17:34:38Z

I'll just re-arrange the PRs a tiny bit and force-push.

Removes sd-whonix from salt code, but adding steps to remove remove sd-whonix in perpetuity in the "sd-remove-unused-qubes". The rationale is that this should be kept as long as possible, since it's possible that some workstation may be "on the shelf" for some time, thus skipping upadtes. By keeping its removal in the code, we can catch these 'straggler' machines and ensure proper removal.

Please enter the commit message for your changes. Lines starting

(test on: openqa)

Reset whonix templates' 'kernelopts' via setting as *default* - removes 'apparmor=1 security=apparmor' - adds 'swiotlb=2048' (set by '*default*') - sys-whonix and other derived qubes inheirt kernelopts from their parent template, so they don't need to be explicitly reset. Rationale: when the SecureDrop Workstation used to make use of Whonix it had added additional apparmor entries to the qubes' kernelopts. Given that Whonix is no longer used, these modification should be removed. These changes were limited to Whonix 17. With future Whonix versions, we assume the workstation has not changed them. (test in: openqa)

'cmd.run' should be avoided but the native salt modules "pkg.del_repo" and "pkg.purge" are likely getting confused by the fact that the debian templates have both "dnf" and "apt" package managers. This happens in Qubes because when Debian qubes are used as default (e.g. for sys-firewall), they still need to enable dom0 to get updates (which are through dnf). Further diagnosis could be helpful, but these are temporary commands to be used until Whonix 17 reaches EOL. (test on: openqa)

Should no longer be present in template

Apt is the user-facing tool, whereas apt-get is the version of the tools that should be used for scripting.

Skip the configuration of Whonix qubes in system where they are not present. Saltstack supports "--targets" where the qubes don't exist (it's just a noop). The problem was with qvm-shutdown under "configure()". (test in: openqa)

deeplow · 2025-10-02T17:56:57Z

Rebase done and OpenQA commit removed. Feel free to give it the final stamp of approval @legoktm.

legoktm

LGTM, my whonixless fresh install worked :) ty!

deeplow added this to SecureDrop Aug 22, 2025

deeplow moved this to In Progress in SecureDrop Aug 22, 2025

deeplow force-pushed the 456-whonix-deprecation-part2 branch from 484f564 to 03cd0d6 Compare August 22, 2025 19:55

nathandyer moved this from In Progress to Blocked or Waiting in SecureDrop Aug 25, 2025

deeplow added this to the 1.4.0 milestone Sep 2, 2025

legoktm modified the milestones: 1.4.0, full whonix removal Sep 2, 2025

legoktm mentioned this pull request Sep 2, 2025

Consider disabling sys-whonix "auto-start" #1410

Open

legoktm force-pushed the 456-whonix-deprecation-part2 branch from 03cd0d6 to 941303f Compare September 12, 2025 21:43

deeplow self-assigned this Sep 23, 2025

deeplow force-pushed the 456-whonix-deprecation-part2 branch from 941303f to 2bae8b1 Compare September 24, 2025 15:05

deeplow force-pushed the 456-whonix-deprecation-part2 branch from 2bae8b1 to 868c5bb Compare September 24, 2025 17:28

deeplow moved this from Blocked or Waiting to In Progress in SecureDrop Sep 30, 2025

deeplow added a commit to freedomofpress/openqa-tests-qubesos that referenced this pull request Sep 30, 2025

Remove sd-whonix set up

7e5e35e

Sd-whonix will no longer present in the workstation code [1]. [1]: freedomofpress/securedrop-workstation#1415

deeplow mentioned this pull request Sep 30, 2025

Remove sd-whonix set up freedomofpress/openqa-tests-qubesos#3

Merged

deeplow commented Sep 30, 2025

View reviewed changes

deeplow force-pushed the 456-whonix-deprecation-part2 branch from ca30af6 to ef5451e Compare September 30, 2025 18:08

deeplow added 2 commits September 30, 2025 19:09

remove sd-whonix mentions in README

7679d74

Remove fpf packages and repo in whonix

a30bb5f

Try to remove the fpf packages and repo. Run this as the last step in configuration, adapted from the steps used to configure them in.

deeplow force-pushed the 456-whonix-deprecation-part2 branch 3 times, most recently from 42e699a to 2020070 Compare October 1, 2025 13:25

deeplow marked this pull request as ready for review October 1, 2025 13:27

deeplow requested a review from a team as a code owner October 1, 2025 13:27

deeplow moved this from In Progress to Ready For Review in SecureDrop Oct 1, 2025

deeplow force-pushed the 456-whonix-deprecation-part2 branch from d09e6e8 to 82a736d Compare October 2, 2025 10:47

legoktm requested changes Oct 2, 2025

View reviewed changes

deeplow force-pushed the 456-whonix-deprecation-part2 branch from 8ab89f3 to 109a910 Compare October 2, 2025 17:22

deeplow added 10 commits October 2, 2025 18:46

Fix tests after Whonix-related removals

a7d3637

Please enter the commit message for your changes. Lines starting

Remove remaining whonix_version references

ce4cdf5

Remove README sd-whonix reference

d002af6

(test on: openqa)

Add test to ensure proper reset of whonix qubes

2383947

Remove securedrop-qubesdb-tools package install

b712d53

Should no longer be present in template

Use apt-get instead of apt in whonix package removal

ef27c50

Apt is the user-facing tool, whereas apt-get is the version of the tools that should be used for scripting.

sdw-admin: skip whonix config. when non-existent

11698da

Skip the configuration of Whonix qubes in system where they are not present. Saltstack supports "--targets" where the qubes don't exist (it's just a noop). The problem was with qvm-shutdown under "configure()". (test in: openqa)

deeplow force-pushed the 456-whonix-deprecation-part2 branch from 4952035 to 11698da Compare October 2, 2025 17:55

legoktm approved these changes Oct 2, 2025

View reviewed changes

legoktm added this pull request to the merge queue Oct 2, 2025

Merged via the queue into main with commit 20c89cb Oct 2, 2025
14 checks passed

github-project-automation bot moved this from Under Review to Done in SecureDrop Oct 2, 2025

deeplow deleted the 456-whonix-deprecation-part2 branch October 3, 2025 07:20

nathandyer removed this from SecureDrop Oct 7, 2025

deeplow mentioned this pull request Oct 13, 2025

Release SecureDrop Workstation 1.5.0 (Keyring package + Remove remaining whonix refs) #1230

Closed

50 tasks

This was referenced Oct 21, 2025

Remove Whonix-related qubes and packages #1433

Closed

Remove dependency on Whonix and sd-whonix VM #456

Closed

Conversation

deeplow commented Aug 22, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Test plan

Checklist

Uh oh!

legoktm commented Sep 12, 2025

Uh oh!

deeplow commented Sep 24, 2025

Uh oh!

deeplow Sep 30, 2025

Choose a reason for hiding this comment

Uh oh!

deeplow commented Sep 30, 2025

Uh oh!

deeplow commented Sep 30, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

deeplow commented Oct 1, 2025

Uh oh!

deeplow commented Oct 2, 2025

Uh oh!

deeplow commented Oct 2, 2025

Uh oh!

deeplow commented Oct 2, 2025

Uh oh!

legoktm commented Oct 2, 2025

Uh oh!

legoktm left a comment

Choose a reason for hiding this comment

Uh oh!

legoktm Oct 2, 2025

Choose a reason for hiding this comment

Uh oh!

deeplow Oct 2, 2025

Choose a reason for hiding this comment

Uh oh!

legoktm Oct 2, 2025

Choose a reason for hiding this comment

Uh oh!

deeplow Oct 2, 2025

Choose a reason for hiding this comment

Uh oh!

deeplow Oct 2, 2025

Choose a reason for hiding this comment

Uh oh!

deeplow commented Oct 2, 2025

Uh oh!

deeplow commented Oct 2, 2025

Uh oh!

legoktm left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

deeplow commented Aug 22, 2025 •

edited

Loading

deeplow commented Sep 30, 2025 •

edited

Loading