freedomofpress · herbenderbler · Apr 28, 2026
@@ -0,0 +1,49 @@
+# Reusable: build debs and upload one artifact with build/<ubuntu_version>/ and
+# build/trixie/ (trixie admin deb is venv-ABI-required by the trixie GCE host).
+name: Build Debian packages
+
+on:
+  workflow_call:
+    inputs:
+      ubuntu_version:
+        required: true
+        type: string
+      python_version:
+        required: true
+        type: string
+      artifact_name:
+        required: true
+        type: string
+
+jobs:
+  package:
+    runs-on: ubuntu-24.04
+    outputs:
+      artifact_id: ${{ steps.upload.outputs.artifact-id }}
+    steps:
+      - uses: actions/checkout@v6
+        with:
+          persist-credentials: false
+      - uses: actions/setup-python@v6
+        with:
+          python-version: ${{ inputs.python_version }}
+      - name: Build SecureDrop packages
+        run: |
+          OS_VERSION=${{ inputs.ubuntu_version }} ./builder/build-debs.sh
+      - name: Build OSSEC packages
+        run: |
+          OS_VERSION=${{ inputs.ubuntu_version }} WHAT=ossec ./builder/build-debs.sh
+      - name: Build admin packages
+        run: |
+          OS_VERSION=${{ inputs.ubuntu_version }} WHAT=admin ./builder/build-debs.sh
+      - name: Build admin packages (trixie)
+        run: |
+          OS_VERSION=trixie WHAT=admin ./builder/build-debs.sh
+      - uses: actions/upload-artifact@v7
+        id: upload
+        with:
+          name: ${{ inputs.artifact_name }}
+          path: |
+            build/${{ inputs.ubuntu_version }}
+            build/trixie
+          if-no-files-found: error
@@ -2,7 +2,7 @@ name: Package builds
 on:
   merge_group:
   push:
-    branches: ["develop", "release/**"]
+    branches: ["develop", "release/**", "stg-*"]
   pull_request:
     types: ["opened", "synchronize"]
 
@@ -24,31 +24,11 @@ jobs:
           - ubuntu: noble
             python: "3.12"
     # TODO: change this back to ubuntu-latest once it is consistently 24.04
-    runs-on: ubuntu-24.04
-    outputs:
-      artifact_id: ${{ steps.upload.outputs.artifact-id }}
-    steps:
-      - uses: actions/checkout@v6
-        with:
-          persist-credentials: false
-      - uses: actions/setup-python@v6
-        with:
-          python-version: ${{ matrix.versions.python }}
-      - name: Build SecureDrop packages
-        run: |
-          OS_VERSION=${{ matrix.versions.ubuntu }} ./builder/build-debs.sh
-      - name: Build OSSEC packages
-        run: |
-          OS_VERSION=${{ matrix.versions.ubuntu }} WHAT=ossec ./builder/build-debs.sh
-      - name: Build admin packages
-        run: |
-          OS_VERSION=${{ matrix.versions.ubuntu }} WHAT=admin ./builder/build-debs.sh
-      - uses: actions/upload-artifact@v7
-        id: upload
-        with:
-          name: ${{ matrix.versions.ubuntu }}-${{ matrix.build }}
-          path: build/${{ matrix.versions.ubuntu }}
-          if-no-files-found: error
+    uses: ./.github/workflows/build-debs-reusable.yml
+    with:
+      ubuntu_version: ${{ matrix.versions.ubuntu }}
+      python_version: ${{ matrix.versions.python }}
+      artifact_name: ${{ matrix.versions.ubuntu }}-${{ matrix.build }}
 
   reproducible-debs:
     strategy:
@@ -72,6 +52,10 @@ jobs:
           # FIXME: securedrop-app-code isn't reproducible
           for pkg in ossec-agent ossec-server securedrop-config securedrop-keyring securedrop-ossec-agent securedrop-ossec-server securedrop-admin
           do
-              echo "Checking ${pkg}..."
-              diffoscope ${{ matrix.ubuntu_version }}-one/${pkg}_*.deb ${{ matrix.ubuntu_version }}-two/${pkg}_*.deb
+              echo "Checking ${pkg} (${{ matrix.ubuntu_version }})..."
+              diffoscope ${{ matrix.ubuntu_version }}-one/${{ matrix.ubuntu_version }}/${pkg}_*.deb \
+                         ${{ matrix.ubuntu_version }}-two/${{ matrix.ubuntu_version }}/${pkg}_*.deb
           done
+          echo "Checking securedrop-admin (trixie)..."
+          diffoscope ${{ matrix.ubuntu_version }}-one/trixie/securedrop-admin_*.deb \
+                     ${{ matrix.ubuntu_version }}-two/trixie/securedrop-admin_*.deb
@@ -1,3 +1,6 @@
+# Reuse the Package builds artifact for github.sha when available; otherwise
+# build via the same reusable workflow. The staging job sees one artifact
+# (staging-debs-noble) containing build/noble/* and build/trixie/*.
 name: Staging
 on:
   push:
@@ -6,9 +9,100 @@ on:
       - 'release/*'
   schedule:
     - cron: '0 3 * * *'
+  workflow_dispatch:
+
+defaults:
+  run:
+    shell: bash
 
 jobs:
+  resolve-debs:
+    runs-on: ubuntu-latest
+    permissions:
+      actions: read
+    outputs:
+      reused: ${{ steps.lookup.outputs.reused }}
+    steps:
+      - name: Try to reuse Package builds artifact
+        id: lookup
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          GH_REPO: ${{ github.repository }}
+          COMMIT_SHA: ${{ github.sha }}
+        run: |
+          set -euxo pipefail
+
+          # Look for a successful build.yml run for this SHA.
+          find_successful_run() {
+            gh run list --repo "${GH_REPO}" --workflow=build.yml \
+              --commit "${COMMIT_SHA}" -L 50 --json databaseId,conclusion \
+              --jq '.[] | select(.conclusion == "success") | .databaseId' | head -1
+          }
+
+          # Check whether a build.yml run is still in progress or queued.
+          has_pending_run() {
+            local pending
+            pending=$(gh run list --repo "${GH_REPO}" --workflow=build.yml \
+              --commit "${COMMIT_SHA}" -L 50 --json databaseId,conclusion,status \
+              --jq '[.[] | select(.status == "in_progress" or .status == "queued")] | length')
+            [[ "${pending}" -gt 0 ]]
+          }
+
+          RUN_ID=$(find_successful_run)
+
+          # If no successful run yet, wait for any in-progress/queued run to finish.
+          if [[ -z "${RUN_ID}" ]] && has_pending_run; then
+            echo "build.yml is still running for ${COMMIT_SHA}; waiting..."
+            MAX_ATTEMPTS=30
+            for ((i=1; i<=MAX_ATTEMPTS; i++)); do
+              sleep 30
+              RUN_ID=$(find_successful_run)
+              if [[ -n "${RUN_ID}" ]]; then
+                echo "build.yml succeeded after ${i} poll(s)."
+                break
+              fi
+              if ! has_pending_run; then
+                echo "build.yml finished without success."
+                break
+              fi
+              echo "Poll ${i}/${MAX_ATTEMPTS}: still waiting..."
+            done
+          fi
+
+          if [[ -z "${RUN_ID}" ]]; then
+            echo "reused=false" >> "${GITHUB_OUTPUT}"
+            exit 0
+          fi
+          mkdir -p build
+          gh run download "${RUN_ID}" --repo "${GH_REPO}" --name noble-one -D build
+          echo "reused=true" >> "${GITHUB_OUTPUT}"
+      - name: Re-upload as staging-debs-noble
+        if: steps.lookup.outputs.reused == 'true'
+        uses: actions/upload-artifact@v7
+        with:
+          name: staging-debs-noble
+          path: |
+            build/noble
+            build/trixie
+          if-no-files-found: error
+
+  build-debs:
+    needs: resolve-debs
+    if: needs.resolve-debs.outputs.reused != 'true'
+    uses: ./.github/workflows/build-debs-reusable.yml
+    with:
+      ubuntu_version: noble
+      python_version: "3.12"
+      artifact_name: staging-debs-noble
+
   staging:
+    needs:
+      - resolve-debs
+      - build-debs
+    if: |
+      always() &&
+      !cancelled() &&
+      (needs.resolve-debs.outputs.reused == 'true' || needs.build-debs.result == 'success')
     strategy:
       fail-fast: false
       matrix:
@@ -17,10 +111,15 @@ jobs:
     env:
       GOOGLE_CREDENTIALS: ${{ secrets.GOOGLE_CREDENTIALS }}
       UBUNTU_VERSION: ${{ matrix.ubuntu_version }}
+      CI_PREBUILT_DEBS: "1"
     steps:
       - uses: actions/checkout@v6
         with:
           persist-credentials: false
+      - uses: actions/download-artifact@v8
+        with:
+          name: staging-debs-noble
+          path: build
       - name: Run staging tests on GCE
         run: |
           make ci-go

@@ -44,7 +44,7 @@ COPY . /src
 ENV PATH="/usr/share/securedrop-admin/venv/bin:$PATH"
 RUN ln -s /src/builder/fixup-changelog.sh /fixup-changelog
 RUN /src/builder/build-debs-admin.sh
-RUN apt-get -y update && apt-get install -y /src/build/trixie/securedrop-admin_*+trixie_amd64.deb
+RUN apt-get install -y /src/build/trixie/securedrop-admin_*+trixie_amd64.deb
 
 # Install dev dependencies in a separate venv
 RUN /usr/bin/python3 -m venv /opt/admin-dev/venv

@@ -1,5 +1,5 @@
 #!/bin/bash
-# shellcheck disable=SC2317
+# shellcheck disable=SC2317,SC2329
 # Verifies a key at at given path matches a fingerprint
 # Does so by importing the key into gpg2 and checking output
 #

@@ -1,20 +1,8 @@
-securedrop-admin (2.16.0~rc1) unstable; urgency=medium
+securedrop-admin (2.15.0~rc1) unstable; urgency=medium
 
-  * 
+  *
 
- -- SecureDrop Team <securedrop@freedom.press>  Thu, 16 Apr 2026 10:39:18 -0700
-
-securedrop-admin (2.15.1) unstable; urgency=medium
-
-  * see changelog.md
-
- -- SecureDrop Team <securedrop@freedom.press>  Wed, 22 Apr 2026 22:59:13 -0700
-
-securedrop-admin (2.15.0) unstable; urgency=medium
-
-  * see changelog.md
-
- -- SecureDrop Team <securedrop@freedom.press>  Wed, 15 Apr 2026 11:30:56 -0700
+ -- SecureDrop Team <securedrop@freedom.press>  Fri, 20 Feb 2026 11:43:01 -0500
 
 securedrop-admin (2.14.0) unstable; urgency=medium
 

@@ -1,5 +1,5 @@
 ansible==8.7.0
-cryptography>=46.0.6  # >= for CVE-2026-34073
+cryptography>=46.0.5  # >= for CVE-2026-26007
 jinja2>=3.1.6
 netaddr
 markupsafe>=3.0

@@ -154,56 +154,56 @@ cffi==2.0.0 \
     #   -r requirements.in
     #   cryptography
     #   pynacl
-cryptography==46.0.6 \
-    --hash=sha256:02fad249cb0e090b574e30b276a3da6a149e04ee2f049725b1f69e7b8351ec70 \
-    --hash=sha256:063b67749f338ca9c5a0b7fe438a52c25f9526b851e24e6c9310e7195aad3b4d \
-    --hash=sha256:12cae594e9473bca1a7aceb90536060643128bb274fcea0fc459ab90f7d1ae7a \
-    --hash=sha256:12f0fa16cc247b13c43d56d7b35287ff1569b5b1f4c5e87e92cc4fcc00cd10c0 \
-    --hash=sha256:22259338084d6ae497a19bae5d4c66b7ca1387d3264d1c2c0e72d9e9b6a77b97 \
-    --hash=sha256:26031f1e5ca62fcb9d1fcb34b2b60b390d1aacaa15dc8b895a9ed00968b97b30 \
-    --hash=sha256:27550628a518c5c6c903d84f637fbecf287f6cb9ced3804838a1295dc1fd0759 \
-    --hash=sha256:2b417edbe8877cda9022dde3a008e2deb50be9c407eef034aeeb3a8b11d9db3c \
-    --hash=sha256:2ea0f37e9a9cf0df2952893ad145fd9627d326a59daec9b0802480fa3bcd2ead \
-    --hash=sha256:2ef9e69886cbb137c2aef9772c2e7138dc581fad4fcbcf13cc181eb5a3ab6275 \
-    --hash=sha256:341359d6c9e68834e204ceaf25936dffeafea3829ab80e9503860dcc4f4dac58 \
-    --hash=sha256:380343e0653b1c9d7e1f55b52aaa2dbb2fdf2730088d48c43ca1c7c0abb7cc2f \
-    --hash=sha256:3c21d92ed15e9cfc6eb64c1f5a0326db22ca9c2566ca46d845119b45b4400361 \
-    --hash=sha256:3dfa6567f2e9e4c5dceb8ccb5a708158a2a871052fa75c8b78cb0977063f1507 \
-    --hash=sha256:456b3215172aeefb9284550b162801d62f5f264a081049a3e94307fe20792cfa \
-    --hash=sha256:4668298aef7cddeaf5c6ecc244c2302a2b8e40f384255505c22875eebb47888b \
-    --hash=sha256:50575a76e2951fe7dbd1f56d181f8c5ceeeb075e9ff88e7ad997d2f42af06e7b \
-    --hash=sha256:639301950939d844a9e1c4464d7e07f902fe9a7f6b215bb0d4f28584729935d8 \
-    --hash=sha256:64235194bad039a10bb6d2d930ab3323baaec67e2ce36215fd0952fad0930ca8 \
-    --hash=sha256:6617f67b1606dfd9fe4dbfa354a9508d4a6d37afe30306fe6c101b7ce3274b72 \
-    --hash=sha256:67177e8a9f421aa2d3a170c3e56eca4e0128883cf52a071a7cbf53297f18b175 \
-    --hash=sha256:6728c49e3b2c180ef26f8e9f0a883a2c585638db64cf265b49c9ba10652d430e \
-    --hash=sha256:6739d56300662c468fddb0e5e291f9b4d084bead381667b9e654c7dd81705124 \
-    --hash=sha256:69cf0056d6947edc6e6760e5f17afe4bea06b56a9ac8a06de9d2bd6b532d4f3a \
-    --hash=sha256:760997a4b950ff00d418398ad73fbc91aa2894b5c1db7ccb45b4f68b42a63b3c \
-    --hash=sha256:79e865c642cfc5c0b3eb12af83c35c5aeff4fa5c672dc28c43721c2c9fdd2f0f \
-    --hash=sha256:7e6142674f2a9291463e5e150090b95a8519b2fb6e6aaec8917dd8d094ce750d \
-    --hash=sha256:7f417f034f91dcec1cb6c5c35b07cdbb2ef262557f701b4ecd803ee8cefed4f4 \
-    --hash=sha256:7f6690b6c55e9c5332c0b59b9c8a3fb232ebf059094c17f9019a51e9827df91c \
-    --hash=sha256:8927ccfbe967c7df312ade694f987e7e9e22b2425976ddbf28271d7e58845290 \
-    --hash=sha256:8ce35b77aaf02f3b59c90b2c8a05c73bac12cea5b4e8f3fbece1f5fddea5f0ca \
-    --hash=sha256:8e7304c4f4e9490e11efe56af6713983460ee0780f16c63f219984dab3af9d2d \
-    --hash=sha256:90e5f0a7b3be5f40c3a0a0eafb32c681d8d2c181fc2a1bdabe9b3f611d9f6b1a \
-    --hash=sha256:97c8115b27e19e592a05c45d0dd89c57f81f841cc9880e353e0d3bf25b2139ed \
-    --hash=sha256:9a693028b9cbe51b5a1136232ee8f2bc242e4e19d456ded3fa7c86e43c713b4a \
-    --hash=sha256:9a9c42a2723999a710445bc0d974e345c32adfd8d2fac6d8a251fa829ad31cfb \
-    --hash=sha256:a3e84d5ec9ba01f8fd03802b2147ba77f0c8f2617b2aff254cedd551844209c8 \
-    --hash=sha256:aad75154a7ac9039936d50cf431719a2f8d4ed3d3c277ac03f3339ded1a5e707 \
-    --hash=sha256:b12c6b1e1651e42ab5de8b1e00dc3b6354fdfd778e7fa60541ddacc27cd21410 \
-    --hash=sha256:b928a3ca837c77a10e81a814a693f2295200adb3352395fad024559b7be7a736 \
-    --hash=sha256:bcb87663e1f7b075e48c3be3ecb5f0b46c8fc50b50a97cf264e7f60242dca3f2 \
-    --hash=sha256:c797e2517cb7880f8297e2c0f43bb910e91381339336f75d2c1c2cbf811b70b4 \
-    --hash=sha256:c89eb37fae9216985d8734c1afd172ba4927f5a05cfd9bf0e4863c6d5465b013 \
-    --hash=sha256:cdcd3edcbc5d55757e5f5f3d330dd00007ae463a7e7aa5bf132d1f22a4b62b19 \
-    --hash=sha256:d24c13369e856b94892a89ddf70b332e0b70ad4a5c43cf3e9cb71d6d7ffa1f7b \
-    --hash=sha256:d4e4aadb7fc1f88687f47ca20bb7227981b03afaae69287029da08096853b738 \
-    --hash=sha256:d9528b535a6c4f8ff37847144b8986a9a143585f0540fbcb1a98115b543aa463 \
-    --hash=sha256:ed3775295fb91f70b4027aeba878d79b3e55c0b3e97eaa4de71f8f23a9f2eb77 \
-    --hash=sha256:ed418c37d095aeddf5336898a132fba01091f0ac5844e3e8018506f014b6d2c4
+cryptography==46.0.5 \
+    --hash=sha256:02f547fce831f5096c9a567fd41bc12ca8f11df260959ecc7c3202555cc47a72 \
+    --hash=sha256:039917b0dc418bb9f6edce8a906572d69e74bd330b0b3fea4f79dab7f8ddd235 \
+    --hash=sha256:1abfdb89b41c3be0365328a410baa9df3ff8a9110fb75e7b52e66803ddabc9a9 \
+    --hash=sha256:2ae6971afd6246710480e3f15824ed3029a60fc16991db250034efd0b9fb4356 \
+    --hash=sha256:2b7a67c9cd56372f3249b39699f2ad479f6991e62ea15800973b956f4b73e257 \
+    --hash=sha256:351695ada9ea9618b3500b490ad54c739860883df6c1f555e088eaf25b1bbaad \
+    --hash=sha256:38946c54b16c885c72c4f59846be9743d699eee2b69b6988e0a00a01f46a61a4 \
+    --hash=sha256:3b4995dc971c9fb83c25aa44cf45f02ba86f71ee600d81091c2f0cbae116b06c \
+    --hash=sha256:3ce58ba46e1bc2aac4f7d9290223cead56743fa6ab94a5d53292ffaac6a91614 \
+    --hash=sha256:3ee190460e2fbe447175cda91b88b84ae8322a104fc27766ad09428754a618ed \
+    --hash=sha256:4108d4c09fbbf2789d0c926eb4152ae1760d5a2d97612b92d508d96c861e4d31 \
+    --hash=sha256:420d0e909050490d04359e7fdb5ed7e667ca5c3c402b809ae2563d7e66a92229 \
+    --hash=sha256:47fb8a66058b80e509c47118ef8a75d14c455e81ac369050f20ba0d23e77fee0 \
+    --hash=sha256:4c3341037c136030cb46e4b1e17b7418ea4cbd9dd207e4a6f3b2b24e0d4ac731 \
+    --hash=sha256:4d7e3d356b8cd4ea5aff04f129d5f66ebdc7b6f8eae802b93739ed520c47c79b \
+    --hash=sha256:4d8ae8659ab18c65ced284993c2265910f6c9e650189d4e3f68445ef82a810e4 \
+    --hash=sha256:4e817a8920bfbcff8940ecfd60f23d01836408242b30f1a708d93198393a80b4 \
+    --hash=sha256:50bfb6925eff619c9c023b967d5b77a54e04256c4281b0e21336a130cd7fc263 \
+    --hash=sha256:556e106ee01aa13484ce9b0239bca667be5004efb0aabbed28d353df86445595 \
+    --hash=sha256:582f5fcd2afa31622f317f80426a027f30dc792e9c80ffee87b993200ea115f1 \
+    --hash=sha256:5be7bf2fb40769e05739dd0046e7b26f9d4670badc7b032d6ce4db64dddc0678 \
+    --hash=sha256:60ee7e19e95104d4c03871d7d7dfb3d22ef8a9b9c6778c94e1c8fcc8365afd48 \
+    --hash=sha256:61aa400dce22cb001a98014f647dc21cda08f7915ceb95df0c9eaf84b4b6af76 \
+    --hash=sha256:68f68d13f2e1cb95163fa3b4db4bf9a159a418f5f6e7242564fc75fcae667fd0 \
+    --hash=sha256:7d1f30a86d2757199cb2d56e48cce14deddf1f9c95f1ef1b64ee91ea43fe2e18 \
+    --hash=sha256:7d731d4b107030987fd61a7f8ab512b25b53cef8f233a97379ede116f30eb67d \
+    --hash=sha256:803812e111e75d1aa73690d2facc295eaefd4439be1023fefc4995eaea2af90d \
+    --hash=sha256:80a8d7bfdf38f87ca30a5391c0c9ce4ed2926918e017c29ddf643d0ed2778ea1 \
+    --hash=sha256:8293f3dea7fc929ef7240796ba231413afa7b68ce38fd21da2995549f5961981 \
+    --hash=sha256:8456928655f856c6e1533ff59d5be76578a7157224dbd9ce6872f25055ab9ab7 \
+    --hash=sha256:890bcb4abd5a2d3f852196437129eb3667d62630333aacc13dfd470fad3aaa82 \
+    --hash=sha256:94a76daa32eb78d61339aff7952ea819b1734b46f73646a07decb40e5b3448e2 \
+    --hash=sha256:9f16fbdf4da055efb21c22d81b89f155f02ba420558db21288b3d0035bafd5f4 \
+    --hash=sha256:a3d1fae9863299076f05cb8a778c467578262fae09f9dc0ee9b12eb4268ce663 \
+    --hash=sha256:a3d507bb6a513ca96ba84443226af944b0f7f47dcc9a399d110cd6146481d24c \
+    --hash=sha256:abace499247268e3757271b2f1e244b36b06f8515cf27c4d49468fc9eb16e93d \
+    --hash=sha256:ba2a27ff02f48193fc4daeadf8ad2590516fa3d0adeeb34336b96f7fa64c1e3a \
+    --hash=sha256:bc84e875994c3b445871ea7181d424588171efec3e185dced958dad9e001950a \
+    --hash=sha256:bfd56bb4b37ed4f330b82402f6f435845a5f5648edf1ad497da51a8452d5d62d \
+    --hash=sha256:c18ff11e86df2e28854939acde2d003f7984f721eba450b56a200ad90eeb0e6b \
+    --hash=sha256:c3bcce8521d785d510b2aad26ae2c966092b7daa8f45dd8f44734a104dc0bc1a \
+    --hash=sha256:c4143987a42a2397f2fc3b4d7e3a7d313fbe684f67ff443999e803dd75a76826 \
+    --hash=sha256:c69fd885df7d089548a42d5ec05be26050ebcd2283d89b3d30676eb32ff87dee \
+    --hash=sha256:ced80795227d70549a411a4ab66e8ce307899fad2220ce5ab2f296e687eacde9 \
+    --hash=sha256:d66e421495fdb797610a08f43b05269e0a5ea7f5e652a89bfd5a7d3c1dee3648 \
+    --hash=sha256:d861ee9e76ace6cf36a6a89b959ec08e7bc2493ee39d07ffe5acb23ef46d27da \
+    --hash=sha256:e9251e3be159d1020c4030bd2e5f84d6a43fe54b6c19c12f51cde9542a2817b2 \
+    --hash=sha256:f145bba11b878005c496e93e257c1e88f154d278d2638e6450d17e0f31e558d2 \
+    --hash=sha256:fe346b143ff9685e40192a4960938545c699054ba11d4f9029f94751e3f71d87
     # via
     #   -r requirements-ansible.in
     #   ansible-core