Qubes 4.3 base compatibility

[deeplow]

Description of Changes

Towards #1245. Base Qubes 4.3 compatibility. Opening so we can iterate on OpenQA.

NOTES:

• Keeps Debian 12 templates -- even though debian 13 is officially installed in 4.3, debian 12 will still be available.
• Inplace upgrade from Qubes 4.2 is out of scope for this PR

Testing

Requirements:

• Debian 13 dev env is needed after 5ce36cb (or equivalent after rebase)
• Machine running Qubes 4.3 (but feel free to test on 4.2 first)

Preparation:

1. Follow tests in 4.2 machine
2. Install Qubes 4.3 and create workstation build environment
3. Temporary: until the fix debian-12-minimal in Qubes 4.3 has held broken Packages QubesOS/qubes-issues#10598 is in the stable repos, you need to enable debian-12-minimal's testing repos:
   • download debian-12-minimal template manually
   • in dom0: qvm-run -u root debian-12-minimal xterm
     • enable testing repos
     • sudo apt update && sudo apt upgrade
     • shut down template
4. sd-dev:
   • Set correct poetry env: poetry env use python3.13
   • Checkout out this branch
5. dom0:
   • Download and install dom0 keyring RPM (e.g. from 4.2 repos — it is not yet available in 4.3 repos)
   • make clone
   • make dev

Testing:

• Qubes 4.2: smoke testing workstation
• Qubes 4.3
  • make dev succeeds
  • Opening document in disposable makes use of preloaded disposable (document opens within ~5 seconds as opposed to the usual longer delay )

Deployment

Any special considerations for deployment? Consider both:

1. Upgrading existing pilot instances
2. New installs

Checklist

If you have made changes to the provisioning logic

• All tests (make test) pass in dom0

If you have added or removed files

• I have updated MANIFEST.in and rpm-build/SPECS/securedrop-workstation-dom0-config.spec

If documentation is required

• I have opened a PR in the docs repo for these changes, or will do so later
• I would appreciate help with the documentation

[deeplow]

This is now passing installation with a few hacks. It's only running into issues in the tests, but I haven't taken a look at those yet.

[legoktm]

Rebased on main. Note that it said:

dropping f79df8d Fix DeprecationWarning: The 'warn' method is deprec. -- patch contents already upstream

[legoktm]

This is really great, the inline comments are very minor. I was able to provision with make dev, have make test pass, and then the App worked fine, plus export + print.

I want to flag one thing that I'm not sure if it's a regression or not. I had two sd-viewer dispVMs open and then ran make test, which failed with:

FAILED tests/test_vms_exist.py::test_all_sdw_vms_present - AssertionError: assert {<qubesadmin.vm.QubesVM object at 0x7830b8121d90>, <qubesadmin.vm.QubesVM object at 0x7830c0b05ba0>, <qubesadmin.vm.QubesVM object at 0x7830b8122810>, <qubesadmin.vm.QubesVM object at 0x7830b8122690>, <qubesadmin.vm.QubesVM object at 0x7830b81bf6c0>, <qubesadmin.vm.QubesVM object at 0x7830b8122990>, <qubesadmin.vm.QubesVM object at 0x7830b81c5250>, <qubesadmin.vm.QubesVM object at 0x7830b8122750>, <qubesadmin.vm.QubesVM object at 0x7830b81228d0>, <qubesadmin.vm.QubesVM object at 0x7830b8122a50>, <qubesadmin.vm.QubesVM object at 0x7830b81225d0>, <qubesadmin.vm.QubesVM object at 0x7830b81aaa50>, <qubesadmin.vm.QubesVM object at 0x7830b81aaeb0>} == {'sd-devices-dvm', 'sd-large-bookworm-template', 'sd-devices', 'sd-small-bookworm-template', 'sd-proxy', 'sd-proxy-dvm', 'sd-viewer', 'sd-log', 'sd-gpg', 'sd-app', 'sd-base-bookworm-template'}
  
  Extra items in the left set:
  <qubesadmin.vm.QubesVM object at 0x7830c0b05ba0>
  <qubesadmin.vm.QubesVM object at 0x7830b81c5250>
  
  Full diff:
    {
  -     'sd-app',
  -     'sd-base-bookworm-template',
  -     'sd-devices',
  -     'sd-devices-dvm',
  -     'sd-gpg',
  -     'sd-large-bookworm-template',
  -     'sd-log',
  -     'sd-proxy',
  -     'sd-proxy-dvm',
  -     'sd-small-bookworm-template',
  -     'sd-viewer',
  +     <qubesadmin.vm.QubesVM object at 0x7830c0b05ba0>,
  +     <qubesadmin.vm.QubesVM object at 0x7830b81c5250>,
  +     <qubesadmin.vm.QubesVM object at 0x7830b81aaa50>,
  +     <qubesadmin.vm.QubesVM object at 0x7830b81aaeb0>,
  +     <qubesadmin.vm.QubesVM object at 0x7830b81bf6c0>,
  +     <qubesadmin.vm.QubesVM object at 0x7830b8121d90>,
  +     <qubesadmin.vm.QubesVM object at 0x7830b81225d0>,
  +     <qubesadmin.vm.QubesVM object at 0x7830b8122690>,
  +     <qubesadmin.vm.QubesVM object at 0x7830b8122750>,
  +     <qubesadmin.vm.QubesVM object at 0x7830b8122810>,
  +     <qubesadmin.vm.QubesVM object at 0x7830b81228d0>,
  +     <qubesadmin.vm.QubesVM object at 0x7830b8122990>,
  +     <qubesadmin.vm.QubesVM object at 0x7830b8122a50>,
    }

I assume the two extra objects are the two dispVMs, which I suppose should be ignored, or we need to set something is a subset of another set. Also it would be good to compare strings with strings, instead of relying on the casting. But if this isn't a regression I can just file it as a separate issue and we can land this.

[legoktm]

We also need to have infra update the CI labels, which we can ask them to do when this is approved and ready to land

[deeplow]

Extra items in the left set:
<qubesadmin.vm.QubesVM object at 0x7830c0b05ba0>
<qubesadmin.vm.QubesVM object at 0x7830b81c5250>

I assume the two extra objects are the two dispVMs, which I suppose should be ignored, or we need to set something is a subset of another set. Also it would be good to compare strings with strings, instead of relying on the casting. But if this isn't a regression I can just file it as a separate issue and we can land this

Being two, I'd guess as well that they are the preloaded ones, but supposedly the fixture sdw_tagged_vms does exclude preloaded qubes as you mention. Let's tackle this separately, if you're OK with it.

[legoktm]

LGTM!! Nice work :)

Will file a task with infra to get the labels updated so this can land.

[deeplow]

I want to flag one thing that I'm not sure if it's a regression or not. I had two sd-viewer dispVMs open and then ran make test, which failed with:

I have filed a follow-up issue on this #1571