conorsch

global_lock released
do_balance()
balance(xen_free_memory=35843820, domain_dictionary={'24': {'last_target': 721125047, 'mem_used': 283856896, 'memory_current': 704278528, 'slow_memset_react': False, 'id': '24', 'memory_maximum': 786432000, 'memory_actual': 721125047, 'no_progress': False}, '128': {'last_target': 955639321, 'mem_used': 389140480, 'memory_current': 938901504, 'slow_memset_react': False, 'id': '128', 'memory_maximum': 4194304000, 'memory_actual': 955639321, 'no_progress': False}, '172': {'last_target': 808155535, 'mem_used': 322928640, 'memory_current': 791416832, 'slow_memset_react': False, 'id': '172', 'memory_maximum': 4194304000, 'memory_actual': 808155535, 'no_progress': False}, '171': {'last_target': 1480951661, 'mem_used': 624975872, 'memory_current': 1464107008, 'slow_memset_react': False, 'id': '171', 'memory_maximum': 4194304000, 'memory_actual': 1480951661, 'no_progress': False}, '17': {'last_target': 786432000, 'mem_used': 343920640, 'memory_current': 769589248, 'slow_memset_react':

conorsch

#!/usr/bin/env python3
"""
Utility script to reboot Qubes domains. Attempts
to perform a graceful shutdown, kills if shutdown fails,
then starts up. Inspiration for the timeout logic taken
from qubesadmin.tools.qvm_shutdown.main.
"""
import argparse
import time
from functools import partial

conorsch

#!/bin/bash
# Test script to evaluate the qrexec service for Qubes VMs,
# depending on virt_mode=(hvm|pvh). Starts several test-only VMs
# of both virt types, then executes a command inside of them and reports
# the time to completion of that command.


function run_cmd_in_vm() {
	vm_name="$1"
	shift

conorsch

#!/usr/bin/env python3
"""
Debugging script meant to reproduce the problems documented in
https://github.com/freedomofpress/securedrop-workstation/issues/590
"""
import logging
import subprocess
import sys
import os

conorsch

$ curl -s https://pressfreedomtracker.us/all-incidents/export/ | xsv frequency -s categories  | xsv select 2,3 | xsv table
value                                      count
Physical Attack                            265
Arrest / Criminal Charge                   100
Other Incident                             73
Subpoena / Legal Order                     71
Physical Attack, Equipment Damage          54
Denial of Access                           48
Chilling Statement                         42
Arrest / Criminal Charge, Physical Attack  35

conorsch

#!/bin/bash
# Helper script to query the SecureDrop Directory API,
# and display how many instances are serving Onion v3 URLs.
set -e
set -u
set -o pipefail


onion_info="$(curl -s https://securedrop.org/api/v1/directory/ | python3 -m json.tool | grep -i onion_address)"

conorsch

$ cat Dockerfile 
ARG DISTRO
FROM ubuntu:$DISTRO
ARG DISTRO
RUN apt-get update && apt-get install -y curl apt-transport-https gnupg2
RUN printf 'deb [arch=amd64] https://apt-test.freedom.press %s main\n' ${DISTRO} > /etc/apt/sources.list.d/apt-test.list
RUN curl -sL -o /tmp/apt-test.asc https://raw.githubusercontent.com/freedomofpress/securedrop/develop/install_files/ansible-base/roles/install-fpf-repo/files/apt-test-signing-key.pub
RUN apt-key add /tmp/apt-test.asc
RUN apt-get update
RUN apt-get download securedrop-config

conorsch

diff --git a/scripts/build-debianpackage b/scripts/build-debianpackage
index 3b7e521..e697eeb 100755
--- a/scripts/build-debianpackage
+++ b/scripts/build-debianpackage
@@ -83,7 +83,7 @@ function build_source_tarball() {
     rm -rf "$build_dir"
     git clone "$repo_url" "$build_dir"
 
-    if [[ -n "$PKG_GITREF" ]]; then
+    if [[ -n "${PKG_GITREF:-}" ]]; then

conorsch

def test_spectre_meltdown_checker(host):
    """
    Runs the "spectre-meltdown-checker" script to evaluate
    vulnerability for CPU side-channel attacks.
    """
    if not host.exists("/usr/bin/spectre-meltdown-checker"):
        warnings.warn("Installing spectre-meltdown-checker to run CPU tests")
        with host.sudo():
            host.run("apt-get install -y spectre-meltdown-checker")
    try:

conorsch

First, add the following to sys-net:/rw/config/suspend-module-blacklist:

iwlmvm
iwlwifi

Order is important. Then, copy this patch to sys-net, saving it as /home/user/prepare-suspend.patch: