SecureDrop Workstation 1.0.2

(cherry picked from commit dae9bb2)
freedomofpress · Feb 13, 2025 · 6f80e6f · 6f80e6f
1 parent c0814d1
commit 6f80e6f
Show file tree

Hide file tree

Showing 3 changed files with 20 additions and 2 deletions.
diff --git a/VERSION b/VERSION
@@ -1 +1 @@
-1.0.0
+1.0.2
diff --git a/changelog.md b/changelog.md
@@ -1,5 +1,20 @@
 # changelog
 
+## 1.0.2
+
+This release is in response to a security issue in the logging component of
+SecureDrop Client (CVE-2025-24889), please see our advisory for more details.
+
+A manual step will be needed to apply this update; please follow
+[these instructions](https://workstation.securedrop.org/en/stable/admin/reference/troubleshooting_updates.html#expired-securedrop-signing-key)
+to retrieve the updated expiry date for our release signing key.
+If you need help or have any questions with this step, please reach out.
+
+* Recreate sd-log VM from scratch; save backup in new sd-retain-logvm VM
+* Update dom0 release signing key expiry to May 2027
+
+Note that the 1.0.1 version was skipped because of an issue while preparing this release.
+
 ## 1.0.0
 
 This is the first release targeting Qubes 4.2 and will require

diff --git a/rpm-build/SPECS/securedrop-workstation-dom0-config.spec b/rpm-build/SPECS/securedrop-workstation-dom0-config.spec
@@ -1,5 +1,5 @@
 Name:		securedrop-workstation-dom0-config
-Version:	1.0.0
+Version:	1.0.2
 Release:	1%{?dist}
 Summary:	SecureDrop Workstation
 
@@ -178,6 +178,9 @@ if [ $1 -eq 0 ]; then
 fi
 
 %changelog
+* Mon Feb 10 2025 SecureDrop Team <securedrop@freedom.press> - 1.0.2
+- See changelog.md
+
 * Thu Jul 11 2024 SecureDrop Team <securedrop@freedom.press> - 1.0.0
 - See changelog.md