Support Whonix 17

[rocodes]

Status

Ready for review

Description of Changes

Fixes #934
Towards #937

Changes proposed in this pull request:

• [qubes 4.1] Upgrade to whonix-workstation-17 and whonix-gateway-17
• Move apparmor config of whonix templates from dom0-files sls to whonix vm config file

Testing

Upgrade scenario (Qubes 4.1, no whonix-17 templates installed)

• Check out this branch and build an rpm, then install it in dom0 and run sdw-admin --apply.
• Whonix-17-* templates downloaded
• apply completes successfully; anon-whonix
• dom0 tests pass (relevant ones: sd-whonix template is whonix-gateway-17, kernelopts for sd-whonix and whonix templates show apparmor enabled)

Other scenarios (eg templates already downloaded)

• apply completes successfully

Deployment

• TK

Any special considerations for deployment? Consider both:

1. Upgrading existing pilot instances
2. New installs

Checklist

If you have made changes to the provisioning logic

• All tests (make test) pass in dom0

If you have added or removed files

• I have updated MANIFEST.in and rpm-build/SPECS/securedrop-workstation-dom0-config.spec : n/a

If documentation is required

• I have opened a PR in the docs repo for these changes, or will do so later
• I would appreciate help with the documentation

[zenmonkeykstop]

Tested again (with rpm built from 9fa6c15):

• installed 4.1
• installed prod rpm and ran sdwadmin --apply
• built test rpm and installed over prod one
• ran sdw-admin --apply again
  • install run completed successfully
  • whonix-17 templates installed (from testing repo)
  • sd-whonix now using whonix 17 gateway as template
  • Updater triggered after reboot and completed successfully
  • make test run (against latest version of branch to pull in above changes) - only failing test is test_sd_whonix_repo_enabled (known, to be flagged upstream)

[zenmonkeykstop]

(This is another example of where it would be good to have clean CI environments - unless we include salt logic to remove the whonix-17 templates, they're now already present on the runner.)

[rocodes]

Agreed, the test failing is a red herring and is because the old template is still being used. Just downloaded the prod templates and they do have /etc/apt/sources.list.d/derivative.list.

[zenmonkeykstop]

Approving based on previous test results, visual inspection post-rebase.