Create Qubes developer workflow recommendations

[eloquence]

When it comes to quickly making and testing workstation (e.g., client) changes in Qubes, each developer currently follows slightly different workflows. This slows down development as devs navigate the complexity of Qubes, and can lead to unpredictable outcomes.

Instead, we want to create a more standardized developer workflow, which may necessitate changes to code or documentation. Two currently pending changes are:

• Uses tags for RPC grants denoting Client privileges #299 - Using tags for RPC grants denoting Client privileges
• Supports opening submissions in DispVMs from Qubes dev env securedrop-client#490 - Adding support for opening submissions in dispVMs from the dev env

Developer workflow recommendations should aim to ensure that developers have the option to reliably and predictably test changes in Qubes in a manner that closely resembles the production configuration.

Optimizing for doing all development work in Qubes is of a lower priority.

This issue should be consider resolved if:

• We have a set of clear recommendations, including on how to merge/re-scope the above PRs, and any additional near-term or long-term follow-up issues;
• We have discussed and agreed upon these recommendations (potentially in the SecureDrop engineering meeting on August 1), with or without modifications.

[sssoleileraaa]

Update

• [complete] Support added for the dev env in Qubes (see Supports opening submissions in DispVMs from Qubes dev env securedrop-client#490 and Uses tags for RPC grants denoting Client privileges #299)

  This includes client docs updates: https://github.com/freedomofpress/securedrop-client#comparison-of-developer-environments with a recommendation on how to test end-to-end

• [long-term follow-up issue] Split-gpg usage in the dev env is being tracked here Support qubes-split-gpg with run.sh in qubes securedrop-client#497 and any doc changes needed here: use split-gpg for dev env #303

• [near-term follow-up discussion] I'm not sure if updating securedrop-workstation readme, specifically the development section or the test section is needed. How we develop and test the client in Qubes makes more sense to me to remain entirely contained in the client repo. What do others think?

[eloquence]

I'm not sure if updating securedrop-workstation readme, specifically the development section or the test section is needed.

Agreed, we can just cross-reference the client README for detailed dev env instructions there.

Overall, I suggest we review the current state of the dev workflow with Jen in the engineering meeting on Thursday, and then we may be able to close out this ticket.

[sssoleileraaa]

Created freedomofpress/securedrop-client#507 for follow-up work and freedomofpress/securedrop-client#508 will close this issue, because it makes clearer our recommendations.