Release 0.9.76 discussion

[kmk3]

Release links:

• Project board: Release 0.9.76
• GitHub Release: https://github.com/netblue30/firejail/releases/tag/0.9.76

Discussion for the previous release:

• Release 0.9.74 discussion #5597

Discussion for the next release:

• Release 0.9.78 discussion #6841

Discussions for this release:

• Create a GitHub Project for 0.9.76 #6695
• Update Debian package to 0.9.76 #6842
• Update Ubuntu PPA to 0.9.76 #7060
• Differing sigining key of latest 0.9.76 release #6847

Release checklist:

• Add a link to the previous discussion above
• Create a GitHub Project for this release and link it above
• Complete RELNOTES: https://github.com/netblue30/firejail/commits/0.9.76-rc4
• Complete README: https://github.com/netblue30/firejail/commits/0.9.76-rc4
• Update the release version and date in the RELNOTES
• Create an annotated git tag and push it (git tag -s or git tag -a)
• Create a new GitHub Release and link it above

Post-release checklist:

• Update the supported versions in SECURITY.md
• Bump the current version in configure.ac/configure
• Add a new WIP release in the RELNOTES
• Update the released/current versions in README.md
• Create a discussion for the next release and link it above
• Update or create an issue for updating the Debian / Ubuntu PPA packages and link it above
• Close this discussion

[kmk3]

@netblue30

The following xorg change seems to have broken many/most profiles for GUI
programs (now fixed in #6775):

• xkeyboard-config 2.45: cannot start many programs (new /usr/share path) #6773

Thoughts on creating a new release soon?

Also, can you try creating a signed git tag again (if not for the release
itself, maybe for rc1)?

It should work just as well as ./mkasc.sh.

Example:

git tag -s 0.9.76

Or:

git tag -u $keyid 0.9.76

If that fails, it can be an annotated tag:

git tag -a 0.9.76

[kmk3]

Tagged rc4:

• https://github.com/netblue30/firejail/tree/0.9.76-rc4

Still no response and no new activity for a week, so I sent an email to
@netblue30, maybe that works.

@SkewedZeppelin

If you think that a full release is too much, how about creating a bugfix
release (such as 0.9.74.2) with just the fix from #6775?

Or maybe just the most basic bugfixes:

• bugfix: fix flock debug messages going to stderr #6712
• bugfix: fix "Not enforcing Landlock" message always being printed #6806
• profiles: wusc: add /usr/share/xkeyboard-config-2 #6775

From looking at the git tags, these appear to be the most recent bugfix
releases:

• https://github.com/netblue30/firejail/tree/0.9.64.2
• https://github.com/netblue30/firejail/tree/0.9.64.4

@rusty-snake Any thoughts?

[SkewedZeppelin]

I'll sign the tag if you want to prepare a full release.

[kmk3]

Considering potential issues in the release, from looking at the RELNOTES the
main breaking change likely would be turning notpm into keep-dev-tpm:

• modif: block TPM devices & turn notpm command into keep-dev-tpm #6698

Though notpm was only added in 0.9.74 and currently it is just ignored with a
warning, so no user profiles should break due to an invalid command (this is
mostly a change in the default behavior). And if a profile requires tpm
devices, users can just add keep-dev-tpm to it.

Otherwise this release contains mostly bugfixes and cleanups, plus a few small
features, so I don't anticipate any major new issues.

I'll sign the tag if you want to prepare a full release.

Sounds good to me, thanks!

Before creating the tag, could you update the -- line in the RELNOTES
(user/email/date)? I think having a recent date also prevents a warning in
lintian.

Let me know if you'll also create the GitHub Release.

Or just comment when the tag is pushed and I can create it afterwards.

[SkewedZeppelin]

https://github.com/netblue30/firejail/releases/tag/0.9.76

[kmk3]

https://github.com/netblue30/firejail/releases/tag/0.9.76

Looks good, thanks!