This is mostly a copy of @eaon's change in securedrop-updater[1], with
one key change of normalizing the version down to a PEP 440 compatible
format.

Since we use setuptools's sdist to create a tarball and then expect
rpmbuild to be able to find it, we need to use a common version format
across both setuptools and RPM. Encoding the RC version in the `Release`
field has always been wrong, since that's used for changes to packaging,
not when the upstream (i.e. sdist tarball) changes.

This also means we no longer need to update `Source` in the release
branch to point at the tarball, since it can be inferred correctly from
the existing `%{name}-%{version}.tar.gz` macros.

Leave a TODO to switch to rpmdev-bumpspec which is the RPM `dch`
equivalent to bump the version and insert a changelog entry.

[1]
freedomofpress/securedrop-updater@42a55c7

Co-authored-by: Michael Z <michael@freedom.press>

Just set `Version` in RPM spec

The RPM build container needs to be highly trustworthy, so it should
only contain things from Fedora itself and any audited code. We don't
audit development dependencies, so we shouldn't be installing them into
the build container.

We split the container used by `./scripts/container.sh` into two, a
base, build container and then a container layered on top with dev
dependencies.

Functionally this should be a no-op since none of the dependencies are
used at build time but it cuts down on the risk of malicious code
injection.

Fixes freedomofpress#921.

…ilds

Don't install dev deps in the RPM build container

(cherry picked from commit d549929)

…0-changelog

Backport SecureDrop Workstation 0.9.0 changelog

…github-actions

Migrate to GitHub Actions

Enable dependabot for GitHub Actions

Bumps [actions/checkout](https://github.com/actions/checkout) from 3 to 4.
- [Release notes](https://github.com/actions/checkout/releases)
- [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md)
- [Commits](actions/checkout@v3...v4)

---
updated-dependencies:
- dependency-name: actions/checkout
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>

…github_actions/actions/checkout-4

Bump actions/checkout from 3 to 4

We have the CURRENT_FEDORA_VERSION/TEMPLATE constants for this purpose.

…edora

tests: Avoid repeating Fedora version in specific test

- Succeed if expected key is present in sd-gpg
- Fail if no key is present locally or remotely

Make `gpg` tests more resilient

Specify whonix template version and use qvm.template_installed to ensure it is present. Update migration flag and vm_tests.

Support Whonix 17

…rc1-bump

Update version to 0.10.0-rc1

…0.0-rc2-bump

[0.10.0] Version 0.10.0 rc2 bump

Securedrop Workstation 0.10.0