Merge 6cb9f46cae into c1cf16a705

.github/workflows/build.yml

@@ -33,6 +33,8 @@ jobs:
             version: "20.04"
           - distro: ubuntu
             version: "22.04"
+          - distro: ubuntu
+            version: "23.10"
           - distro: ubuntu
             version: "24.04"
           - distro: ubuntu

.github/workflows/check_repos.yml

@@ -23,6 +23,8 @@ jobs:
             version: "24.10"  # oracular
           - distro: ubuntu
             version: "24.04"  # noble
+          - distro: ubuntu
+            version: "23.10"  # mantic
           - distro: ubuntu
             version: "22.04"  # jammy
           - distro: ubuntu

.github/workflows/ci.yml

@@ -159,6 +159,8 @@ jobs:
             version: "20.04"
           - distro: ubuntu
             version: "22.04"
+          - distro: ubuntu
+            version: "23.10"
           - distro: ubuntu
             version: "24.04"
           - distro: ubuntu
@@ -227,6 +229,8 @@ jobs:
             version: "20.04"
           - distro: ubuntu
             version: "22.04"
+          - distro: ubuntu
+            version: "23.10"
           - distro: ubuntu
             version: "24.04"
           - distro: ubuntu
@@ -346,6 +350,8 @@ jobs:
             version: "20.04"
           - distro: ubuntu
             version: "22.04"
+          - distro: ubuntu
+            version: "23.10"
           - distro: ubuntu
             version: "24.04"
           - distro: ubuntu

INSTALL.md

@@ -11,6 +11,7 @@ an isolated environment. It will be installed automatically when installing Dang
 Dangerzone is available for:
 - Ubuntu 24.10 (oracular)
 - Ubuntu 24.04 (noble)
+- Ubuntu 23.10 (mantic)
 - Ubuntu 22.04 (jammy)
 - Ubuntu 20.04 (focal)
 - Debian 13 (trixie)

dangerzone/gvisor_wrapper/entrypoint.py

@@ -142,6 +142,9 @@ runsc_argv = [
     "--rootless=true",
     "--network=none",
     "--root=/home/dangerzone/.containers",
+    # Disable DirectFS for to make the seccomp filter even stricter,
+    # at some performance cost.
+    "--directfs=false",
 ]
 if os.environ.get("RUNSC_DEBUG"):
     runsc_argv += ["--debug=true", "--alsologtostderr=true"]

dev_scripts/env.py

@@ -696,6 +696,8 @@ class Env:
                     DOCKERFILE_CONMON_UPDATE + DOCKERFILE_BUILD_DEV_DEBIAN_DEPS
                 )
             elif self.distro == "ubuntu" and self.version in (
+                "23.10",
+                "mantic",
                 "24.04",
                 "noble",
                 "24.10",
@@ -782,6 +784,8 @@ class Env:
                 # package (see https://github.com/freedomofpress/dangerzone/issues/685)
                 install_deps = DOCKERFILE_CONMON_UPDATE + DOCKERFILE_BUILD_DEBIAN_DEPS
             elif self.distro == "ubuntu" and self.version in (
+                "23.10",
+                "mantic",
                 "24.04",
                 "noble",
                 "24.10",

dev_scripts/qa.py

@@ -978,6 +978,11 @@ class QAUbuntu2204(QADebianBased):
     VERSION = "22.04"
 
 
+class QAUbuntu2310(QADebianBased):
+    DISTRO = "ubuntu"
+    VERSION = "23.10"
+
+
 class QAUbuntu2404(QADebianBased):
     DISTRO = "ubuntu"
     VERSION = "24.04"

setup-windows.py

@@ -4,6 +4,7 @@ from cx_Freeze import Executable, setup
 with open("share/version.txt") as f:
     version = f.read().strip()
 
+packages = ["dangerzone", "dangerzone.gui"]
 
 setup(
     name="dangerzone",
@@ -11,13 +12,10 @@ setup(
     # On Windows description will show as the app's name in the "Open With" menu. See:
     # https://github.com/freedomofpress/dangerzone/issues/283#issuecomment-1365148805
     description="Dangerzone",
+    packages=packages,
     options={
         "build_exe": {
-            # Explicitly specify pymupdf.util module to fix building the executables
+            "packages": packages,
-            # with cx_freeze. See https://github.com/marcelotduarte/cx_Freeze/issues/2653
-            # for more details.
-            # TODO: Upgrade to cx_freeze 7.3.0 which should include a fix.
-            "packages": ["dangerzone", "dangerzone.gui", "pymupdf.utils"],
             "excludes": ["test", "tkinter"],
             "include_files": [("share", "share"), ("LICENSE", "LICENSE")],
             "include_msvcr": True,

tests/isolation_provider/base.py

@@ -164,7 +164,6 @@ class IsolationProviderTermination:
         terminate_proc_mock = mocker.patch.object(
             provider, "terminate_doc_to_pixels_proc", return_value=None
         )
-        kill_pg_orig = base.kill_process_group
         kill_pg_mock = mocker.patch(
             "dangerzone.isolation_provider.base.kill_process_group", return_value=None
         )
@@ -179,7 +178,6 @@ class IsolationProviderTermination:
 
         # Reset the function to the original state.
         provider.terminate_doc_to_pixels_proc = terminate_proc_orig  # type: ignore [method-assign]
-        base.kill_process_group = kill_pg_orig
 
         # Really kill the spawned process, so that it doesn't linger after the tests
         # complete.