Graphical updater re-appears, fails after initial run without admin password

[eloquence]

Description

The graphical updater fails to successfully complete an update, if it is re-run after an update that failed due to a Tails admin password not being set.

Steps to Reproduce

1. Boot up the Admin Workstation with an update pending;
2. Do not set a Tails admin password;
3. Proceed with the update when prompted by the graphical updater.
4. Cancel the update and reboot the workstation at the step that requires a Tails admin password.
5. Proceed with the update when prompted by the graphical updater.

Expected Behavior

I can successfully complete the update.

Actual Behavior

The update fails ("Update failed").

[rocodes]

Hey folks - any proposed workaround for this issue? Have a user reporting it in our Support Portal.

[zenmonkeykstop]

Yup, this is caused by a flag file that does not get removed when the updater fails in this scenario.

The most straightforward workaround is to:

• delete the file ~amnesia/Persistent/.securedrop/securedrop_update.flag on the Admin Workstation
• reboot Tails and start with the PV unlocked and an admin password set.

If the git checkout portion of the update completed successfully, the GUI updater will no longer appear. If you want to force it to run again (not necessary for releases that don't require a setup or tailsconfig update), open a terminal and run:

cd ~/Persistent/securedrop
git tag -v <previous release here> # verify that tag is signed
git checkout <previous release here>

Then, bounce the network connection. The GUI updater will appear and should work correctly, prompting you for the Tails admin pw about halfway through.