Add dependency to ubuntu-release-upgrader-core

[kushaldas]

Description

securedrop-config package should depend on ubuntu-release-upgrader-core package.

Steps to Reproduce

While trying to install SecureDrop on Focal on prod vm based on bento/ubuntu-20.04 (libvirt, 202008.16.0) image, the securedrop-config package postinstallation failed as the ubuntu-release-upgrader-core package is missing.

Expected Behavior

The installation should finish normally.

Actual Behavior

TASK [ossec : Install securedrop-ossec-agent package.] *********************************************************
fatal: [app]: FAILED! => {"cache_update_time": 1608709951, "cache_updated": false, "changed": false, "msg": "'/usr/bin/apt-get -y -o \"Dpkg::Options::=--force-confdef\" -o \"Dpkg::Options::=--force-confold\"      install 'securedrop-ossec-agent'' failed: No apport report written because the error message indicates its a followup error from a previous failure.\nE: Sub-process /usr/bin/dpkg returned an error code (1)\n", "rc": 100, "stderr": "No apport report written because the error message indicates its a followup error from a previous failure.\nE: Sub-process /usr/bin/dpkg returned an error code (1)\n", "stderr_lines": ["No apport report written because the error message indicates its a followup error from a previous failure.", "E: Sub-process /usr/bin/dpkg returned an error code (1)"], "stdout": "Reading package lists...\nBuilding dependency tree...\nReading state information...\nThe following additional packages will be installed:\n  expect inotify-tools libinotifytools0 libtcl8.6 ossec-agent\n  securedrop-config tcl-expect tcl8.6\nSuggested packages:\n  tk8.6 tcl-tclreadline\nThe following NEW packages will be installed:\n  expect inotify-tools libinotifytools0 libtcl8.6 ossec-agent\n  securedrop-config securedrop-ossec-agent tcl-expect tcl8.6\n0 upgraded, 9 newly installed, 0 to remove and 0 not upgraded.\nNeed to get 1496 kB of archives.\nAfter this operation, 4868 kB of additional disk space will be used.\nGet:1 http://archive.ubuntu.com/ubuntu focal/main amd64 libtcl8.6 amd64 8.6.10+dfsg-1 [902 kB]\nGet:2 https://apt-test.freedom.press focal/main amd64 ossec-agent amd64 3.6.0+focal [289 kB]\nGet:3 http://archive.ubuntu.com/ubuntu focal/main amd64 tcl8.6 amd64 8.6.10+dfsg-1 [14.8 kB]\nGet:4 http://archive.ubuntu.com/ubuntu focal/universe amd64 tcl-expect amd64 5.45.4-2build1 [105 kB]\nGet:5 http://archive.ubuntu.com/ubuntu focal/universe amd64 expect amd64 5.45.4-2build1 [137 kB]\nGet:6 http://archive.ubuntu.com/ubuntu focal/universe amd64 libinotifytools0 amd64 3.14-8 [17.8 kB]\nGet:7 http://archive.ubuntu.com/ubuntu focal/universe amd64 inotify-tools amd64 3.14-8 [22.8 kB]\nGet:8 https://apt-test.freedom.press focal/main amd64 securedrop-config all 0.1.3+1.8.0~rc1+focal [2804 B]\nGet:9 https://apt-test.freedom.press focal/main amd64 securedrop-ossec-agent amd64 3.6.0+1.8.0~rc1+focal [4660 B]\nFetched 1496 kB in 2s (796 kB/s)\nSelecting previously unselected package libtcl8.6:amd64.\r\n(Reading database ... \r(Reading database ... 5%\r(Reading database ... 10%\r(Reading database ... 15%\r(Reading database ... 20%\r(Reading database ... 25%\r(Reading database ... 30%\r(Reading database ... 35%\r(Reading database ... 40%\r(Reading database ... 45%\r(Reading database ... 50%\r(Reading database ... 55%\r(Reading database ... 60%\r(Reading database ... 65%\r(Reading database ... 70%\r(Reading database ... 75%\r(Reading database ... 80%\r(Reading database ... 85%\r(Reading database ... 90%\r(Reading database ... 95%\r(Reading database ... 100%\r(Reading database ... 48880 files and directories currently installed.)\r\nPreparing to unpack .../0-libtcl8.6_8.6.10+dfsg-1_amd64.deb ...\r\nUnpacking libtcl8.6:amd64 (8.6.10+dfsg-1) ...\r\nSelecting previously unselected package tcl8.6.\r\nPreparing to unpack .../1-tcl8.6_8.6.10+dfsg-1_amd64.deb ...\r\nUnpacking tcl8.6 (8.6.10+dfsg-1) ...\r\nSelecting previously unselected package tcl-expect:amd64.\r\nPreparing to unpack .../2-tcl-expect_5.45.4-2build1_amd64.deb ...\r\nUnpacking tcl-expect:amd64 (5.45.4-2build1) ...\r\nSelecting previously unselected package expect.\r\nPreparing to unpack .../3-expect_5.45.4-2build1_amd64.deb ...\r\nUnpacking expect (5.45.4-2build1) ...\r\nSelecting previously unselected package libinotifytools0:amd64.\r\nPreparing to unpack .../4-libinotifytools0_3.14-8_amd64.deb ...\r\nUnpacking libinotifytools0:amd64 (3.14-8) ...\r\nSelecting previously unselected package inotify-tools.\r\nPreparing to unpack .../5-inotify-tools_3.14-8_amd64.deb ...\r\nUnpacking inotify-tools (3.14-8) ...\r\nSelecting previously unselected package ossec-agent.\r\nPreparing to unpack .../6-ossec-agent_3.6.0+focal_amd64.deb ...\r\nUnpacking ossec-agent (3.6.0+focal) ...\r\nSelecting previously unselected package securedrop-config.\r\nPreparing to unpack .../7-securedrop-config_0.1.3+1.8.0~rc1+focal_all.deb ...\r\nUnpacking securedrop-config (0.1.3+1.8.0~rc1+focal) ...\r\nSelecting previously unselected package securedrop-ossec-agent.\r\nPreparing to unpack .../8-securedrop-ossec-agent_3.6.0+1.8.0~rc1+focal_amd64.deb ...\r\nUnpacking securedrop-ossec-agent (3.6.0+1.8.0~rc1+focal) ...\r\nReplacing files in old package ossec-agent (3.6.0+focal) ...\r\nSetting up libinotifytools0:amd64 (3.14-8) ...\r\nSetting up libtcl8.6:amd64 (8.6.10+dfsg-1) ...\r\nSetting up securedrop-config (0.1.3+1.8.0~rc1+focal) ...\r\n+ manage_tor_repo_config\r\n+ rm -f /etc/apt/sources.list.d/deb_torproject_org_torproject_org.list\r\n+ rm -f /etc/apt/sources.list.d/tor_apt_freedom_press.list\r\n+ apt_security_list=/etc/apt/security.list\r\n+ [ -f /etc/apt/security.list ]\r\n+ remove_2fa_tty_req\r\n+ auth_file=/etc/pam.d/common-auth\r\n+ sed -i /^auth\\ required\\ pam_google.*/d /etc/pam.d/common-auth\r\n+ grep -qF PasswordAuthentication no /etc/ssh/sshd_config\r\n+ echo PasswordAuthentication no\r\n+ sed -i /^UsePAM\\ /s/\\ .*/\\ no/ /etc/ssh/sshd_config\r\n+ sed -i /^ChallengeResponseAuthentication\\ /s/\\ .*/\\ no/ /etc/ssh/sshd_config\r\n+ service ssh restart\r\n+ update_release_prompt\r\n+ set -e\r\n+ upgrade_config=/etc/update-manager/release-upgrades\r\n+ sed -i s/Prompt=.*/Prompt=never/ /etc/update-manager/release-upgrades\r\nsed: can't read /etc/update-manager/release-upgrades: No such file or directory\r\ndpkg: error processing package securedrop-config (--configure):\r\n installed securedrop-config package post-installation script subprocess returned error exit status 2\r\nSetting up inotify-tools (3.14-8) ...\r\nSetting up tcl8.6 (8.6.10+dfsg-1) ...\r\nSetting up tcl-expect:amd64 (5.45.4-2build1) ...\r\ndpkg: dependency problems prevent configuration of securedrop-ossec-agent:\r\n securedrop-ossec-agent depends on securedrop-config; however:\r\n  Package securedrop-config is not configured yet.\r\n\r\ndpkg: error processing package securedrop-ossec-agent (--configure):\r\n dependency problems - leaving unconfigured\r\nSetting up expect (5.45.4-2build1) ...\r\nSetting up ossec-agent (3.6.0+focal) ...\r\nProcessing triggers for systemd (245.4-4ubuntu3.4) ...\r\nProcessing triggers for man-db (2.9.1-1) ...\r\nProcessing triggers for libc-bin (2.31-0ubuntu9.2) ...\r\nErrors were encountered while processing:\r\n securedrop-config\r\n securedrop-ossec-agent\r\n", "stdout_lines": ["Reading package lists...", "Building dependency tree...", "Reading state information...", "The following additional packages will be installed:", "  expect inotify-tools libinotifytools0 libtcl8.6 ossec-agent", "  securedrop-config tcl-expect tcl8.6", "Suggested packages:", "  tk8.6 tcl-tclreadline", "The following NEW packages will be installed:", "  expect inotify-tools libinotifytools0 libtcl8.6 ossec-agent", "  securedrop-config securedrop-ossec-agent tcl-expect tcl8.6", "0 upgraded, 9 newly installed, 0 to remove and 0 not upgraded.", "Need to get 1496 kB of archives.", "After this operation, 4868 kB of additional disk space will be used.", "Get:1 http://archive.ubuntu.com/ubuntu focal/main amd64 libtcl8.6 amd64 8.6.10+dfsg-1 [902 kB]", "Get:2 https://apt-test.freedom.press focal/main amd64 ossec-agent amd64 3.6.0+focal [289 kB]", "Get:3 http://archive.ubuntu.com/ubuntu focal/main amd64 tcl8.6 amd64 8.6.10+dfsg-1 [14.8 kB]", "Get:4 http://archive.ubuntu.com/ubuntu focal/universe amd64 tcl-expect amd64 5.45.4-2build1 [105 kB]", "Get:5 http://archive.ubuntu.com/ubuntu focal/universe amd64 expect amd64 5.45.4-2build1 [137 kB]", "Get:6 http://archive.ubuntu.com/ubuntu focal/universe amd64 libinotifytools0 amd64 3.14-8 [17.8 kB]", "Get:7 http://archive.ubuntu.com/ubuntu focal/universe amd64 inotify-tools amd64 3.14-8 [22.8 kB]", "Get:8 https://apt-test.freedom.press focal/main amd64 securedrop-config all 0.1.3+1.8.0~rc1+focal [2804 B]", "Get:9 https://apt-test.freedom.press focal/main amd64 securedrop-ossec-agent amd64 3.6.0+1.8.0~rc1+focal [4660 B]", "Fetched 1496 kB in 2s (796 kB/s)", "Selecting previously unselected package libtcl8.6:amd64.", "(Reading database ... ", "(Reading database ... 5%", "(Reading database ... 10%", "(Reading database ... 15%", "(Reading database ... 20%", "(Reading database ... 25%", "(Reading database ... 30%", "(Reading database ... 35%", "(Reading database ... 40%", "(Reading database ... 45%", "(Reading database ... 50%", "(Reading database ... 55%", "(Reading database ... 60%", "(Reading database ... 65%", "(Reading database ... 70%", "(Reading database ... 75%", "(Reading database ... 80%", "(Reading database ... 85%", "(Reading database ... 90%", "(Reading database ... 95%", "(Reading database ... 100%", "(Reading database ... 48880 files and directories currently installed.)", "Preparing to unpack .../0-libtcl8.6_8.6.10+dfsg-1_amd64.deb ...", "Unpacking libtcl8.6:amd64 (8.6.10+dfsg-1) ...", "Selecting previously unselected package tcl8.6.", "Preparing to unpack .../1-tcl8.6_8.6.10+dfsg-1_amd64.deb ...", "Unpacking tcl8.6 (8.6.10+dfsg-1) ...", "Selecting previously unselected package tcl-expect:amd64.", "Preparing to unpack .../2-tcl-expect_5.45.4-2build1_amd64.deb ...", "Unpacking tcl-expect:amd64 (5.45.4-2build1) ...", "Selecting previously unselected package expect.", "Preparing to unpack .../3-expect_5.45.4-2build1_amd64.deb ...", "Unpacking expect (5.45.4-2build1) ...", "Selecting previously unselected package libinotifytools0:amd64.", "Preparing to unpack .../4-libinotifytools0_3.14-8_amd64.deb ...", "Unpacking libinotifytools0:amd64 (3.14-8) ...", "Selecting previously unselected package inotify-tools.", "Preparing to unpack .../5-inotify-tools_3.14-8_amd64.deb ...", "Unpacking inotify-tools (3.14-8) ...", "Selecting previously unselected package ossec-agent.", "Preparing to unpack .../6-ossec-agent_3.6.0+focal_amd64.deb ...", "Unpacking ossec-agent (3.6.0+focal) ...", "Selecting previously unselected package securedrop-config.", "Preparing to unpack .../7-securedrop-config_0.1.3+1.8.0~rc1+focal_all.deb ...", "Unpacking securedrop-config (0.1.3+1.8.0~rc1+focal) ...", "Selecting previously unselected package securedrop-ossec-agent.", "Preparing to unpack .../8-securedrop-ossec-agent_3.6.0+1.8.0~rc1+focal_amd64.deb ...", "Unpacking securedrop-ossec-agent (3.6.0+1.8.0~rc1+focal) ...", "Replacing files in old package ossec-agent (3.6.0+focal) ...", "Setting up libinotifytools0:amd64 (3.14-8) ...", "Setting up libtcl8.6:amd64 (8.6.10+dfsg-1) ...", "Setting up securedrop-config (0.1.3+1.8.0~rc1+focal) ...", "+ manage_tor_repo_config", "+ rm -f /etc/apt/sources.list.d/deb_torproject_org_torproject_org.list", "+ rm -f /etc/apt/sources.list.d/tor_apt_freedom_press.list", "+ apt_security_list=/etc/apt/security.list", "+ [ -f /etc/apt/security.list ]", "+ remove_2fa_tty_req", "+ auth_file=/etc/pam.d/common-auth", "+ sed -i /^auth\\ required\\ pam_google.*/d /etc/pam.d/common-auth", "+ grep -qF PasswordAuthentication no /etc/ssh/sshd_config", "+ echo PasswordAuthentication no", "+ sed -i /^UsePAM\\ /s/\\ .*/\\ no/ /etc/ssh/sshd_config", "+ sed -i /^ChallengeResponseAuthentication\\ /s/\\ .*/\\ no/ /etc/ssh/sshd_config", "+ service ssh restart", "+ update_release_prompt", "+ set -e", "+ upgrade_config=/etc/update-manager/release-upgrades", "+ sed -i s/Prompt=.*/Prompt=never/ /etc/update-manager/release-upgrades", "sed: can't read /etc/update-manager/release-upgrades: No such file or directory", "dpkg: error processing package securedrop-config (--configure):", " installed securedrop-config package post-installation script subprocess returned error exit status 2", "Setting up inotify-tools (3.14-8) ...", "Setting up tcl8.6 (8.6.10+dfsg-1) ...", "Setting up tcl-expect:amd64 (5.45.4-2build1) ...", "dpkg: dependency problems prevent configuration of securedrop-ossec-agent:", " securedrop-ossec-agent depends on securedrop-config; however:", "  Package securedrop-config is not configured yet.", "", "dpkg: error processing package securedrop-ossec-agent (--configure):", " dependency problems - leaving unconfigured", "Setting up expect (5.45.4-2build1) ...", "Setting up ossec-agent (3.6.0+focal) ...", "Processing triggers for systemd (245.4-4ubuntu3.4) ...", "Processing triggers for man-db (2.9.1-1) ...", "Processing triggers for libc-bin (2.31-0ubuntu9.2) ...", "Errors were encountered while processing:", " securedrop-config", " securedrop-ossec-agent"]}

Comments

Suggestions to fix, any other relevant information.

[conorsch]

Discussed at standup today. No one's seen this the initial report. Could have been resolved by securedrop-config changes in #5684, or perhaps 004dc3c Leaving open for now, if no one sees it again by feature freeze, we should be good to close.

[sssoleileraaa]

The repro (on a different vagrant box version)

I was able to repro this error today. This didn't happen to me for my focal vagrant box but it did happen for my xenial box. I am using different boxes than @kushaldas , see:

> vagrant box list
bento/ubuntu-16.04 (libvirt, 202102.02.0)
bento/ubuntu-16.04 (virtualbox, 202102.02.0)
bento/ubuntu-20.04 (libvirt, 202012.23.0)
bento/ubuntu-20.04 (virtualbox, 202012.23.0)

I also want to point out that I am on the latest develop branch as of 240a9a9, and my virtual environment was created today.

And the error I saw was:

failed: [mon-staging] (item=[1, 'securedrop-config-0.1.4+1.8.0~rc1+xenial-amd64.deb']) => {"ansible_loop_var": "item", "changed": false, "item": [1, "securedrop-config-0.1.4+1.8.0~rc1+xenial-amd64.deb"], "msg": "dpkg --force-confdef --force-confold -i /root/securedrop-config-0.1.4+1.8.0~rc1+xenial-amd64.deb failed", "stderr": "+ manage_tor_repo_config\n+ rm -f /etc/apt/sources.list.d/deb_torproject_org_torproject_org.list\n+ rm -f /etc/apt/sources.list.d/tor_apt_freedom_press.list\n+ apt_security_list=/etc/apt/security.list\n+ [ -f /etc/apt/security.list ]\n+ sed -i /deb\\.torproject\\.org\\/torproject\\.org/d /etc/apt/security.list\n+ sed -i /tor-apt\\.freedom\\.press/d /etc/apt/security.list\n+ remove_2fa_tty_req\n+ auth_file=/etc/pam.d/common-auth\n+ sed -i /^auth\\ required\\ pam_google.*/d /etc/pam.d/common-auth\n+ grep -qF PasswordAuthentication no /etc/ssh/sshd_config\n+ echo PasswordAuthentication no\n+ sed -i /^UsePAM\\ /s/\\ .*/\\ no/ /etc/ssh/sshd_config\n+ sed -i /^ChallengeResponseAuthentication\\ /s/\\ .*/\\ no/ /etc/ssh/sshd_config\n+ service ssh restart\n+ update_release_prompt\n+ set -e\n+ upgrade_config=/etc/update-manager/release-upgrades\n+ sed -i s/Prompt=.*/Prompt=never/ /etc/update-manager/release-upgrades\nsed: can't read /etc/update-manager/release-upgrades: No such file or directory\ndpkg: error processing package securedrop-config (--install):\n subprocess installed post-installation script returned error exit status 2\nErrors were encountered while processing:\n securedrop-config\n", "stderr_lines": ["+ manage_tor_repo_config", "+ rm -f /etc/apt/sources.list.d/deb_torproject_org_torproject_org.list", "+ rm -f /etc/apt/sources.list.d/tor_apt_freedom_press.list", "+ apt_security_list=/etc/apt/security.list", "+ [ -f /etc/apt/security.list ]", "+ sed -i /deb\\.torproject\\.org\\/torproject\\.org/d /etc/apt/security.list", "+ sed -i /tor-apt\\.freedom\\.press/d /etc/apt/security.list", "+ remove_2fa_tty_req", "+ auth_file=/etc/pam.d/common-auth", "+ sed -i /^auth\\ required\\ pam_google.*/d /etc/pam.d/common-auth", "+ grep -qF PasswordAuthentication no /etc/ssh/sshd_config", "+ echo PasswordAuthentication no", "+ sed -i /^UsePAM\\ /s/\\ .*/\\ no/ /etc/ssh/sshd_config", "+ sed -i /^ChallengeResponseAuthentication\\ /s/\\ .*/\\ no/ /etc/ssh/sshd_config", "+ service ssh restart", "+ update_release_prompt", "+ set -e", "+ upgrade_config=/etc/update-manager/release-upgrades", "+ sed -i s/Prompt=.*/Prompt=never/ /etc/update-manager/release-upgrades", "sed: can't read /etc/update-manager/release-upgrades: No such file or directory", "dpkg: error processing package securedrop-config (--install):", " subprocess installed post-installation script returned error exit status 2", "Errors were encountered while processing:", " securedrop-config"], "stdout": "Selecting previously unselected package securedrop-config.\n(Reading database ... 42733 files and directories currently installed.)\nPreparing to unpack .../securedrop-config-0.1.4+1.8.0~rc1+xenial-amd64.deb ...\nUnpacking securedrop-config (0.1.4+1.8.0~rc1+xenial) ...\nSetting up securedrop-config (0.1.4+1.8.0~rc1+xenial) ...\n", "stdout_lines": ["Selecting previously unselected package securedrop-config.", "(Reading database ... 42733 files and directories currently installed.)", "Preparing to unpack .../securedrop-config-0.1.4+1.8.0~rc1+xenial-amd64.deb ...", "Unpacking securedrop-config (0.1.4+1.8.0~rc1+xenial) ...", "Setting up securedrop-config (0.1.4+1.8.0~rc1+xenial) ..."]}
    failed: [app-staging] (item=[1, 'securedrop-config-0.1.4+1.8.0~rc1+xenial-amd64.deb']) => {"ansible_loop_var": "item", "changed": false, "item": [1, "securedrop-config-0.1.4+1.8.0~rc1+xenial-amd64.deb"], "msg": "dpkg --force-confdef --force-confold -i /root/securedrop-config-0.1.4+1.8.0~rc1+xenial-amd64.deb failed", "stderr": "+ manage_tor_repo_config\n+ rm -f /etc/apt/sources.list.d/deb_torproject_org_torproject_org.list\n+ rm -f /etc/apt/sources.list.d/tor_apt_freedom_press.list\n+ apt_security_list=/etc/apt/security.list\n+ [ -f /etc/apt/security.list ]\n+ sed -i /deb\\.torproject\\.org\\/torproject\\.org/d /etc/apt/security.list\n+ sed -i /tor-apt\\.freedom\\.press/d /etc/apt/security.list\n+ remove_2fa_tty_req\n+ auth_file=/etc/pam.d/common-auth\n+ sed -i /^auth\\ required\\ pam_google.*/d /etc/pam.d/common-auth\n+ grep -qF PasswordAuthentication no /etc/ssh/sshd_config\n+ echo PasswordAuthentication no\n+ sed -i /^UsePAM\\ /s/\\ .*/\\ no/ /etc/ssh/sshd_config\n+ sed -i /^ChallengeResponseAuthentication\\ /s/\\ .*/\\ no/ /etc/ssh/sshd_config\n+ service ssh restart\n+ update_release_prompt\n+ set -e\n+ upgrade_config=/etc/update-manager/release-upgrades\n+ sed -i s/Prompt=.*/Prompt=never/ /etc/update-manager/release-upgrades\nsed: can't read /etc/update-manager/release-upgrades: No such file or directory\ndpkg: error processing package securedrop-config (--install):\n subprocess installed post-installation script returned error exit status 2\nErrors were encountered while processing:\n securedrop-config\n", "stderr_lines": ["+ manage_tor_repo_config", "+ rm -f /etc/apt/sources.list.d/deb_torproject_org_torproject_org.list", "+ rm -f /etc/apt/sources.list.d/tor_apt_freedom_press.list", "+ apt_security_list=/etc/apt/security.list", "+ [ -f /etc/apt/security.list ]", "+ sed -i /deb\\.torproject\\.org\\/torproject\\.org/d /etc/apt/security.list", "+ sed -i /tor-apt\\.freedom\\.press/d /etc/apt/security.list", "+ remove_2fa_tty_req", "+ auth_file=/etc/pam.d/common-auth", "+ sed -i /^auth\\ required\\ pam_google.*/d /etc/pam.d/common-auth", "+ grep -qF PasswordAuthentication no /etc/ssh/sshd_config", "+ echo PasswordAuthentication no", "+ sed -i /^UsePAM\\ /s/\\ .*/\\ no/ /etc/ssh/sshd_config", "+ sed -i /^ChallengeResponseAuthentication\\ /s/\\ .*/\\ no/ /etc/ssh/sshd_config", "+ service ssh restart", "+ update_release_prompt", "+ set -e", "+ upgrade_config=/etc/update-manager/release-upgrades", "+ sed -i s/Prompt=.*/Prompt=never/ /etc/update-manager/release-upgrades", "sed: can't read /etc/update-manager/release-upgrades: No such file or directory", "dpkg: error processing package securedrop-config (--install):", " subprocess installed post-installation script returned error exit status 2", "Errors were encountered while processing:", " securedrop-config"], "stdout": "Selecting previously unselected package securedrop-config.\n(Reading database ... 42733 files and directories currently installed.)\nPreparing to unpack .../securedrop-config-0.1.4+1.8.0~rc1+xenial-amd64.deb ...\nUnpacking securedrop-config (0.1.4+1.8.0~rc1+xenial) ...\nSetting up securedrop-config (0.1.4+1.8.0~rc1+xenial) ...\n", "stdout_lines": ["Selecting previously unselected package securedrop-config.", "(Reading database ... 42733 files and directories currently installed.)", "Preparing to unpack .../securedrop-config-0.1.4+1.8.0~rc1+xenial-amd64.deb ...", "Unpacking securedrop-config (0.1.4+1.8.0~rc1+xenial) ...", "Setting up securedrop-config (0.1.4+1.8.0~rc1+xenial) ..."]}

Specifically, what stands out is: sed: can't read /etc/update-manager/release-upgrades: No such file or directory, which @emkll pointed out means that the ubuntu-release-upgrader-core package is missing (you can confirm by running apt-file search /etc/update-manager/release-upgrades.

Install the missing package

To add the package via ansible, you can apply this diff (provided by @emkll):

diff --git a/install_files/ansible-base/roles/common/vars/Ubuntu_xenial.yml b/install_files/ansible-base/roles/common/vars/Ubuntu_xenial.yml
index 55d9453be..5778424e9 100644
--- a/install_files/ansible-base/roles/common/vars/Ubuntu_xenial.yml
+++ b/install_files/ansible-base/roles/common/vars/Ubuntu_xenial.yml
@@ -18,3 +18,4 @@ securedrop_common_packages:
   - ntpdate
   - resolvconf
   - tmux
+  - ubuntu-release-upgrader-core

Then molecule destroy -s libvirt-staging-xenial and rerun make staging. I assume this package wasn't needed for my build of the focal staging servers because it was already included with the 202012.23.0 vagrant box for focal.

The next error

After fixing the first error above, I saw a new error from running make staging:

    TASK [ossec : Register OSSEC agent.] *******************************************
    fatal: [app-staging]: FAILED! => {"changed": true, "cmd": ["/var/ossec/bin/agent-auth", "-m", "10.0.1.3", "-p", "1515", "-A", "app-staging", "-P", "/var/ossec/etc/authd.pass"], "delta": "0:02:09.451390", "end": "2021-02-11 21:13:24.196073", "failed_when_result": true, "msg": "non-zero return code", "rc": 1, "start": "2021-02-11 21:11:14.744683", "stderr": "2021/02/11 21:11:14 ossec-authd: INFO: Started (pid: 26761).\n2021/02/11 21:13:24 ossec-authd: Unable to connect to 10.0.1.3:1515", "stderr_lines": ["2021/02/11 21:11:14 ossec-authd: INFO: Started (pid: 26761).", "2021/02/11 21:13:24 ossec-authd: Unable to connect to 10.0.1.3:1515"], "stdout": "INFO: Using specified password.", "stdout_lines": ["INFO: Using specified password."]}

Specifically, what stands out is: ossec-authd: Unable to connect to 10.0.1.3:1515.

I started to wonder if there could be an issue with sharing the same local directory between xenial and focal builds. I believe in CI we use separate directories when running make staging and make staging-focal because we have separate build jobs. When I searched locally for my *.aths files in install_files/ansible-base they didn't exist and the tor_v3_keys.json contained information, but I wasn't sure if it was for xenial or focal. I think running make staging deleted my *.aths files for focal (I'm assuming they were there to begin with). The /var/lib/tor/services directory on my focal staging vm was also missing so the onion urls were unknown.

Use separate securedrop directories for focal and xenial staging builds

I decided to clone another version of securedrop and separate my staging builds for focal and xenial. I still saw the ossec-authd: Unable to connect to 10.0.1.3:1515 error during make staging for xenial but, the good news is, the *.aths files and /var/lib/tor/services were no longer missing.

:( Now what?

At this point, in order to continue development and make progress towards SecureDrop 1.8.0, it might make the most sense to start using the same version of vagrant boxes used in CI, since those seem to be working. I'll be able to confirm later whether or not this works locally for me. It is surprising that @kushaldas saw the first error on the same focal box that we use in CI. You can see which versions of vagrant boxes CI should be using (https://github.com/freedomofpress/infrastructure/blob/b3dbae358a0e9071044edc1a5c5ab3d2bff8ebde/playbooks/sd-ci-gce-nested-virt-box.yml#L30-L34):

    sd_vagrant_boxes:
      - name: bento/ubuntu-16.04
        version: 202008.16.0
      - name: bento/ubuntu-20.04
        version: 202008.16.0

So I'll be able to confirm this error as well if there's time today (I do have a working focal build now and am hesitate to destroy it since I still have yet to work on #5688 today).

[conorsch]

Root cause appears to be chef/bento@6921eb3 , which ostensibly affects all recent Ubuntu Vagrant boxes from Bento. Haven't checked precisely when that commit was released to the prod boxes, but clearly that's what's going on.

The proposed of installing the package makes sense to me as a quick fix. It appears to be a Vagrant-only variation, but doesn't hurt to be explicit in the config. In the spirit of #2743, updating in the securedrop-config dependencies as suggested in the OP will minimize surprises going forward. N.B. I've been using ISO-based Qubes VMs, which lack the Bento box customizations, and this problem hasn't occurred, which means the behavior for production installs remains predictable.

[sssoleileraaa]

@conorsch curious what your thoughts are about the second error around ossec as well as using separate securedrop directories for building xenial and focal staging servers since the second build will overwrite the auth files from the first build. We could also try manually renaming the *aths and the tor_v3_keys.json files (maybe append -focal or -xenial) until we create a fix.

Update: It looks like the tor_v3_key.json file will be the same between focal and xenial, but the following files differ between builds and are overwritten when sharing the same directory: app-journalist-aths app-journalist.auth_private app-source-ths app-sourcev3-ths

[conorsch]

Not sure what's causing the OSSEC failure you mention. You can't have both the Xenial & the Staging environments configured simultaneously, since they use the same internal IPs:

$ grep -oPI '10\.[\d\.]+' -r molecule/*staging*
molecule/libvirt-staging-focal/molecule.yml:10.0.1.2
molecule/libvirt-staging-focal/molecule.yml:10.0.1.2
molecule/libvirt-staging-focal/molecule.yml:10.0.1.3
molecule/libvirt-staging-focal/molecule.yml:10.0.1.3
molecule/libvirt-staging-xenial/molecule.yml:10.0.1.2
molecule/libvirt-staging-xenial/molecule.yml:10.0.1.2
molecule/libvirt-staging-xenial/molecule.yml:10.0.1.3
molecule/libvirt-staging-xenial/molecule.yml:10.0.1.3
molecule/virtualbox-staging-xenial/molecule.yml:10.0.1.2
molecule/virtualbox-staging-xenial/molecule.yml:10.0.1.2
molecule/virtualbox-staging-xenial/molecule.yml:10.0.1.3
molecule/virtualbox-staging-xenial/molecule.yml:10.0.1.3

There's no reason to suspect tor configuration, since the failing task is an inter-VM OSSEC communication. So I'd recommending running those commands manually, and scanning the ports between the two VMs, to determine whether that service is actually running, and whether it's reachable from the other VM.

[sssoleileraaa]

I see, we don't support having both a focal staging server and xenial staging server on the same machine. We could support this in the future, but for now, I will just run focal staging here, since it's working for me. And then to avoid the xenial staging ossec error that has come up repeatedly throughout the day, i will test changes on my xenial home server. It just means that I will have to building the securedrop-app-code package and shuttle it over to my home server to install it each time I want to test a code change that cannot be tested in a dev environment (docker), e.g. v2 warnings do not show up in a dev environment. i could also run different staging servers on separate vms in Qubes. or maybe use different ips for focal staging builds. there is no shortage of ways for me to be clever about this.

[conorsch]

we don't support having both a focal staging server and xenial staging server on the same machine

Oops, I was unclear: you can certainly have both Xenial & Focal environments on the same host machine, just not at the exact same time. If you tried to bring up both environments at the exact same time, I would expect an error, but it may be possible that the networking settings would simply get confused. Certainly there's a networking problem of some kind behind the registration error, since that's an inter-VM connection, but it may not be that one specifically.

It's also possible that you never had the two environments running at the same time. Maybe it's worthwhile to ground a bit in steps to reproduce. Try this:

1. Run molecule destroy -s libvirt-staging-xenial
2. Run molecule destroy -s libvirt-staging-focal
3. Run virt-manager and ensure that no SD staging VMs are visible. If any are, delete them from the virt-manager interface.
4. Reboot your host machine entirely.
5. On next boot, hop into your SD env, make sure you're on latest develop with the patch to install_files/ansible-base/roles/common/vars/Ubuntu_xenial.yml you shared above applied
6. Run make build-debs
7. Run make staging

Does the OSSEC registration failure occur again? If so, sounds like a networking problem. Debug by logging into the VMs and running the commands manually, see if you can get a connection. Try opening up the firewall rules and see if that helps.

If the OSSEC registration does not occur again, great, then it may have been a problem with reusing the IPs between both environments. We could proactively update the environments to use different internal IPs, but let's not do that until we're sure that's causing a problem for you!

[sssoleileraaa]

Oops, I was unclear: you can certainly have both Xenial & Focal environments on the same host machine, just not at the exact same time. If you tried to bring up both environments at the exact same time

Sorry, that makes more sense. I've just been headsdown on this for so long I've forgotten how to communicate. My thinking is that the focal servers need to be shut down before running make staging for the first time to build the xenial servers, and maybe that will fix the ossec networking issue. But also there seems to be an unacknowledged issue of the second run of make staging overwriting the aths files, meaning: app-journalist-aths, app-journalist.auth_private, app-source-ths, app-sourcev3-ths files. This means it'll be more difficult run playbooks against the staging server with no aths files right?

I'll try running though your instructions shortly. I have a test running right now that should be done in ~30 mins.

[conorsch]

Yes, any time "make staging" is run, it will clobber the records of the onion urls, as you pointed out in

It looks like the tor_v3_key.json file will be the same between focal and xenial, but the following files differ between builds and are overwritten when sharing the same directory: app-journalist-aths app-journalist.auth_private app-source-ths app-sourcev3-ths

That's a valid observation, but unrelated (as far as I can tell) to both the ubuntu-release-upgrader-core problem and the OSSEC agent registration failure. Even though the onion url files are clobber, that doesn't affect the onion services inside the machines, they'll still be the same as ever. So you can back up the files locally, or you can log into the app-staging VM (e.g. molecule login -s libvirt-staging-focal -h app-staging) and retrieve the onion urls from /var/lib/tor/.

[sssoleileraaa]

It seems that what I experienced were 3 different issues:

1. ubuntu-release-upgrader-core not being installed - easy fix as documented in my original comment
2. the ossec error - just confirmed that shutting down any running vagrant boxes fixes this issue (thanks for the feedback above to help me realize that was the issue)
3. important files are overwritten if you use the same securedrop directory when building staging servers for focal and xenial - my recommendation is to use a separate directory so you don't have to manage backups of install_files/ansible-base/app* files

[sssoleileraaa]

Another thing we might want to recommend to developers is to use the same vagrant box versions as we use in CI. Something to discuss more later.