securedrop-app-code generated postinst

gistfile1.txt

#!/bin/bash
# postinst script for securedrop-app-code
#
# see: dh_installdeb(1)
set -e
set -x
set -o pipefail
# summary of how this script can be called:
#        * <postinst> `configure' <most-recently-configured-version>
#        * <old-postinst> `abort-upgrade' <new version>
#        * <conflictor's-postinst> `abort-remove' `in-favour' <package>
#          <new-version>
#        * <postinst> `abort-remove'
#        * <deconfigured's-postinst> `abort-deconfigure' `in-favour'
#          <failed-install-package> <version> `removing'
#          <conflicting-package> <version>
# for details, see http://www.debian.org/doc/debian-policy/ or
# the debian-policy package

SDVE="/opt/venvs/securedrop-app-code"
SDBIN="${SDVE}/bin"

database_migration() {
    database_dir='/var/lib/securedrop'
    database_file="$database_dir/db.sqlite"

    # Ensure the database exists.
    if [ ! -e "$database_file" ]; then
        old_umask=$(umask)
        umask 0027 # to get os 0640 permissions from the sqlite command

        # Future-proof way to create an empty database.
        sqlite3 "$database_file" '.databases'
        umask "$old_umask"
        chown www-data:www-data "$database_file"
    fi

    cd '/var/www/securedrop/'

    # `alembic current` outputs nothing if the DB isn't under version control.
    if [ -z "$(${SDBIN}/alembic current)" ]; then
        sqlite_tables=$(sqlite3 "$database_file" .tables)

        if ! echo "$sqlite_tables" | grep -q journalists; then
            # This is a fresh install, run the full migrations.
            ${SDBIN}/alembic upgrade head
        else
            # This is an old install, so mark that the schema is up to date
            # as of the version of migration 15ac9509fc68_init.py when we first
            # started version controlling the database.
            ${SDBIN}/alembic stamp 15ac9509fc68
        fi
    fi

    db_backup="/var/lib/securedrop/backups/$(date +%Y-%m-%d-%H-%M-%S)-db.sqlite"

    if ! ${SDBIN}/alembic current | grep -q '(head)'; then
        cp /var/lib/securedrop/db.sqlite "$db_backup"
    fi

    if ${SDBIN}/alembic upgrade head; then
        rm -f "$db_backup"
    else
        echo "Error migrating database: Backup saved to $db_backup" >&2
        return 1
    fi
}

adjust_wsgi_configuration() {
    journalist_conf="/etc/apache2/sites-available/journalist.conf"
    if test -f $journalist_conf; then
        # Supports passing authorization headers for the SecureDrop API.
        # Only affects the Journalist Interface. Required for unattended upgrade
        # to v0.9.0.
        #
        # First we check whether the line is present.
        # Next we find a target line to anchor the insertion.
        # Then we insert the line, along with the target line that was matched.
        if ! grep -qP '^WSGIPassAuthorization' "$journalist_conf"; then
            perl -pi -e 's/^(WSGIScriptAlias .*)/$1\nWSGIPassAuthorization On/' "$journalist_conf"
        fi

        # Add process-group and application-group to WSGIScriptAlias
        # to ensure the application is initialized at process start
        # instead of waiting for the first request. (See
        # https://modwsgi.readthedocs.io/en/latest/configuration-directives/WSGIScriptAlias.html)
        if grep -qP '^WSGIScriptAlias / /var/www/journalist.wsgi$' "$journalist_conf"; then
            perl -pi -e 's/^(WSGIScriptAlias .*)/$1 process-group=journalist application-group=journalist/' "$journalist_conf"
        fi

        # Remove the WSGIProcessGroup directive; it's not needed if
        # specified in WSGIScriptAlias.
        if grep -qP '^WSGIProcessGroup journalist' "$journalist_conf"; then
            perl -pi -e 's/^WSGIProcessGroup journalist.*\n//' "$journalist_conf"
        fi
    fi
}

#
# Remove any existing byte code files from the virtualenv, to ensure
# that obsolete dependencies can't linger after they've been removed.
#
remove_bytecode() {
    find "${SDVE}" -name '*.py[co]' -delete
}

#
# Modify existing instance to use only TLS1.3 for the source.
update_to_tls13(){
    source_conf="/etc/apache2/sites-available/source.conf"
    if grep -qP '^SSLProtocol all' "$source_conf"; then
        sed -i '/^SSLProtocol all/c\SSLProtocol all -SSLv3 -TLSv1 -TLSv1.1 -TLSv1.2' "$source_conf"
        sed -i '/^SSLCipherSuite ECDHE-ECDSA-AES256-GCM-SHA384/d' "$source_conf"
        sed -i '/^SSLHonorCipherOrder on/c\SSLHonorCipherOrder off' "$source_conf"
        sed -i '/^SSLCompression off/ a \\SSLSessionTickets off' "$source_conf"
    fi
}

case "$1" in
    configure)

    # Ensure SecureDrop's necessary directories are created
    for dir in /var/lib/securedrop/{,tmp,shredder,store,keys,/keys/private-keys-v1.d,/keys/openpgp-revocs.d,backups} /var/www/securedrop; do
      mkdir -p "$dir"
      chmod 0700 "$dir"
    done

    # Ensure required gpg-agent.conf is in place, see #4013.
    if [ -e "/var/lib/securedrop/keys/gpg-agent.conf" ]; then

        # gpg-agent.conf does exist, update it if needed.
        if ! grep -qE '^allow-loopback-pinentry$' /var/lib/securedrop/keys/gpg-agent.conf; then
            echo allow-loopback-pinentry >> /var/lib/securedrop/keys/gpg-agent.conf
        fi

    else
        # gpg-agent.conf does not yet exist, create it.
        echo allow-loopback-pinentry > /var/lib/securedrop/keys/gpg-agent.conf
    fi

    # Migrate private keyring to gpg2.1 if needed
    if [ ! -d "/var/lib/securedrop/keys/private-keys-v1.d" ]; then
        # Then we should migrate the keyring
        gpg2 --homedir=/var/lib/securedrop/keys --batch --import < /var/lib/securedrop/keys/secring.gpg
    fi

    chown -R www-data:www-data /var/lib/securedrop /var/www/securedrop

    chown -R www-data:www-data /var/www/securedrop
    chown www-data:www-data /var/www/journalist.wsgi
    chown www-data:www-data /var/www/source.wsgi

    # Apache's default sites are not allowed by the securedrop apparmor profile
    # disable the site before putting the apache apparmor profile in enforce
    # mode.
    a2dissite 000-default
    a2dissite default-ssl
    # Stop Apache service before making changes to its AppArmor profile.
    # If the Apache service is running unconfined, and the profile is
    # set to "enforce", then apache2 will fail to restart, since it lacks
    # the ability to send signals to unconfined peers.
    service apache2 stop

    # Point Apache to our bundled mod_wsgi
    ${SDBIN}/mod_wsgi-express module-config > /etc/apache2/mods-available/wsgi.load

    # and make sure it's enabled
    a2enmod wsgi

    # If the profile was disabled enabled it.
    if [ -e "/etc/apparmor.d/disable/usr.sbin.apache2" ]; then
        rm /etc/apparmor.d/disable/usr.sbin.apache2
    fi

    aa-enforce /etc/apparmor.d/usr.sbin.tor
    aa-enforce /etc/apparmor.d/usr.sbin.apache2

    # Munge Apache config while service is stopped.
    adjust_wsgi_configuration

    # Remove Python bytecode from virtualenv
    remove_bytecode

    # Add TLS1.3 configruation to the source configruation if required
    update_to_tls13

    # Restart apache so it loads with the apparmor profiles in enforce mode.
    service apache2 restart

    # cleanup dynamically generated assets
    rm -fr /var/www/securedrop/static/gen/*

    # Version migrations

    database_migration

    ;;

    abort-upgrade|abort-remove|abort-deconfigure)
    ;;

    *)
        echo "postinst called with unknown argument \`$1'" >&2
        exit 1
    ;;
esac

# dh_installdeb will replace this with shell code automatically
# generated by other debhelper scripts.


# Automatically added by dh_python2:
# dh-virtualenv postinst autoscript
set -e
dh_venv_install_dir='/opt/venvs/securedrop-app-code'
dh_venv_package='securedrop-app-code'

# set to empty to enable verbose output
test "${DH_VERBOSE:-0}" = "1" && DH_VENV_DEBUG="" || DH_VENV_DEBUG=:
$DH_VENV_DEBUG set -x


dh_venv_safe_interpreter_update() {
    # get Python version used
    local pythonX_Y=$(cd "$dh_venv_install_dir/lib" && ls -1d python[2-9].*[0-9] | tail -n1)

    local i
    for i in python ${pythonX_Y%.*} ${pythonX_Y}; do
        local interpreter_path="$dh_venv_install_dir/bin/$i"

        # skip any symlinks, and make sure we have an existing target
        test ! -L "$interpreter_path" || continue
        test -x "$interpreter_path" || continue

        # skip if already identical
        if cmp "/usr/bin/$pythonX_Y" "$interpreter_path" >/dev/null 2>&1; then
            continue
        fi

        # hardlink or copy new interpreter
        cp -fpl "/usr/bin/$pythonX_Y" "$interpreter_path,new" \
            || cp -fp "/usr/bin/$pythonX_Y" "$interpreter_path,new" \
            || rm -f "$interpreter_path,new" \
            || true

        # make a backup (once)
        test -f "$interpreter_path,orig" || ln  "$interpreter_path" "$interpreter_path,orig"

        # atomic move
        if test -x "$interpreter_path,new" && mv "$interpreter_path,new" "$interpreter_path"; then
            echo "Successfully updated $interpreter_path"
        else
            echo >&2 "WARNING: Some error occured while updating $interpreter_path"
        fi
    done
}


case "$1" in
    configure|reconfigure)
        $DH_VENV_DEBUG echo "$0 $1 called with $# args:" "$@"
        dh_venv_safe_interpreter_update
        ;;

    triggered)
        $DH_VENV_DEBUG echo "$0 $1 called with $# args:" "$@"
        for trigger in $2; do
            case "$trigger" in
                /usr/bin/python?.*)
                    # this trigger might be for the "wrong" interpreter (other version),
                    # but the "cmp" in "dh_venv_safe_interpreter_update" and the fact we only
                    # ever look at our own Python version catches that
                    dh_venv_safe_interpreter_update
                    ;;
                dh-virtualenv-interpreter-update)
                    dh_venv_safe_interpreter_update
                    ;;
                *)
                    #echo >&2 "ERROR:" $(basename "$0") "called with unknown trigger '$2'"
                    #exit 1
                    ;;
            esac
        done
        ;;

    abort-upgrade|abort-remove|abort-deconfigure)
        ;;

    *)
        #echo >&2 "ERROR:" $(basename "$0") "called with unknown argument '$1'"
        #exit 1
        ;;
esac

$DH_VENV_DEBUG set +x
# END dh-virtualenv postinst autoscript

# End automatically added section
# Automatically added by dh_systemd_enable/12.10ubuntu1
if [ "$1" = "configure" ] || [ "$1" = "abort-upgrade" ] || [ "$1" = "abort-deconfigure" ] || [ "$1" = "abort-remove" ] ; then
	# This will only remove masks created by d-s-h on package removal.
	deb-systemd-helper unmask 'securedrop_rqrequeue.service' >/dev/null || true

	# was-enabled defaults to true, so new installations run enable.
	if deb-systemd-helper --quiet was-enabled 'securedrop_rqrequeue.service'; then
		# Enables the unit on first installation, creates new
		# symlinks on upgrades if the unit file has changed.
		deb-systemd-helper enable 'securedrop_rqrequeue.service' >/dev/null || true
	else
		# Update the statefile to add new symlinks (if any), which need to be
		# cleaned up on purge. Also remove old symlinks.
		deb-systemd-helper update-state 'securedrop_rqrequeue.service' >/dev/null || true
	fi
fi
# End automatically added section
# Automatically added by dh_systemd_enable/12.10ubuntu1
if [ "$1" = "configure" ] || [ "$1" = "abort-upgrade" ] || [ "$1" = "abort-deconfigure" ] || [ "$1" = "abort-remove" ] ; then
	# This will only remove masks created by d-s-h on package removal.
	deb-systemd-helper unmask 'securedrop_rqworker.service' >/dev/null || true

	# was-enabled defaults to true, so new installations run enable.
	if deb-systemd-helper --quiet was-enabled 'securedrop_rqworker.service'; then
		# Enables the unit on first installation, creates new
		# symlinks on upgrades if the unit file has changed.
		deb-systemd-helper enable 'securedrop_rqworker.service' >/dev/null || true
	else
		# Update the statefile to add new symlinks (if any), which need to be
		# cleaned up on purge. Also remove old symlinks.
		deb-systemd-helper update-state 'securedrop_rqworker.service' >/dev/null || true
	fi
fi
# End automatically added section
# Automatically added by dh_systemd_enable/12.10ubuntu1
if [ "$1" = "configure" ] || [ "$1" = "abort-upgrade" ] || [ "$1" = "abort-deconfigure" ] || [ "$1" = "abort-remove" ] ; then
	# This will only remove masks created by d-s-h on package removal.
	deb-systemd-helper unmask 'securedrop_shredder.service' >/dev/null || true

	# was-enabled defaults to true, so new installations run enable.
	if deb-systemd-helper --quiet was-enabled 'securedrop_shredder.service'; then
		# Enables the unit on first installation, creates new
		# symlinks on upgrades if the unit file has changed.
		deb-systemd-helper enable 'securedrop_shredder.service' >/dev/null || true
	else
		# Update the statefile to add new symlinks (if any), which need to be
		# cleaned up on purge. Also remove old symlinks.
		deb-systemd-helper update-state 'securedrop_shredder.service' >/dev/null || true
	fi
fi
# End automatically added section
# Automatically added by dh_systemd_enable/12.10ubuntu1
if [ "$1" = "configure" ] || [ "$1" = "abort-upgrade" ] || [ "$1" = "abort-deconfigure" ] || [ "$1" = "abort-remove" ] ; then
	# This will only remove masks created by d-s-h on package removal.
	deb-systemd-helper unmask 'securedrop_source_deleter.service' >/dev/null || true

	# was-enabled defaults to true, so new installations run enable.
	if deb-systemd-helper --quiet was-enabled 'securedrop_source_deleter.service'; then
		# Enables the unit on first installation, creates new
		# symlinks on upgrades if the unit file has changed.
		deb-systemd-helper enable 'securedrop_source_deleter.service' >/dev/null || true
	else
		# Update the statefile to add new symlinks (if any), which need to be
		# cleaned up on purge. Also remove old symlinks.
		deb-systemd-helper update-state 'securedrop_source_deleter.service' >/dev/null || true
	fi
fi
# End automatically added section
# Automatically added by dh_systemd_enable/12.10ubuntu1
if [ "$1" = "configure" ] || [ "$1" = "abort-upgrade" ] || [ "$1" = "abort-deconfigure" ] || [ "$1" = "abort-remove" ] ; then
	# This will only remove masks created by d-s-h on package removal.
	deb-systemd-helper unmask 'securedrop_rqrequeue.service' >/dev/null || true

	# was-enabled defaults to true, so new installations run enable.
	if deb-systemd-helper --quiet was-enabled 'securedrop_rqrequeue.service'; then
		# Enables the unit on first installation, creates new
		# symlinks on upgrades if the unit file has changed.
		deb-systemd-helper enable 'securedrop_rqrequeue.service' >/dev/null || true
	else
		# Update the statefile to add new symlinks (if any), which need to be
		# cleaned up on purge. Also remove old symlinks.
		deb-systemd-helper update-state 'securedrop_rqrequeue.service' >/dev/null || true
	fi
fi
# End automatically added section
# Automatically added by dh_systemd_enable/12.10ubuntu1
if [ "$1" = "configure" ] || [ "$1" = "abort-upgrade" ] || [ "$1" = "abort-deconfigure" ] || [ "$1" = "abort-remove" ] ; then
	# This will only remove masks created by d-s-h on package removal.
	deb-systemd-helper unmask 'securedrop_rqworker.service' >/dev/null || true

	# was-enabled defaults to true, so new installations run enable.
	if deb-systemd-helper --quiet was-enabled 'securedrop_rqworker.service'; then
		# Enables the unit on first installation, creates new
		# symlinks on upgrades if the unit file has changed.
		deb-systemd-helper enable 'securedrop_rqworker.service' >/dev/null || true
	else
		# Update the statefile to add new symlinks (if any), which need to be
		# cleaned up on purge. Also remove old symlinks.
		deb-systemd-helper update-state 'securedrop_rqworker.service' >/dev/null || true
	fi
fi
# End automatically added section
# Automatically added by dh_systemd_enable/12.10ubuntu1
if [ "$1" = "configure" ] || [ "$1" = "abort-upgrade" ] || [ "$1" = "abort-deconfigure" ] || [ "$1" = "abort-remove" ] ; then
	# This will only remove masks created by d-s-h on package removal.
	deb-systemd-helper unmask 'securedrop_shredder.service' >/dev/null || true

	# was-enabled defaults to true, so new installations run enable.
	if deb-systemd-helper --quiet was-enabled 'securedrop_shredder.service'; then
		# Enables the unit on first installation, creates new
		# symlinks on upgrades if the unit file has changed.
		deb-systemd-helper enable 'securedrop_shredder.service' >/dev/null || true
	else
		# Update the statefile to add new symlinks (if any), which need to be
		# cleaned up on purge. Also remove old symlinks.
		deb-systemd-helper update-state 'securedrop_shredder.service' >/dev/null || true
	fi
fi
# End automatically added section
# Automatically added by dh_systemd_enable/12.10ubuntu1
if [ "$1" = "configure" ] || [ "$1" = "abort-upgrade" ] || [ "$1" = "abort-deconfigure" ] || [ "$1" = "abort-remove" ] ; then
	# This will only remove masks created by d-s-h on package removal.
	deb-systemd-helper unmask 'securedrop_source_deleter.service' >/dev/null || true

	# was-enabled defaults to true, so new installations run enable.
	if deb-systemd-helper --quiet was-enabled 'securedrop_source_deleter.service'; then
		# Enables the unit on first installation, creates new
		# symlinks on upgrades if the unit file has changed.
		deb-systemd-helper enable 'securedrop_source_deleter.service' >/dev/null || true
	else
		# Update the statefile to add new symlinks (if any), which need to be
		# cleaned up on purge. Also remove old symlinks.
		deb-systemd-helper update-state 'securedrop_source_deleter.service' >/dev/null || true
	fi
fi
# End automatically added section
# Automatically added by dh_systemd_enable/12.10ubuntu1
if [ "$1" = "configure" ] || [ "$1" = "abort-upgrade" ] || [ "$1" = "abort-deconfigure" ] || [ "$1" = "abort-remove" ] ; then
	# This will only remove masks created by d-s-h on package removal.
	deb-systemd-helper unmask 'securedrop_rqrequeue.service' >/dev/null || true

	# was-enabled defaults to true, so new installations run enable.
	if deb-systemd-helper --quiet was-enabled 'securedrop_rqrequeue.service'; then
		# Enables the unit on first installation, creates new
		# symlinks on upgrades if the unit file has changed.
		deb-systemd-helper enable 'securedrop_rqrequeue.service' >/dev/null || true
	else
		# Update the statefile to add new symlinks (if any), which need to be
		# cleaned up on purge. Also remove old symlinks.
		deb-systemd-helper update-state 'securedrop_rqrequeue.service' >/dev/null || true
	fi
fi
# End automatically added section
# Automatically added by dh_systemd_enable/12.10ubuntu1
if [ "$1" = "configure" ] || [ "$1" = "abort-upgrade" ] || [ "$1" = "abort-deconfigure" ] || [ "$1" = "abort-remove" ] ; then
	# This will only remove masks created by d-s-h on package removal.
	deb-systemd-helper unmask 'securedrop_rqworker.service' >/dev/null || true

	# was-enabled defaults to true, so new installations run enable.
	if deb-systemd-helper --quiet was-enabled 'securedrop_rqworker.service'; then
		# Enables the unit on first installation, creates new
		# symlinks on upgrades if the unit file has changed.
		deb-systemd-helper enable 'securedrop_rqworker.service' >/dev/null || true
	else
		# Update the statefile to add new symlinks (if any), which need to be
		# cleaned up on purge. Also remove old symlinks.
		deb-systemd-helper update-state 'securedrop_rqworker.service' >/dev/null || true
	fi
fi
# End automatically added section
# Automatically added by dh_systemd_enable/12.10ubuntu1
if [ "$1" = "configure" ] || [ "$1" = "abort-upgrade" ] || [ "$1" = "abort-deconfigure" ] || [ "$1" = "abort-remove" ] ; then
	# This will only remove masks created by d-s-h on package removal.
	deb-systemd-helper unmask 'securedrop_shredder.service' >/dev/null || true

	# was-enabled defaults to true, so new installations run enable.
	if deb-systemd-helper --quiet was-enabled 'securedrop_shredder.service'; then
		# Enables the unit on first installation, creates new
		# symlinks on upgrades if the unit file has changed.
		deb-systemd-helper enable 'securedrop_shredder.service' >/dev/null || true
	else
		# Update the statefile to add new symlinks (if any), which need to be
		# cleaned up on purge. Also remove old symlinks.
		deb-systemd-helper update-state 'securedrop_shredder.service' >/dev/null || true
	fi
fi
# End automatically added section
# Automatically added by dh_systemd_enable/12.10ubuntu1
if [ "$1" = "configure" ] || [ "$1" = "abort-upgrade" ] || [ "$1" = "abort-deconfigure" ] || [ "$1" = "abort-remove" ] ; then
	# This will only remove masks created by d-s-h on package removal.
	deb-systemd-helper unmask 'securedrop_source_deleter.service' >/dev/null || true

	# was-enabled defaults to true, so new installations run enable.
	if deb-systemd-helper --quiet was-enabled 'securedrop_source_deleter.service'; then
		# Enables the unit on first installation, creates new
		# symlinks on upgrades if the unit file has changed.
		deb-systemd-helper enable 'securedrop_source_deleter.service' >/dev/null || true
	else
		# Update the statefile to add new symlinks (if any), which need to be
		# cleaned up on purge. Also remove old symlinks.
		deb-systemd-helper update-state 'securedrop_source_deleter.service' >/dev/null || true
	fi
fi
# End automatically added section
# Automatically added by dh_systemd_start/12.10ubuntu1
if [ "$1" = "configure" ] || [ "$1" = "abort-upgrade" ] || [ "$1" = "abort-deconfigure" ] || [ "$1" = "abort-remove" ] ; then
	if [ -d /run/systemd/system ]; then
		systemctl --system daemon-reload >/dev/null || true
		deb-systemd-invoke start 'securedrop_rqrequeue.service' 'securedrop_rqworker.service' 'securedrop_shredder.service' 'securedrop_source_deleter.service' >/dev/null || true
	fi
fi
# End automatically added section
# Automatically added by dh_systemd_start/12.10ubuntu1
if [ "$1" = "configure" ] || [ "$1" = "abort-upgrade" ] || [ "$1" = "abort-deconfigure" ] || [ "$1" = "abort-remove" ] ; then
	if [ -d /run/systemd/system ]; then
		systemctl --system daemon-reload >/dev/null || true
		deb-systemd-invoke start 'securedrop_rqrequeue.service' 'securedrop_rqworker.service' 'securedrop_shredder.service' 'securedrop_source_deleter.service' >/dev/null || true
	fi
fi
# End automatically added section
# Automatically added by dh_systemd_start/12.10ubuntu1
if [ "$1" = "configure" ] || [ "$1" = "abort-upgrade" ] || [ "$1" = "abort-deconfigure" ] || [ "$1" = "abort-remove" ] ; then
	if [ -d /run/systemd/system ]; then
		systemctl --system daemon-reload >/dev/null || true
		deb-systemd-invoke start 'securedrop_rqrequeue.service' 'securedrop_rqworker.service' 'securedrop_shredder.service' 'securedrop_source_deleter.service' >/dev/null || true
	fi
fi
# End automatically added section


exit 0