Consider avoiding assert statements in validate_config.py

[eloquence]

Informational finding TOB-SDW-024 from the 2020 SecureDrop Workstation audit (PDF) notes that assert statements are optimized out if Python is ever run with the -O or -OO flags and recommends eventually factoring them out in favor of if conditions and custom exceptions in validate_config.py, which is not test code but used during the installation.

[pierwill]

I'd be happy to help with this. Would we need a small helper function that tests for truth and exits on false?

[conorsch]

That's right, simply refactoring the logic not to use assert would be sufficient. Over in the SD repo we have a rather complex validator for server config https://github.com/freedomofpress/securedrop/blob/c267329e5bad9c3396a5087b41275bb324fbf4f8/admin/securedrop_admin/__init__.py#L119 but I don't think you need to go quick so far to satisfy this issue! =)

[gonzalo-bulnes]

Would we need a small helper function that tests for truth and exits on false?

I was thinking along the same lines. I think I'd make all those functions return a bool and either exit early with a function like @pierwill suggests, or collect all the steps and exit 0 or 1 if any of the checks returned False.

[zenmonkeykstop]

Planning to investigate config validation in the near future, will take this ticket on as a first step.