ci(lint): verify machine objects

Adapted from
freedomofpress/securedrop-client#6fcd4ddc4ac6aaf034aa841bbd5651c8ac703737.
Here we do treat "make verify-mo" as a linter, to avoid running it (over
n languages) n times in each of n "translation-tests" jobs.

.circleci/config.yml

@@ -94,6 +94,13 @@ jobs:
             DOCKER_BUILD_ARGUMENTS="--cache-from securedrop-test-focal-py3:${fromtag:-latest}" securedrop/bin/dev-shell \
                   bash -c "/opt/venvs/securedrop-app-code/bin/pip3 install --require-hashes -r requirements/python3/develop-requirements.txt && make -C .. lint"
 
+      - run:
+          name: Check that translation machine objects are reproducible
+          command: |
+            fromtag=$(docker images |grep securedrop-test-focal-py3 |head -n1 |awk '{print $2}')
+            DOCKER_BUILD_ARGUMENTS="--cache-from securedrop-test-focal-py3:${fromtag:-latest}" securedrop/bin/dev-shell \
+                  bash -c "/opt/venvs/securedrop-app-code/bin/pip3 install --require-hashes -r requirements/python3/develop-requirements.txt && make -C .. verify-mo"
+
   rust:
     # Keep version in sync with rust-toolchain.toml
     docker:

securedrop/dockerfiles/focal/python3/Dockerfile

@@ -6,6 +6,8 @@ RUN apt-get update  && apt-get install -y \
     # with its being installed along with everything else since it will be
     # cached along with everything else too.
     default-jdk \
+    # For diffoscope:
+    libarchive13 libmagic1 \
     libasound2 libdbus-glib-1-2 libgtk2.0-0 libfontconfig1 libxrender1 \
     libcairo-gobject2 libgtk-3-0 libstartup-notification0 npm && \
     npm install --global [email protected]