Add builder tests for securedrop-config

At build time, let's ensure:
- no conffiles are present so that files in /etc are properly squashed
- securedrop-config contains the expected files

molecule/builder-trusty/tests/test_securedrop_deb_package.py

@@ -241,7 +241,7 @@ def test_deb_package_contains_expected_conffiles(host, deb):
     deb_package = host.file(deb.format(
         securedrop_test_vars.securedrop_version))
 
-    # Only relevant for the securedrop-app-code package:
+    # For the securedrop-app-code package:
     if "securedrop-app-code" in deb_package.path:
         tmpdir = tempfile.mkdtemp()
         # The `--raw-extract` flag includes `DEBIAN/` dir with control files
@@ -255,6 +255,12 @@ def test_deb_package_contains_expected_conffiles(host, deb):
         conffiles = f.content_string.rstrip()
         assert conffiles == "/var/www/securedrop/static/i/logo.png"
 
+    # For the securedrop-config package, we want to ensure there are no
+    # conffiles so securedrop_additions.sh is squashed every time
+    if "securedrop-config" in deb_package.path:
+        c = host.run("dpkg-deb -I {}".format(deb))
+        assert "conffiles" not in c.stdout
+
 
 @pytest.mark.parametrize("deb", deb_packages)
 def test_deb_package_contains_css(host, deb):
@@ -449,3 +455,21 @@ def test_ossec_binaries_are_present_server(host, deb):
         c = host.run("dpkg-deb --contents {}".format(deb_package.path))
         for wanted_file in wanted_files:
             assert wanted_file in c.stdout
+
+
+@pytest.mark.parametrize("deb", deb_packages)
+def test_config_package_contains_expected_files(host, deb):
+    """
+    Inspect the package contents to ensure all config files are included in
+    the package.
+    """
+    deb_package = host.file(deb.format(
+        securedrop_test_vars.securedrop_version))
+    if "securedrop-config" in deb_package.path:
+        wanted_files = [
+            "/etc/cron-apt/action.d/9-remove",
+            "/etc/profile.d/securedrop_additions.sh",
+        ]
+        c = host.run("dpkg-deb --contents {}".format(deb_package.path))
+        for wanted_file in wanted_files:
+            assert wanted_file in c.stdout