Merge pull request #5792 from freedomofpress/5781-release-upgrader-se…

…ttings

Installs release-upgrader in prepare-servers role

install_files/ansible-base/roles/prepare-servers/tasks/main.yml

@@ -21,15 +21,15 @@
       SecureDrop cannot be installed. For details, see
       https://github.com/freedomofpress/securedrop/issues/4058
 
+- name: Install python and packages required by installer
+  raw: apt install -y python3 apt-transport-https dnsutils ubuntu-release-upgrader-core
+  register: _apt_install_prereqs_results
+  changed_when: "'0 upgraded, 0 newly installed, 0 to remove' not in _apt_install_prereqs_results.stdout"
+
 - name: Remove cloud-init
   apt:
     name: cloud-init
     state: absent
     purge: yes
   tags:
     - apt
-
-- name: Install python and packages required by installer
-  raw: apt install -y python apt-transport-https dnsutils
-  register: _apt_install_prereqs_results
-  changed_when: "'0 upgraded, 0 newly installed, 0 to remove' not in _apt_install_prereqs_results.stdout"

molecule/testinfra/common/test_release_upgrades.py

@@ -4,6 +4,16 @@
 testinfra_hosts = [test_vars.app_hostname, test_vars.monitor_hostname]
 
 
+def test_release_manager_installed(host):
+    """
+    The securedrop-config package munges `do-release-upgrade` settings
+    that assume the release-upgrader logic is installed. On hardware
+    installs of Ubuntu, it is, but the VM images we use in CI may
+    remove it to make the boxes leaner.
+    """
+    assert host.package("ubuntu-release-upgrader-core").is_installed
+
+
 def test_release_manager_upgrade_channel(host):
     """
     Ensures that the `do-release-upgrade` command will not

molecule/testinfra/common/test_system_hardening.py

@@ -148,6 +148,7 @@ def test_no_ecrypt_messages_in_logs(host, logfile):
 @pytest.mark.parametrize('package', [
     'cloud-init',
     'libiw30',
+    'python-is-python2',
     'snapd',
     'wireless-tools',
     'wpasupplicant',