securedrop-admin setup fails on Tails 4

[redshiftzero]

Description

We need to add a torify call to the pip install commands in securedrop-admin setup

Steps to Reproduce

1. Install the Tails 4 beta: https://tails.boum.org/news/test_4.0-beta2/
2. Set up persistence
3. Clone the SecureDrop repo
4. From ~/Persistent/securedrop, run ./securedrop-admin setup

Expected Behavior

apt and python dependencies are installed

Actual Behavior

apt dependencies are installed, but then:

ERROR: Failed to install pip dependencies. Check network connection and try again.

Comments

Rerunning with -v indicates that the problem is a connection failure. Prefixing the ./admin/.venv/bin/pip install -r admin/requirements.txt [...more options snipped....] command with torify resolves.

Related to #4669

[kushaldas]

@pradyunsg should we also file a bug against pip for this?

[pradyunsg]

If someone is willing to post the options passed to pip and more complete output from pip (redacting any sensitive information appropriately), it'll be much easier for me to tell if it's a pip thing or a tor/tails thing or an invocation issue. The arguments/output would help me confirm that.

---

I feel that this is more of a situation of needing to push pip's connections through Tor, when on Tails.

A quick look at the corresponding code makes me think that the issue is either in pip, or admin/bootstrap.py:is_tails() isn't working right. There's already maybe_torify() at that call site (I think the OP is suggesting that's what is needed). I'm not familiar with the code here, so I'm guessing here. :)

securedrop/admin/bootstrap.py

Line 185 in 7a9750d

pip_output = subprocess.check_output(maybe_torify() + pip_install_cmd,

[emkll]

Tails 4.0 is scheduled to be released on October 22 (per https://tails.boum.org/contribute/calendar/)

[redshiftzero]

yep looks like the issue is is_tails() (lsb_release is not Tails), meaning this ticket has the same root cause as #4767

[zenmonkeykstop]

Filed a bug against Tails instead of pip: https://redmine.tails.boum.org/code/issues/17074

Adding an unreliable check (is the system Debian? is the node name amnesia? - probably Tails then) to unblock Tails 4.0 testing until bug above is fixed.