"securedrop-admin tailsconfig" fails after updating admin workstation checkout from 0.14.0 to 1.0.0~rc2

[rmol]

Description

Running securedrop-admin tailsconfig after updating the admin workstation repo from 0.14.0 to 1.0.0~rc2 will fail with an error from install_files/ansible-base/roles/validate/tasks/validate_tails_environment.yml, when it checks v3 SSH files in Confirm that a valid set of SSH auth files is present and v3_onion_services is undefined.

Steps to Reproduce

On an admin workstation, with a site-specific file that does not contain the new onion service variables v2_onion_services and v3_onion_services, run:

• cd ~/Persistent/securedrop
• git checkout -b release/1.0.0 origin/release/1.0.0
• ./securedrop-admin tailsconfig

Expected Behavior

That securedrop-admin tailsconfig should run normally.

Actual Behavior

An error is thrown at the Confirm that a valid set of SSH auth files is present task.

Comments

Copying the v2_onion_services and v3_onion_services variable initialization from e.g. roles/app/defaults/main.yml into roles/tails-config/defaults/main.yml will solve this.

Running securedrop-admin sdconfig before tailsconfig, to add the new variables to group_vars/all/site-specific, would fix it as well, but that hasn't been part of our previous upgrade instructions, and isn't otherwise necessary, unless the site is planning on adding v3 Onion service support.

[kushaldas]

I can reproduce this bug.

TASK [tails-config : Confirm that a valid set of SSH auth files is present] ************************************
fatal: [localhost]: FAILED! => {"msg": "The conditional check 'v3_onion_services' failed. The error was: error while evaluating conditional (v3_onion_services): 'v3_onion_services' is undefined\n\nThe error appears to have been in '/home/amnesia/Persistent/securedrop/install_files/ansible-base/roles/validate/tasks/validate_tails_environment.yml': line 51, column 3, but may\nbe elsewhere in the file depending on the exact syntax problem.\n\nThe offending line appears to be:\n\n\n- name: Confirm that a valid set of SSH auth files is present\n  ^ here\n"}