make staging-focal for a Focal based staging environment

[kushaldas]

Description

We need make staging-focal to create a Ubuntu Focal based staging environment which can use the locally built packages.

This is part of #4768

Progress

• Create a barebones staging environment for iterating - Adds libvirt staging environment for Focal #5486
• Focal staging environment installs completely with no errors - Provides first-run custom kernel support for Focal #5518
• Support multiple VM drivers (e.g. libvirt, qubes) Updates pytest pluggy testinfra molecule and the universe #5585

[conorsch]

@kushaldas Do you have any unpushed WIP branches for Focal staging support? I checked the recent branches on the remote, didn't see anything, so pushed: https://github.com/freedomofpress/securedrop/tree/5468-libvirt-staging-focal That's enough to get the VMs up and running, but they fail when configuring the apt-test repo, since we don't have any packages in the Focal channel on apt-test yet. As soon as freedomofpress/securedrop-apt-test#60 is merged, I'd expect the initial repo setup to work, but we shall see.

Feel free to append to that branch or point me somewhere else to peek at ongoing work.

[conorsch]

Opened a draft PR documenting what progress we've made so far: #5486 @kushaldas has some pre-existing work in the on_focal branch, some of which may need to be pulled in.

Major problems encountered so far:

• Custom kernel installation doesn't work. Ostensibly this is merely due to lack of a securedrop-grsec metapackage for focal on apt-test, see Add preliminary Focal packages to apt-test securedrop-apt-test#59 (comment)
• The PaX flags supported by the grub binaries have changed header formats. We can work around this with distro-specific logic, but I'm inclined to switch to paxctld, which we're already using in the Workstation (https://github.com/freedomofpress/securedrop-debian-packaging/blob/3f33993e4cadc6e3ff713944e1d9f3df54ccea7a/securedrop-workstation-grsec/debian/control#L15), see Use paxctld to manage all PaX flags in Ubuntu Focal #4134
• The app-code deb package fails to install due to a missing wsgi call in postinst; possibly related to "Upgrade (and review) mod_wsgi dependency" in Support for Ubuntu 20.04 (Focal) #4768

[eloquence]

(Closing this out, we do have make staging-focal, tasks that were remaining are already tracked separately).