added Ansible parameter to use legacy password prompt text

[zenmonkeykstop]

Status

Ready for review

Description of Changes

Fixes #5254.

Sets agnostic_become_prompt to False in ansible.cfg. This sets the password prompt when ansible is called with --ask-become-pass to SUDO password:. When set to True, the prompt is set as BECOME password:.

The default value was switched in Ansible 2.8, but the GUI updater expects the False and SUDO password version, so it needs to be set explicitly.

Testing

In a prod instance (VMs or hardware):

• check out this branch in an Admin Workstation
• run ./securedrop-admin setup - it completes without error
• follow the installation guide and verify that:
  • the password prompt for ./securedrop-admin install is SUDO password:
  • the password prompt for ./securedrop-admin tailsconfig is SUDO password:
  • both commands complete successfully.

Deployment

This will be deployed with the next production release after merge - as it preserves existing behaviour it should not have any impact on the GUI updater.

Checklist

If you made non-trivial code changes:

• I have written a test plan and validated it for this PR

[rmol]

Worked for me:

• run ./securedrop-admin setup - it completes without error
• follow the installation guide and verify that:
  • the password prompt for ./securedrop-admin install is SUDO password:
  • the password prompt for ./securedrop-admin tailsconfig is SUDO password:
  • both commands complete successfully.

Think there should be a second review before merging this though.

[zenmonkeykstop]

Agreed - I tested this via the GUI updater on Tails as follows:

• checked out this branch, tagged it locally as 1.3.0
• checked out 1.2.2, deleted the 1.2.2 tag (locally!)
• disabled signature verification in admin/securedrop_admin/__init.py, committed, and tagged locally as 1.2.2
• bumped network connection to trigger updater and followed regular flow

This worked, the tailsconfig phase completed successfully. This isn't a perfect test as it involves the surgery mentioned above, but it does increase my confidence in the fix .If someone else wants to run through a similar process, feel free.

[rmol]

I repeated that process and can confirm that the updater has no problem with the escalation prompt after (this pending version of) 1.3.0 is checked out.

[conorsch]

Merging based on @rmol's two-pass test report.