fix: added match for new key in updater

[zenmonkeykstop]

Status

Ready for review

Description of Changes

Fixes #5994 .

Adds signature verification match for 2021 release key, allowing GUI updater to validate tags signed with new key.

Testing

Updates with existing tags signed with old key:

On an admin or journalist workstation:

• check out this branch
• bounce the network connection:
  • verify that the GUI updater appears
  • verify that the update completes successfully when triggered

Updates with new tag signed with new key:

• TBD

Deployment

• Change to be deployed with last release with tag signed with old key.
• Once the new updater code is in place, tags can be signed with new key

Checklist

If you made changes to securedrop-admin:

• Linting and tests (make -C admin test) pass in the admin development container

If you made non-trivial code changes:

• I have written a test plan and validated it for this PR

Choose one of the following:

• I have opened a PR in the docs repo for these changes, or will do so later
• I would appreciate help with the documentation
• These changes do not require documentation

[eloquence]

I believe this will resolve, lmk if there are additional testing steps that would help ensure the correct behavior. From testing in the REPL, with output of git tag -v modified to use the new UID:

>>> good_sig_text = ['Good signature from "SecureDrop Release Signing ' + 'Key"', 'Good signature from "SecureDrop Release Signing ' + 'Key <[email protected]>"', 'Good signature from "SecureDrop Release Signing ' + 'Key <[email protected]>"']
>>> lines="""
... object f9baa82372de82bcbc08d9bad74ccd603ac9db1d
... type commit
... tag 1.8.2
... tagger Kevin O'Gorman <[email protected]> 1621370169 +0000
... 
... SecureDrop 1.8.2
... gpg: Signature made Tue 18 May 2021 08:43:49 PM UTC
... gpg:                using RSA key 22245C81E3BAEB4138B36061310F561200F4AD77
... gpg: Good signature from "SecureDrop Release Signing Key <[email protected]>" [unknown]
... gpg:                 aka "SecureDrop Release Signing Key" [unknown]
... gpg: WARNING: This key is not certified with a trusted signature!
... gpg:          There is no indication that the signature belongs to the owner.
... Primary key fingerprint: 2224 5C81 E3BA EB41 38B3  6061 310F 5612 00F4 AD77
... """
>>> gpg_lines=lines.split('\n')
>>> gpg_lines
['', 'object f9baa82372de82bcbc08d9bad74ccd603ac9db1d', 'type commit', 'tag 1.8.2', "tagger Kevin O'Gorman <[email protected]> 1621370169 +0000", '', 'SecureDrop 1.8.2', 'gpg: Signature made Tue 18 May 2021 08:43:49 PM UTC', 'gpg:                using RSA key 22245C81E3BAEB4138B36061310F561200F4AD77', 'gpg: Good signature from "SecureDrop Release Signing Key <[email protected]>" [unknown]', 'gpg:                 aka "SecureDrop Release Signing Key" [unknown]', 'gpg: WARNING: This key is not certified with a trusted signature!', 'gpg:          There is no indication that the signature belongs to the owner.', 'Primary key fingerprint: 2224 5C81 E3BA EB41 38B3  6061 310F 5612 00F4 AD77', '']
>>> good_sig_matches = [s for s in gpg_lines if any(xs in s for xs in good_sig_text)]
>>> good_sig_matches
['gpg: Good signature from "SecureDrop Release Signing Key <[email protected]>" [unknown]']
>>> len(good_sig_matches)
1

[kushaldas]

Worked with the following steps:

On an admin or journalist workstation:

• check out this branch
• bounce the network connection:
• verify that the GUI updater appears
• verify that the update completes successfully when triggered