Skip to content

Commit 8689ccd

Browse files
legoktmlegoktm
authored
Merge pull request #7606 from freedomofpress/admin-deb
Refactor `securedrop-admin` to be a Debian package
2 parents 58d650e + 9551535 commit 8689ccd

File tree

88 files changed

+1726
-4070
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

88 files changed

+1726
-4070
lines changed

‎.github/workflows/build.yml‎

Lines changed: 7 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -34,12 +34,15 @@ jobs:
3434
- uses: actions/setup-python@v6
3535
with:
3636
python-version: ${{ matrix.versions.python }}
37-
- name: Build packages
37+
- name: Build SecureDrop packages
3838
run: |
39-
UBUNTU_VERSION=${{ matrix.versions.ubuntu }} ./builder/build-debs.sh
39+
OS_VERSION=${{ matrix.versions.ubuntu }} ./builder/build-debs.sh
4040
- name: Build OSSEC packages
4141
run: |
42-
UBUNTU_VERSION=${{ matrix.versions.ubuntu }} WHAT=ossec ./builder/build-debs.sh
42+
OS_VERSION=${{ matrix.versions.ubuntu }} WHAT=ossec ./builder/build-debs.sh
43+
- name: Build admin packages
44+
run: |
45+
OS_VERSION=${{ matrix.versions.ubuntu }} WHAT=admin ./builder/build-debs.sh
4346
- uses: actions/upload-artifact@v5
4447
id: upload
4548
with:
@@ -67,7 +70,7 @@ jobs:
6770
run: |
6871
find . -name '*.deb' -exec sha256sum {} \;
6972
# FIXME: securedrop-app-code isn't reproducible
70-
for pkg in ossec-agent ossec-server securedrop-config securedrop-keyring securedrop-ossec-agent securedrop-ossec-server
73+
for pkg in ossec-agent ossec-server securedrop-config securedrop-keyring securedrop-ossec-agent securedrop-ossec-server securedrop-admin
7174
do
7275
echo "Checking ${pkg}..."
7376
diffoscope ${{ matrix.ubuntu_version }}-one/${pkg}_*.deb ${{ matrix.ubuntu_version }}-two/${pkg}_*.deb

‎.github/workflows/ci.yml‎

Lines changed: 0 additions & 21 deletions
Original file line numberDiff line numberDiff line change
@@ -121,27 +121,6 @@ jobs:
121121
make rust-lint
122122
make rust-test
123123
124-
updater-gui-tests:
125-
runs-on: ubuntu-latest
126-
container: debian:bookworm
127-
steps:
128-
- name: Install dependencies
129-
run: |
130-
apt-get update && apt-get install --yes git libqt5designer5 python3-venv
131-
- uses: actions/checkout@v5
132-
with:
133-
persist-credentials: false
134-
- name: Install Python dependencies
135-
run: |
136-
cd journalist_gui
137-
python3 -m venv .venv/ && source .venv/bin/activate
138-
pip install --require-hashes -r dev-requirements.txt
139-
- name: Run tests
140-
run: |
141-
cd journalist_gui
142-
source .venv/bin/activate
143-
QT_QPA_PLATFORM=offscreen python3 test_gui.py -v
144-
145124
admin-tests:
146125
runs-on: ubuntu-latest
147126
steps:

‎.gitignore‎

Lines changed: 4 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -181,4 +181,7 @@ securedrop/geckodriver.log
181181

182182
# Rust build artifacts
183183
target/
184-
redwood/build/
184+
redwood/build/
185+
186+
# Admin build artifacts
187+
admin/build/

‎Makefile‎

Lines changed: 24 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -34,7 +34,7 @@ update-admin-pip-requirements: ## Update admin requirements.
3434
.PHONY: update-python3-requirements
3535
update-python3-requirements: ## Update Python 3 requirements with pip-compile.
3636
@echo "███ Updating Python 3 requirements files..."
37-
@SLIM_BUILD=1 UBUNTU_VERSION=noble $(DEVSHELL) $(SDBIN)/update-requirements
37+
@SLIM_BUILD=1 OS_VERSION=noble $(DEVSHELL) $(SDBIN)/update-requirements
3838

3939
.PHONY: update-pip-requirements
4040
update-pip-requirements: update-admin-pip-requirements update-python3-requirements ## Update all requirements with pip-compile.
@@ -499,6 +499,29 @@ build-debs-ossec-notest: ## Build OSSEC Debian packages without running tests
499499
@echo "$(SCRIPT_MESSAGE)"
500500
@echo "$(OUT)"
501501

502+
.PHONY: build-debs-admin
503+
build-debs-admin: OUT:=$(SCRIPT_OUTPUT_PREFIX)-securedrop-admin.$(SCRIPT_OUTPUT_EXT)
504+
build-debs-admin: ## Build admin Debian packages
505+
@echo "Building admin Debian packages"
506+
@export TERM=dumb
507+
@WHAT=admin script \
508+
--command $(SDROOT)/builder/build-debs.sh --return \
509+
$(OUT)
510+
@echo
511+
@echo "$(SCRIPT_MESSAGE)"
512+
@echo "$(OUT)"
513+
514+
.PHONY: build-debs-admin-notest
515+
build-debs-admin-notest: OUT:=$(SCRIPT_OUTPUT_PREFIX)-securedrop-admin.$(SCRIPT_OUTPUT_EXT)
516+
build-debs-admin-notest: ## Build admin Debian packages without running tests
517+
@echo "Building admin Debian packages, skipping tests..."
518+
@export TERM=dumb
519+
@NOTEST=1 WHAT=admin script \
520+
--command $(SDROOT)/builder/build-debs.sh --return \
521+
$(OUT)
522+
@echo
523+
@echo "$(SCRIPT_MESSAGE)"
524+
@echo "$(OUT)"
502525

503526
########################
504527
#

‎admin/Dockerfile‎

Lines changed: 47 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -1,23 +1,55 @@
11
# debian:trixie 2025-08-25
22
FROM debian@sha256:6d87375016340817ac2391e670971725a9981cfc24e221c47734681ed0f6c0f5
33
ARG USER_NAME
4-
ENV USER_NAME ${USER_NAME:-root}
4+
ENV USER_NAME=${USER_NAME:-root}
55
ARG USER_ID
6-
ENV USER_ID ${USER_ID:-0}
6+
ENV USER_ID=${USER_ID:-0}
77

8-
ENV LC_ALL C.UTF-8
9-
ENV LANG C.UTF-8
8+
ENV LC_ALL=C.UTF-8
9+
ENV LANG=C.UTF-8
1010

11-
RUN apt-get update && \
12-
apt-get install -y python3 sudo gnupg2 git sq
13-
RUN if test $USER_NAME != root ; then useradd --no-create-home --home-dir /tmp --uid $USER_ID $USER_NAME && echo "$USER_NAME ALL=(ALL) NOPASSWD:ALL" >> /etc/sudoers ; fi
11+
# Install deps for building securedrop-admin package
12+
ARG DEBIAN_FRONTEND=noninteractive
13+
RUN apt-get -y update && \
14+
apt-get -y upgrade && \
15+
apt-get -y install \
16+
coreutils \
17+
debhelper \
18+
devscripts \
19+
dh-python \
20+
make \
21+
pkg-config \
22+
python3-all \
23+
python3-pip \
24+
python3-setuptools \
25+
python3-venv \
26+
rsync \
27+
sudo \
28+
tzdata \
29+
unzip \
30+
virtualenv \
31+
gnupg2 \
32+
git
1433

15-
WORKDIR /opt/admin
16-
COPY . /opt
17-
RUN rm -rf /opt/admin/.venv3
18-
RUN cd /opt/admin && python3 bootstrap.py -v
19-
ENV VIRTUAL_ENV /opt/admin/.venv3
20-
ENV PATH="$VIRTUAL_ENV/bin:$PATH"
21-
RUN pip3 install --no-deps --require-hashes -r /opt/admin/requirements-dev.txt
34+
# Add user if necessary
35+
RUN if test $USER_NAME != root ; then \
36+
useradd --no-create-home --home-dir /tmp --uid $USER_ID $USER_NAME && \
37+
echo "$USER_NAME ALL=(ALL) NOPASSWD:ALL" >> /etc/sudoers ; \
38+
fi
2239

23-
RUN chown -R $USER_NAME /opt
40+
WORKDIR /src
41+
COPY . /src
42+
43+
# Build and install the securedrop-admin package
44+
ENV PATH="/usr/share/securedrop-admin/venv/bin:$PATH"
45+
RUN ln -s /src/builder/fixup-changelog.sh /fixup-changelog
46+
RUN /src/builder/build-debs-admin.sh
47+
RUN apt-get install -y /src/build/trixie/securedrop-admin_*+trixie_amd64.deb
48+
49+
# Install dev dependencies in a separate venv
50+
RUN /usr/bin/python3 -m venv /opt/admin-dev/venv
51+
RUN /opt/admin-dev/venv/bin/pip install --no-deps --require-hashes -r /src/admin/requirements-dev.txt
52+
53+
WORKDIR /src/admin
54+
55+
RUN chown -R $USER_NAME /src

‎admin/Makefile‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -3,14 +3,14 @@ DEFAULT_GOAL: help
33
.PHONY: test
44
test: ## Run tox
55
@echo "NB. This can be VERY slow. If you find yourself running this test suite multiple times, you may prefer to \"docker run -it securedrop-admin bash\", install the editor of your choice into the container and edit there, and run \"tox\" directly as you work."
6-
bin/dev-shell tox
6+
bin/dev-shell /opt/admin-dev/venv/bin/tox
77

88
.PHONY: update-pip-requirements
99
update-pip-requirements: ## Updates all Python requirements files via pip-compile.
1010
@echo "███ Updating admin pip requirements..."
11-
@bin/dev-shell pip-compile --allow-unsafe --generate-hashes --output-file requirements.txt requirements.in requirements-ansible.in
12-
@bin/dev-shell pip-compile --allow-unsafe --generate-hashes --output-file requirements-testinfra.txt requirements.in requirements-ansible.in requirements-testinfra.in
13-
@bin/dev-shell pip-compile --allow-unsafe --generate-hashes --output-file requirements-dev.txt requirements-dev.in
11+
@bin/dev-shell /opt/admin-dev/venv/bin/pip-compile --allow-unsafe --generate-hashes --output-file requirements.txt requirements.in requirements-ansible.in
12+
@bin/dev-shell /opt/admin-dev/venv/bin/pip-compile --allow-unsafe --generate-hashes --output-file requirements-testinfra.txt requirements.in requirements-ansible.in requirements-testinfra.in
13+
@bin/dev-shell /opt/admin-dev/venv/bin/pip-compile --allow-unsafe --generate-hashes --output-file requirements-dev.txt requirements-dev.in
1414

1515
# Explanation of the below shell command should it ever break.
1616
# 1. Set the field separator to ": ##" and any make targets that might appear between : and ##

‎admin/bin/dev-shell‎

Lines changed: 1 addition & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -17,14 +17,11 @@ if test -t 0; then
1717
fi
1818

1919
function docker_image() {
20-
local out
21-
out="$(mktemp)"
2220
cd "${TOPLEVEL}"
2321
if ! docker build \
2422
--build-arg=USER_ID="$(id -u)" \
2523
--build-arg=USER_NAME="${USER:-root}" \
26-
${DOCKER_BUILD_ARGUMENTS:-} -t securedrop-admin -f admin/Dockerfile . >& "$out" ; then
27-
cat "$out"
24+
${DOCKER_BUILD_ARGUMENTS:-} -t securedrop-admin -f admin/Dockerfile . ; then
2825
status=1
2926
else
3027
status=0

‎admin/bin/securedrop-admin-packaged‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,6 @@
1+
#!/usr/share/securedrop-admin/venv/bin/python3
2+
import sys
3+
4+
from securedrop_admin import main
5+
6+
main(sys.argv[1:])

‎admin/bootstrap-tails-wrapper.sh‎

Lines changed: 73 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,73 @@
1+
#!/bin/bash
2+
# Bootstrap script for fresh Tails installations
3+
# This script sets up SecureDrop admin tools on Tails via APT
4+
set -e
5+
set -o pipefail
6+
7+
SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
8+
9+
# Check if running on Tails
10+
if ! grep -q 'NAME="Tails"' /etc/os-release; then
11+
zenity --error \
12+
--title="Unsupported Platform" \
13+
--width=500 \
14+
--text="This command only works on Tails.\n\nCurrent platform is not supported."
15+
exit 1
16+
fi
17+
18+
echo "========================================"
19+
echo "SecureDrop Admin Tools Bootstrap"
20+
echo "========================================"
21+
echo ""
22+
echo "This will install the SecureDrop admin tools on Tails..."
23+
echo ""
24+
25+
# Run the root script
26+
ROOT_SCRIPT="$SCRIPT_DIR/configure-tails-persistence.sh"
27+
echo "Configuring Tails persistence (requires password)..."
28+
if ! pkexec bash "$ROOT_SCRIPT"; then
29+
echo ""
30+
echo "========================================"
31+
echo "ERROR: Bootstrap failed!"
32+
echo "========================================"
33+
echo ""
34+
zenity --error \
35+
--title="Bootstrap Failed" \
36+
--width=500 \
37+
--text="Failed to configure Tails persistence.\n\nPlease see the terminal output for details."
38+
exit 1
39+
fi
40+
41+
# Verify installation
42+
if ! command -v /usr/bin/securedrop-admin >/dev/null 2>&1; then
43+
echo ""
44+
echo "========================================"
45+
echo "ERROR: Installation failed!"
46+
echo "========================================"
47+
echo ""
48+
zenity --error \
49+
--title="Bootstrap Failed" \
50+
--width=500 \
51+
--text="Package installed but securedrop-admin command not found.\n\nInstallation may have failed."
52+
exit 1
53+
fi
54+
55+
echo ""
56+
echo "========================================"
57+
echo "Bootstrap completed successfully!"
58+
echo "========================================"
59+
echo ""
60+
61+
# Inform user to click Install Every Time
62+
zenity --info \
63+
--title="Click Install Every Time" \
64+
--width=500 \
65+
--text="In the Additional Software notification above, click \"Install Every Time\"."
66+
67+
# Show final instructions
68+
zenity --info \
69+
--title="Reboot Tails" \
70+
--width=500 \
71+
--text="Please REBOOT Tails to complete bootstrapping SecureDrop Admin Tools."
72+
73+
exit 0

0 commit comments

Comments
 (0)