Check for private key file with SDW config validator. Add validator unit tests.

[rocodes]

Status

Ready for review

Description of Changes

Fixes #1202

• smoketest for armored private key files in sdw config validator
• add sdw config validator unit tests

Fixes #1215

Testing

• visual review
• ci
• Build an rpm from the tip of this branch and install in dom0. sdw-admin --validate with a valid key file succeeds; sdw-admin --validate with a missing or malformed key or a pubkey file fails.
• Passphrase-protected PGP secret key yields descriptive error message: sdw-admin --validate should inform users when a Submission Key has a passphrase set #1215
• make clone && make test in dom0 succeeds (or CI passing).

Deployment

Any special considerations for deployment? Consider both:

1. Upgrading existing pilot instances
2. New installs

Checklist

If you have made changes to the provisioning logic

• All tests (make test) pass in dom0

If you have added or removed files

• I have updated MANIFEST.in and rpm-build/SPECS/securedrop-workstation-dom0-config.spec

If documentation is required

• I have opened a PR in the docs repo for these changes, or will do so later
• I would appreciate help with the documentation

[deeplow]

Approved. Happy to see some guard-rails for potentially Johnny-can't-encrypt type problems :)

It's currently only missing CI, which failed for another reason.

[deeplow]

It's an unrelated issue, but @rocodes what do you think about printing just the error message as opposed to the python traceback?

[rocodes]

@deeplow I'm generally in favour of that :) Are you referring to the CI failure here:
INFO:[2024-11-28-21:43:37:519991] subprocess.CalledProcessError: Command '['sudo', 'qubesctl', '--show-output', 'state.highstate']' returned non-zero exit status 1. [...] ? If yes, I'd suggest that as a separate issue about console output during provisioning, which I agree would be an improvement.

[deeplow]

Are you referring to the CI failure here:
INFO:[2024-11-28-21:43:37:519991] subprocess.CalledProcessError: Command '['sudo', 'qubesctl', '--show-output', 'state.highstate']' returned non-zero exit status 1. [...] ? If yes, I'd suggest that as a separate issue about console output during provisioning, which I agree would be an improvement.

Sorry, but I'm not sure I follow. I'm talking about that issue, but it does show the salt output. The error is:

INFO:[2024-11-28-21:43:37:490899]           ID: enable-user-units
INFO:[2024-11-28-21:43:37:490945]     Function: cmd.run
INFO:[2024-11-28-21:43:37:490974]         Name: systemctl --user daemon-reload
INFO:[2024-11-28-21:43:37:491006] systemctl --user enable sdw-notify.timer
INFO:[2024-11-28-21:43:37:491034] 
INFO:[2024-11-28-21:43:37:491066]       Result: False
INFO:[2024-11-28-21:43:37:491093]      Comment: Command "systemctl --user daemon-reload
INFO:[2024-11-28-21:43:37:491126]               systemctl --user enable sdw-notify.timer
INFO:[2024-11-28-21:43:37:491151]               " run
INFO:[2024-11-28-21:43:37:491184]      Started: 21:42:53.059047
INFO:[2024-11-28-21:43:37:491210]     Duration: 189.213 ms
INFO:[2024-11-28-21:43:37:491243]      Changes:   
INFO:[2024-11-28-21:43:37:491269]               ----------
INFO:[2024-11-28-21:43:37:491302]               pid:
INFO:[2024-11-28-21:43:37:491328]                   13529
INFO:[2024-11-28-21:43:37:491360]               retcode:
INFO:[2024-11-28-21:43:37:491386]                   1
INFO:[2024-11-28-21:43:37:491418]               stderr:
INFO:[2024-11-28-21:43:37:491444]                   Failed to connect to bus: No such file or directory
INFO:[2024-11-28-21:43:37:491477]                   Failed to connect to bus: No such file or directory
INFO:[2024-11-28-21:43:37:491503]               stdout:

[rocodes]

(Just rebased to try to get a successful CI run.)

[rocodes]

Sorry, but I'm not sure I follow. I'm talking about that issue, but it does show the salt output. The error is: [snip]

Yes; it looks like CI has been failing on main for a while, I'm looking into it, but it's not code that is introduced in this PR. I will investigate and hopefully put up a fix today, then we can see some more 🟢 here. : )

Regarding your request about not showing tracebacks, I am in favour, and since that's also a bit outside the scope of this specific PR I have filed #1207 - hth :)

[rocodes]

(CI issue should be resolved; now also includes a fix for #1215 and an updated test plan item)

[deeplow]

New changes look good. Approved for your merge, @rocodes.

[rocodes]

Thank you!