Update template build logic to use debian10-buster

[emkll]

Closes freedomofpress/securedrop-workstation#308

Background

• Kernel configuration / build logic : Update securedrop-workstation and securedrop-core to 4.14.150 ansible-role-grsecurity-build#51
• Packages for buster channel needed for build logic, including kernel images, headers, and metapackages, as well as config metapackages: Add Buster channel for securedrop-workstation and 4.14.151 kernel images securedrop-apt-test#22

Test plan:

• Create (or repurpose) a fedora-based Qube with at least 20GB of private storage
• Check out securedrop-workstation's master branch
• apply the following diff (this is for testing only, to make testing easier and to avoid the manual build steps)

diff --git a/builder/build-workstation-template b/builder/build-workstation-template
index 103ae03..eb5323e 100755
--- a/builder/build-workstation-template
+++ b/builder/build-workstation-template
@@ -24,7 +24,7 @@ fi
 rm -rf "${qubes_builder_dir}" "${sd_template_dir}"
 
 git clone https://github.com/qubesos/qubes-builder "${build_dir}/qubes-builder"
-git clone https://github.com/freedomofpress/qubes-template-securedrop-workstation "${sd_template_dir}"
+git clone -b debian-buster https://github.com/freedomofpress/qubes-template-securedrop-workstation "${sd_template_dir}"
 
 cd "${qubes_builder_dir}"

• make template completes without error (this should take 20-30 minutes depending on internet speed)
• Copy the built template into dom0 (the template is in securedrop-workstation/builder/qubes-builder/qubes-src/rpmbuild/rpm/noarch)
• install the template in dom0
• template installs successfully in dom0
• Run qvm-prefs securedrop-workstation-buster virt_mode hvm
• Run qvm-prefs securedrop-workstation-buster kernel ""
• The templateVM boots, and uname -r returns 4.14.151-grsec
• The name of the template makes sense (it was purposely not named securedrop-worksation so that this template can coexist happily with securedrop-workstation template

pre merge

Before merging, please revert commit 250f989 which was introduced for testing only

post merge:

• push a signed tag pointing to master's HEAD with the FPF Authority Key
  250f989

[conorsch]

Success!

Followed the test plan exactly. Encountered two small bumps in the road:

1. Had to update the pubkey logic in the securedrop-workstation repo; I'll submit a PR over there for your review, @emkll, which I expect will smooth over the build process for the broader team.
2. The kernel version reported in the template is not 4.14.151-grsec, but rather 4.14.151-grsec-workstation (see screenshot above). That's not a problem, merely a consequence of freedomofpress/ansible-role-grsecurity-build@60d3fb9 . Still, worth mentioning, so we're all on the same page.

Since you clearly flagged the need to drop a test-only commit, I'll do that now, then mark with final approval.

[conorsch]

Confirmed successful local build. Dropped test-only commit prior to merging. Post-merge, we'll follow up with a signed tag.