cron-apt remove action should be after security

install_files/ansible-base/roles/common/tasks/cron_apt.yml

@@ -34,8 +34,8 @@
   # this logic for existing installs.
 - name: Configure cron-apt to remove vanilla kernels if they are installed.
   copy:
-    src: 1-remove
-    dest: /etc/cron-apt/action.d/1-remove
+    src: 9-remove
+    dest: /etc/cron-apt/action.d/9-remove
   tags:
     - apt
     - cron-apt

install_files/securedrop-config/DEBIAN/postinst

@@ -34,6 +34,11 @@ case "$1" in
     fi
     remove_2fa_tty_req
     disable_upgrade_prompt
+    # Remove cron-apt action should occur after security upgrades to avoid breaking
+    # automatic upgrades (see issue #4003)
+    if [ -f "/etc/cron-apt/action.d/1-remove" ]; then
+        rm /etc/cron-apt/action.d/1-remove
+    fi
     ;;
 
     abort-upgrade|abort-remove|abort-deconfigure)

molecule/testinfra/staging/common/test_cron_apt.py

@@ -76,7 +76,7 @@ def test_cron_apt_delete_vanilla_kernels(File):
     Ensure cron-apt removes generic linux image packages when installed.
     """
 
-    f = File('/etc/cron-apt/action.d/1-remove')
+    f = File('/etc/cron-apt/action.d/9-remove')
     assert f.is_file
     assert f.user == "root"
     assert oct(f.mode) == "0644"