Updated logs playbook to clean up unencrypted tarballs

[zenmonkeykstop]

Status

Ready for review

Description of Changes

Fixes #4593

Updates securedrop-logs.yml to delete unencrypted tarballs from the servers and Admin Workstation.

Testing

On a VM or HW production instance, via the Admin Workstation:

• verify that ./securedrop-admin logs completes without error
• verify that the unencrypted tarballs do not exist in ~/Persistent/securedrop/install_files/ansible-base
• verify that the unencrypted tarballs do not exist in the server admin home directory for either the Application or Monitor Server.
• if you have access to the necessary key, verify that the encrypted tarballs can be decrypted.

Deployment

Deployed when workstation USBs are updated.

Checklist

If you made changes to securedrop-admin:

• Linting and tests (make -C admin test) pass in the admin development container

If you made non-trivial code changes:

• I have written a test plan and validated it for this PR

[codecov-io]

Codecov Report

Merging #4596 into develop will not change coverage.
The diff coverage is n/a.

@@           Coverage Diff            @@
##           develop    #4596   +/-   ##
========================================
  Coverage    82.63%   82.63%           
========================================
  Files           45       45           
  Lines         3116     3116           
  Branches       337      337           
========================================
  Hits          2575     2575           
  Misses         455      455           
  Partials        86       86

---

Continue to review full report at Codecov.

Legend - Click here to learn more
Δ = absolute <relative> (impact), ø = not affected, ? = missing data
Powered by Codecov. Last update d53ab5c...d51530e. Read the comment docs.

[kushaldas]

Everything else works, but I think it is encrypted with a different key.

$ gpg -d securedrop-logs-app-20190708T063445.tar.gz.gpg > sd-logs.tar.gz
gpg: encrypted with 4096-bit RSA key, ID EECE0DDC6DCB11EF, created 2015-03-16
      "Freedom of the Press Foundation <info@freedom.press>"

[zenmonkeykstop]

@kushaldas I didn't change the encryption key - it should be the one with fingerprint 734F6E707434ECA6C007E1AE82BD6C9616DABB79

[kushaldas]

@kushaldas I didn't change the encryption key - it should be the one with fingerprint 734F6E707434ECA6C007E1AE82BD6C9616DABB79

I think we found a bug, @conorsch according to my system that is not the support key, but, the other key we use. Can you please confirm? I was wrong, thank you @emkll.

[kushaldas]

• verify that ./securedrop-admin logs completes without error
• verify that the unencrypted tarballs do not exist in ~/Persistent/securedrop/install_files/ansible-base
• verify that the unencrypted tarballs do not exist in the server admin home directory for either the Application or Monitor Server.
• if you have access to the necessary key, verify that the encrypted tarballs can be decrypted.

Approved. 🌈