Disables haveged service in preinst, if unit file is present

[zenmonkeykstop]

Status

Ready for review

Description of Changes

Adds to fix for #6005 .

If haveged is present, stop/disable/mask the service - this is a compromise vs removing the package altogether.

Testing

• Make sure you're using libvirt-based VMs (upgrade scenario does not support Qubes env)
• molecule create -s libvirt-prod-focal
• Boot up admin workstation and install against those prod VMs with ./securedrop-admin install
• make build-debs on this branch on host (ok to run this in parallel with step 2 to save time)
• make upgrade-start on host, to set up local apt repo
• Back in admin workstation, run the playbook securedrop-apt-local.yml in the ansible-base directory (make sure to source the admin venv first, see docs), ansible-playbook --diff -vv ./securedrop-apt-local.yml
• ssh app and then sudo apt-get update && sudo unattended-upgrade -d
  • the unattended upgrade command completes successfully
  • apt-cache policy securedrop-app-code shows package is upgraded
  • systemctl status haveged shows haveged is stopped, disabled, and masked.

Deployment

Any special considerations for deployment? Consider both:

1. Upgrades: script change has been tested as above - in cases where haveged is present it should just be disabled
2. New installs: since havaged will not be installed on fresh SD installs from 2.0.0 on, the script won't do anything.

Checklist

If you made changes to the server application code:

If you made non-trivial code changes:

• I have written a test plan and validated it for this PR

Choose one of the following:

• I have opened a PR in the docs repo for these changes, or will do so later
• I would appreciate help with the documentation
• These changes do not require documentation

[rmol]

I had to test using my Qubes prod VMs, as I didn't have a virtualized admin environment on Debian. I started from 1.8.2, with haveged installed, enabled, and running, and set up a local apt repo instead of using the upgrade scenario's server. With that in place, unattended-upgrades completed the upgrade of securedrop-app-code, and the haveged service was disabled and masked according to plan.