{"action":"closed","issue":{"url":"https://api.github.com/repos/freedomofpress/securedrop/issues/1308","repository_url":"https://api.github.com/repos/freedomofpress/securedrop","labels_url":"https://api.github.com/repos/freedomofpress/securedrop/issues/1308/labels{/name}","comments_url":"https://api.github.com/repos/freedomofpress/securedrop/issues/1308/comments","events_url":"https://api.github.com/repos/freedomofpress/securedrop/issues/1308/events","html_url":"https://github.com/freedomofpress/securedrop/issues/1308","id":156389603,"number":1308,"title":"Refactor install.sh script for Tails configuration","user":{"login":"conorsch","id":657862,"avatar_url":"https://avatars.githubusercontent.com/u/657862?v=3","gravatar_id":"","url":"https://api.github.com/users/conorsch","html_url":"https://github.com/conorsch","followers_url":"https://api.github.com/users/conorsch/followers","following_url":"https://api.github.com/users/conorsch/following{/other_user}","gists_url":"https://api.github.com/users/conorsch/gists{/gist_id}","starred_url":"https://api.github.com/users/conorsch/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/conorsch/subscriptions","organizations_url":"https://api.github.com/users/conorsch/orgs","repos_url":"https://api.github.com/users/conorsch/repos","events_url":"https://api.github.com/users/conorsch/events{/privacy}","received_events_url":"https://api.github.com/users/conorsch/received_events","type":"User","site_admin":false},"labels":[],"state":"closed","locked":false,"assignee":null,"milestone":{"url":"https://api.github.com/repos/freedomofpress/securedrop/milestones/12","html_url":"https://github.com/freedomofpress/securedrop/milestones/0.3.7","labels_url":"https://api.github.com/repos/freedomofpress/securedrop/milestones/12/labels","id":1746379,"number":12,"title":"0.3.7","description":"Point release to address some requests from SecureDrop administrators and upgrade various components on the SecureDrop architecture.\r\n\r\n* Improve backup and restore roles\r\n* Ensure SecureDrop-specific Tails configuration works on Tails 2.x\r\n * Document upgrading from Tails 1.x to Tails 2.x for current admins using 1.x\r\n* Upgrade SecureDrop's Python dependencies","creator":{"login":"garrettr","id":407302,"avatar_url":"https://avatars.githubusercontent.com/u/407302?v=3","gravatar_id":"","url":"https://api.github.com/users/garrettr","html_url":"https://github.com/garrettr","followers_url":"https://api.github.com/users/garrettr/followers","following_url":"https://api.github.com/users/garrettr/following{/other_user}","gists_url":"https://api.github.com/users/garrettr/gists{/gist_id}","starred_url":"https://api.github.com/users/garrettr/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/garrettr/subscriptions","organizations_url":"https://api.github.com/users/garrettr/orgs","repos_url":"https://api.github.com/users/garrettr/repos","events_url":"https://api.github.com/users/garrettr/events{/privacy}","received_events_url":"https://api.github.com/users/garrettr/received_events","type":"User","site_admin":false},"open_issues":8,"closed_issues":24,"state":"open","created_at":"2016-05-03T22:12:07Z","updated_at":"2016-06-03T01:17:51Z","due_on":"2016-05-20T07:00:00Z","closed_at":null},"comments":1,"created_at":"2016-05-23T23:36:32Z","updated_at":"2016-06-03T01:17:51Z","closed_at":"2016-06-03T01:17:51Z","body":"The `tails_files/install.sh` script is designed to be run after initial installation on both the Admin Workstation and the Journalist Workstation. The script handles configuring the ATHS values in the system torrc file so that the Document Interface is accessible, and for the Admin Workstation, the servers are reachable over SSH.\r\n\r\nThe strategy used to handle the ATHS configuration has changed over the past year or so, due to both upstream changes and less-than-durable implementations on our part, and the deprecated solutions must be cleaned up by subsequent versions of the script to provide a path for ensuring system state on the Admin and Journalist Workstations.\r\n\r\nPreviously we've considered `install.sh` to be a \"run-once\" script, that will handle initial configuration and that's it. Because we're preparing to clean up several legacy issues (e.g. #1285), we'll need to instruct Admins to run the script again—and therefore the script must be largely idempotent.\r\n\r\nThe following changes must be accommodated for in the script:\r\n\r\n* [x] #1182 \r\n* [x] #1198 \r\n* [x] #1206 \r\n* [x] #1277 \r\n* [x] #1285 \r\n* [x] #1287 \r\n* [x] #1292 \r\n\r\nIn so far it is as possible, the script on second-run should not prompt for information that's already determinable. For instance, rather than interactively prompting for ATHS info for the Document Interface on the Journalist Workstation, the script should inspect common locations for that information (e.g. `/etc/tor/torrc`) and reuse it if found.\r\n\r\nAs general cleanup, the following wish-list would greatly improve maintainability for the script:\r\n\r\n* [x] organize the disparate logic into small reusable functions\r\n* [x] avoid using all-caps var names at the global level, to avoid clobbering env vars\r\n* [x] use bracket-notation when interpolating vars in strings\r\n* [x] liberal comments throughout explaining rational of each piece\r\n\r\nLong-term, we need to rethink the use of Bash at all. In certain context of SecureDrop, we can leverage Ansible to help achieve idempotence, but that only works on the servers. For the workstations, a more durable solution than Bash is warranted.\r\n"}}
{"actor":{"display_login":"conorsch"}}