Add a basic noble migration check script

[legoktm]

Status

Ready for review

Description of Changes

Perform a number of checks to ensure the system is ready for the noble migration. The results are written to a JSON file in /etc/ that other things like the JI and the upgrade script itself can read from.

The script is run hourly on a systemd timer but can also be run interactively for administrators who want slightly more details.

For ease of review, this is split into two commits: first set up all the configuration needed to ship Rust code in the securedrop-config package; and then second the actual check script, Rust dependencies, and systemd units.

Out of scope for this PR: OSSEC alerts, JI banner.

Refs #7322.

Testing

How should the reviewer test this PR?

• staging CI passes
• visual review

Deployment

Any special considerations for deployment? n/a

Checklist

• Configuration tests pass

[legoktm]

I'm still thinking of a few more checks to add, but I think this is ready for review + merge and other checks can be added incrementally.

[legoktm]

I plan to port this to Rust based on #7332 (comment).

[legoktm]

Now that this is in Rust, need to do a few more cargo vet reviews:

recommended audits for safe-to-deploy:
    Command                                     Publisher      Used By                            Audit Size
    cargo vet diff zerofrom-derive 0.1.3 0.1.4  robertbastian  zerofrom                           5 files changed, 49 insertions(+), 43 deletions(-)
    cargo vet diff idna 1.0.2 1.0.3             valenting      url and sequoia-openpgp            7 files changed, 207 insertions(+), 208 deletions(-)
    cargo vet diff url 2.5.1 2.5.3              valenting      noble-migration                    12 files changed, 386 insertions(+), 92 deletions(-)
    cargo vet inspect stable_deref_trait 1.2.0  Storyyeller    yoke and icu_provider              484 lines
    cargo vet inspect idna_adapter 1.2.0        hsivonen       idna                               612 lines
    cargo vet inspect smallvec 1.8.0            mbrubeck       idna, icu_normalizer, and 1 other  3879 lines
      NOTE: mozilla trusts Matt Brubeck (mbrubeck) - consider cargo vet trust smallvec mbrubeck

estimated audit backlog: 5960 lines

The main new dependency triggering reviews is url, which pulls in idna.

[legoktm]

In the end we only needed one audit for zerofrom-derive 0.1.3 -> 0.1.4 (done); I hadn't configured the new crate to use the safe-to-run standard. Went a bit out of the way to upgrade cargo-vet since a newer version was available.

[legoktm]

Marking this as ready for review, I went through and added a bunch of docs and tried to make the error handling a bit more robust and obvious. Staging CI will fail until the new kernels are on apt-test.

[legoktm]

On staging we get:

{'ssh': False, 'ufw': True, 'free_space': False, 'apt': True, 'systemd': True}

Free space is understandable, I'll have it ignore that one. I'm confused by ssh, that should've been resolved. Will add some debug code 🤔

[legoktm]

I had a bug in my getent output parser when I ported the logic from Python to Rust. I have paid penance by adding a unit/regression test.

[zenmonkeykstop]

added some comments. Haven't tested yet tho.

[zenmonkeykstop]

One thing to consider would be adding a "getting ready for Noble" page in the docs, that lists steps admins should take, and linking to that here as well/instead of the support link. Giving folks the tools to solve problems themselves drives down our support overhead and also helps admins who don't want to work with FPF for whatever reason.

(Just added freedomofpress/securedrop-docs#610)

[legoktm]

Absolutely.

[legoktm]

I will spend some time working on the documentation and agree that we should link it here, but don't think it should hold up review/approval of this since it'll be trivial to add in afterwards but before the release.

[legoktm]

Hm, and CI is failing now that I've removed the apt-test/apt-qa URLs... 🤔

[legoktm]

They just yanked the url crate, so rust-audit is failing. Let me upgrade it...

[zenmonkeykstop]

LGTM based on visual review and testing in staging.