Remove "sd-whonix" from salt, update and tests

Removes sd-whonix from salt code, but adding steps to remove remove
sd-whonix in perpetuity in the "sd-remove-unused-qubes". The rationale
is that this should be kept as long as possible, since it's possible
that some workstation may be "on the shelf" for some time, thus skipping
upadtes. By keeping its removal in the code, we can catch these
'straggler' machines and ensure proper removal.

(test on: openqa)

Author: deeplow

files/sdw-admin.py

@@ -215,7 +215,6 @@ def sync_appmenus():
 
     # These are the ones we show in prod VMs, so sync explicitly
     run_cmd(["qvm-sync-appmenus", "--regenerate-only", "sd-devices"])
-    run_cmd(["qvm-sync-appmenus", "--regenerate-only", "sd-whonix"])
     run_cmd(["qvm-sync-appmenus", "--regenerate-only", "sd-log"])
 
 

launcher/tests/test_updater.py

@@ -17,7 +17,6 @@
     "sd-viewer",
     "sd-gpg",
     "sd-proxy",
-    "sd-whonix",
     "sd-devices",
 ]
 

sdw_updater/Updater.py

@@ -51,7 +51,6 @@ def _get_current_vms():
         "sd-log": f"sd-small-{debian_version}-template",
         "sd-devices": f"sd-large-{debian_version}-template",
         "sd-proxy": f"sd-small-{debian_version}-template",
-        "sd-whonix": f"whonix-gateway-{whonix_version}",
         "sd-gpg": f"sd-small-{debian_version}-template",
     }
 

securedrop_salt/sd-remove-deprecated-qubes.sls

@@ -5,25 +5,25 @@
 # WARNING: only remove when complete reinstall is assumed (e.g. 1.0.0 release)
 # This is because the workstation may have been offline for a while
 # and skipped some salt updates.
-{% for untagged_qube in ["sd-retain-logvm"] %}
+{% for qube_name in ["sd-retain-logvm", "sd-whonix"] %}
 
-poweroff-before-removal-{{ untagged_qube }}:
+poweroff-before-removal-{{ qube_name }}:
   qvm.shutdown:
-    - name: {{ untagged_qube }}
+    - name: {{ qube_name }}
     - flags:
       - force
       - wait
     - onlyif:
-      - qvm-check --quiet {{ untagged_qube }}
+      - qvm-check --quiet {{ qube_name }}
     - order: last
 
-remove-{{ untagged_qube }}:
+remove-{{ qube_name }}:
   qvm.absent:
-    - name: {{ untagged_qube }}
+    - name: {{ qube_name }}
     - require:
-      - qvm: poweroff-before-removal-{{ untagged_qube }}
+      - qvm: poweroff-before-removal-{{ qube_name }}
     - onlyif:
-      - qvm-check --quiet {{ untagged_qube }}
+      - qvm-check --quiet {{ qube_name }}
     - order: last
 
 {% endfor %}

securedrop_salt/sd-whonix.sls

@@ -17,8 +17,7 @@ base:
     - securedrop_salt.sd-proxy
     - securedrop_salt.sd-viewer
     - securedrop_salt.sd-app
-    - securedrop_salt.sd-whonix
-    - securedrop_salt.sd-remove-deprecated-qubes
+    - securedrop_salt.sd-remove-unused-qubes
     - securedrop_salt.sd-remove-unused-templates
 
   sd-base-bookworm-template:

securedrop_salt/sd-workstation.top

@@ -10,7 +10,7 @@
 SD_TEMPLATE_LARGE = f"sd-large-{DEBIAN_VERSION}-template"
 SD_TEMPLATE_SMALL = f"sd-small-{DEBIAN_VERSION}-template"
 
-SD_VMS = ["sd-gpg", "sd-log", "sd-proxy", "sd-app", "sd-viewer", "sd-whonix", "sd-devices"]
+SD_VMS = ["sd-gpg", "sd-log", "sd-proxy", "sd-app", "sd-viewer", "sd-devices"]
 SD_DVM_TEMPLATES = ["sd-devices-dvm", "sd-proxy-dvm"]
 SD_TEMPLATES = [SD_TEMPLATE_BASE, SD_TEMPLATE_LARGE, SD_TEMPLATE_SMALL]
 SD_UNTAGGED_DEPRECATED_VMS = ["sd-retain-logvm"]

tests/base.py

@@ -58,7 +58,7 @@ def test_logs_are_flowing(qube):
     # TODO: test a sd-viewer based dispVM
     skip = [f"sd-base-{CURRENT_DEBIAN_VERSION}-template", "sd-viewer"]
     # VMs we expect logs will not go to
-    no_log_vms = ["sd-gpg", "sd-log", "sd-whonix"]
+    no_log_vms = ["sd-gpg", "sd-log"]
 
     # We first run the command in each VM, and then do a second loop to
     # look for the token in the log entry, so there's enough time for the