Adds check to prevent v2 installs on Focal instances

[zenmonkeykstop]

Status

Ready for review

Description of Changes

Fixes #5818.
Fixes #5687.

Adds a check in the install playbook to bug out early if v2 is enabled for a Focal install.

Testing

• prod (vms or h/w) with Xenial:
  • when v2 is enabled in sdconfig, install playbook runs normally, without V2 services were enabled via ./securedrop-admin sdconfig, but are not available on Focal. message being triggered
  • when v2 is not enabled in sdconfig, install playbook runs normally.
• prod (vms or h/w) with Focal
  • when v2 is enabled in sdconfig, install playbook stops early, with V2 services were enabled via ./securedrop-admin sdconfig, but are not available on Focal. message being triggered
  • when v2 is not enabled in sdconfig, install playbook runs normally.

Deployment

Deployed with workstation code update.

Checklist

If you made changes to the server application code:

• Linting (make lint) and tests (make test) pass in the development container

If you made non-trivial code changes:

• I have written a test plan and validated it for this PR

Choose one of the following:

• I have opened a PR in the docs repo for these changes, or will do so later
• I would appreciate help with the documentation
• These changes do not require documentation

[eloquence]

I've pushed a small commit, 0f3c413, to revise the deprecation warning. I went with "short and (hopefully) sweet" since the logic is pretty simple now - if you're on Ubuntu 20.04, you can't enable v2. As a side note, the integration test is super brittle about minor string variations, I think because it chokes on wherever securedrop-admin happens to insert a newline. If we want to tweak the string further, we may have to poke at making that logic a bit more tolerant.

I brought along a code comment which I wish had been there during my securedrop-admin adventures, hopefully uncontroversial.

[emkll]

Thanks @zenmonkeykstop for this, the logic seems sound, and is working correctly in both Xenial and Focal scenarios, after applying the diff in [1], without which reliable apt errors in Focal are observed on install:

TASK [install-fpf-repo : Install SecureDrop apt repo GPG signing key.] *********
changed: [app] => (item=fpf-signing-key.pub)
changed: [mon] => (item=fpf-signing-key.pub)

TASK [install-fpf-repo : Setup FPF apt repo.] **********************************
fatal: [app]: FAILED! => {"changed": false, "msg": "apt cache update failed"}
fatal: [mon]: FAILED! => {"changed": false, "msg": "apt cache update failed"}

Visual review of the securedrop-admin changes look good as well, so good to merge when CI passes

[1]:

diff --git a/install_files/ansible-base/roles/install-fpf-repo/defaults/main.yml b/install_files/ansible-base/roles/install-fpf-repo/defaults/main.yml
index d186993df..6354113fa 100644
--- a/install_files/ansible-base/roles/install-fpf-repo/defaults/main.yml
+++ b/install_files/ansible-base/roles/install-fpf-repo/defaults/main.yml
@@ -10,7 +10,7 @@
 #
 # For testing/QA, set this URL to another apt server. You must also update
 # the associated public key for the apt repo for testing/QA.
-apt_repo_url: https://apt.freedom.press
+apt_repo_url: https://apt-test.freedom.press
 
 # By default, install packages from the apt-repo, but under
 # staging hosts we'll prefer locally-built deb packages
@@ -20,7 +20,7 @@ install_local_packages: False
 # May be overridden in staging to install from a test/QA server,
 # the Release file for which will *not* be signed with the prod key.
 apt_repo_pubkey_files:
-  - fpf-signing-key.pub
+  - apt-test-signing-key.pub
 
 # Enabling support for xenial by default.
 apt_repo_target_distro: "{{ ansible_distribution_release }}"