Fix errors in Tails validation logic; bump Tails version req

[eloquence]

Status

Ready for review

Description of Changes

Fixes #5942

• The journalist auth file should always be present when ./securedrop-admin tailsconfig is run and is not logically tied to the SSH-over-Tor setting or the presence of SSH onion service secrets.

• The tor_v3_keys.json file is only required if SSH secrets are present and SSH-over-Tor is enabled

• We can no longer support the Tails 3 series, so it's appropriate to error out at this point when users attempt to use it

Testing

Estimated testing time: 30-60 minutes

On a physical or virtualized Admin Workstation with SSH-over-Tor enabled

1. Move app-journalist.auth_private, tor_v3_keys.json, app-ssh.auth_private and mon-ssh.auth_private from ~/Persistent/securedrop/install_files/ansible-base into a temporary location like ~/Persistent
2. On this branch, run ./securedrop-admin --force tailsconfig in /Persistent/securedrop
3. • Observe that it fails with an error noting that app-journalist.auth_private is missing. [Explanation: This file must always be present to access the web-based Journalist/Admin Interface.]
4. Copy app-journalist.auth_private into place
5. Repeat step 2
6. • Observe that the command completes successfully.
7. Copy app-ssh.auth_private and mon-ssh.auth_private into place
8. Repeat step 2
9. • Observe that it fails with an error noting that tor_v3_keys.json is missing [Explanation: This file contains the private key needed to authenticate against the SSH onion services.]
10. Edit ~/Persistent/securedrop/install_files/ansible-base/group_vars/all/site-specific and set enable_ssh_over_tor to false
11. Repeat step 2
12. • Observe that the command completes successfully. [Explanation: When SSH-over-Tor is disabled, we do not need to strictly confirm existence of the file.]
13. Undo your modification in step 10
14. Copy tor_v3_keys.json into place
15. • Observe that the command completes successfully

Deployment

Although folks really should not be using Tails 3 anymore, it likely will warrant a call-out in our release notes.

Checklist

• These changes do not require documentation

[codecov-commenter]

Codecov Report

Merging #5965 (0eafe02) into develop (bac4677) will not change coverage.
The diff coverage is n/a.

@@           Coverage Diff            @@
##           develop    #5965   +/-   ##
========================================
  Coverage    85.34%   85.34%           
========================================
  Files           53       53           
  Lines         3875     3875           
  Branches       480      480           
========================================
  Hits          3307     3307           
  Misses         456      456           
  Partials       112      112           

---

Continue to review full report at Codecov.

Legend - Click here to learn more
Δ = absolute <relative> (impact), ø = not affected, ? = missing data
Powered by Codecov. Last update bac4677...0eafe02. Read the comment docs.

[zenmonkeykstop]

On a physical or virtualized Admin Workstation with SSH-over-Tor enabled

1. Move app-journalist.auth_private, tor_v3_keys.json, app-ssh.auth_private and mon-ssh.auth_private from ~/Persistent/securedrop/install_files/ansible-base into a temporary location like ~/Persistent
2. On this branch, run ./securedrop-admin --force tailsconfig in /Persistent/securedrop
3. • Observe that it fails with an error noting that app-journalist.auth_private is missing. [Explanation: This file must always be present to access the web-based Journalist/Admin Interface.]
4. Copy app-journalist.auth_private into place
5. Repeat step 2
6. • Observe that the command completes successfully.
7. Copy app-ssh.auth_private and mon-ssh.auth_private into place
8. Repeat step 2
9. • Observe that it fails with an error noting that tor_v3_keys.json is missing [Explanation: This file contains the private key needed to authenticate against the SSH onion services.]
10. Edit ~/Persistent/securedrop/install_files/ansible-base/group_vars/all/site-specific and set enable_ssh_over_tor to false
11. Repeat step 2
12. • Observe that the command completes successfully. [Explanation: When SSH-over-Tor is disabled, we do not need to strictly confirm existence of the file.]
13. Undo your modification in step 10
14. Copy tor_v3_keys.json into place
15. • Observe that the command completes successfully

Test plan and changes LGTM