Have CI run piuparts

piuparts tests package installation, upgrade and removal. We don't care
that much about the last one so it's just a warning for now.

For each package, piuparts will install the package CI just built and
ensure that goes smoothly, making sure all the dependencies are present
and the postinst works. Issues that were found are being fixed in the
next commit.

At a later stage, once the released packages are passing piuparts too,
we can have it automatically grab the latest package from
apt.freedom.press, install that, and then test the upgrade path to the
new CI-built packages.

This CI setup relies on running docker-in-docker, which is hacky but
seems to work. Unfortunately it doesn't work for the client (starts
apparmor), workstation-config (starts systemd) and workstation-viewer
(pulls in grsec kernel). In the future we can look at switching into a
chrooted setup that might fix the last two.

Getting this to work in GitHub Actions was inspired by
<https://github.com/evgeni/action-piuparts/> but I didn't really copy
any code.

Refs #1785.

.github/workflows/build.yml

@@ -36,7 +36,7 @@ jobs:
           PKG_DIR=../proxy make -C securedrop-builder requirements
           git config --global --add safe.directory "$GITHUB_WORKSPACE"
           git diff --ignore-matching-lines=# --exit-code
-          
+
 
   build-debs:
     strategy:
@@ -119,3 +119,39 @@ jobs:
             echo "Diffoscoping $deb"
             diffoscope build-${{ matrix.debian_version }}/$deb build2-${{ matrix.debian_version }}/$deb
           done;
+
+  piuparts:
+    strategy:
+      fail-fast: false
+      matrix:
+        # TODO: client sets up apparmor, which doesn't work in our CI setup
+        # TODO: workstation-config pulls in systemd, which doesn't work
+        # TODO: workstation-viewer pulls in grsec and qubes packages
+        package:
+          - export
+          - keyring
+          - log
+          - proxy
+        debian_version:
+          - bullseye
+          - bookworm
+    runs-on: ubuntu-latest
+    needs:
+      - build-debs
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/download-artifact@v4
+        with:
+          pattern: "build-${{ matrix.debian_version }}"
+      - name: Run piuparts
+        run: |
+          # We need to run it as docker-in-docker
+          docker run \
+            -v "/var/lib/docker:/var/lib/docker" \
+            -v "/var/run/docker.sock:/var/run/docker.sock" \
+            -v "/$(pwd)/keyring:/keyring" \
+            -v "/$(pwd)/build-${{ matrix.debian_version }}:/build" \
+            -v "/$(pwd)/.github/workflows/piuparts:/piuparts" \
+            -e DISTRO=${{ matrix.debian_version }} \
+            -e PACKAGE=${{ matrix.package }} \
+            debian:${{ matrix.debian_version }} bash /piuparts/run-piuparts.sh

.github/workflows/piuparts/Dockerfile

@@ -0,0 +1,9 @@
+ARG DISTRO=bullseye
+FROM debian:$DISTRO
+
+RUN apt-get update && apt-get upgrade --yes && apt-get install -y ca-certificates
+# FIXME: Do this to fool piuparts into thinking we didn't remove /opt during
+# the package purge. Why does purging our packages not work properly?
+RUN rm -rf /opt
+# CI manifest will copy keyring into the build directory
+COPY securedrop-keyring.gpg /usr/share/keyrings

.github/workflows/piuparts/run-piuparts.sh

@@ -0,0 +1,19 @@
+#!/bin/bash
+set -euxo pipefail
+# Runs inside the container
+apt-get update && apt-get install --yes piuparts docker.io
+
+cd /piuparts
+
+cp /keyring/securedrop-keyring.gpg .
+docker build . --build-arg DISTRO=$DISTRO -t ourimage
+
+# TODO: Our currently released packages don't install with piuparts, so we pass
+# --no-upgrade-test to avoid installing them and testing the upgrade path. Once
+# they do we can remove that line.
+piuparts --docker-image ourimage \
+    --distribution $DISTRO \
+    --extra-repo 'deb [signed-by=/usr/share/keyrings/securedrop-keyring.gpg] https://apt.freedom.press bullseye main' \
+    --warn-on-leftovers-after-purge \
+    --no-upgrade-test \
+    /build/securedrop-${PACKAGE}*.deb