Drop dh-virtualenv from packaging process

dh-virtualenv is responsible for creating the virtualenv, installing
dependencies from requirements.txt, and then munging the virtualenv to
use the path that it will be installed to.

There are a number of issues with it however:
* largely unmaintained in Debian (missed focal)
* incompatible with debhelper compat 12
* cannot use --require-hashes
* hides deprecation warnings and error messages

It is now getting in the way of Rust packaging since we want to install
a wheel into the virtualenv, however it needs to happen before the
munging step, which dh-virtualenv doesn't really support.

Since we already want to get rid of it, let's just do it now.

Fixes #6538.

builder/Dockerfile

@@ -34,14 +34,6 @@ RUN apt-get -y update && apt-get upgrade -y && apt-get install -y \
         unzip \
         zlib1g-dev
 
-
-# Install dh-virtualenv from Jammy Ubuntu release because there's no focal package
-# https://github.com/spotify/dh-virtualenv/issues/298
-RUN echo "deb http://archive.ubuntu.com/ubuntu/ jammy universe main" > /etc/apt/sources.list.d/ubuntu-jammy.list
-COPY dh-virtualenv.pref /etc/apt/preferences.d/
-
-RUN apt-get update && apt-get install -y dh-virtualenv
-
 ENV RUST_VERSION 1.69.0
 ENV RUSTUP_VERSION 1.24.3
 ENV RUSTUP_INIT_SHA256 3dc5ef50861ee18657f9db2eeb7392f9c2a6c95c90ab41e45ab4ca71476b4338

securedrop/debian/control

@@ -2,7 +2,7 @@ Source: securedrop
 Section: web
 Priority: optional
 Maintainer: SecureDrop Team <[email protected]>
-Build-Depends: debhelper (>= 9), dh-python, python3-all, python3-setuptools, dh-systemd, dh-virtualenv
+Build-Depends: debhelper (>= 9), dh-python, python3-all, python3-setuptools, dh-systemd
 Homepage: https://securedrop.org
 Standards-Version: 4.5.1
 

securedrop/debian/rules

@@ -2,9 +2,10 @@
 include /usr/share/dpkg/pkg-info.mk
 
 DEB_DH_INSTALL_ARGS=-X .git
+PIP_ARGS=--verbose --no-deps --no-binary=:all: --no-cache-dir
 
 %:
-	dh $@ --with python-virtualenv --with systemd
+	dh $@ --with systemd --buildsystem=pybuild
 
 override_dh_gencontrol:
 	dh_gencontrol -- $(SUBSTVARS)
@@ -19,6 +20,22 @@ override_dh_installdeb:
 	echo "" > ${CURDIR}/debian/securedrop-config/DEBIAN/conffiles
 	echo "" > ${CURDIR}/debian/securedrop-keyring/DEBIAN/conffiles
 
+override_dh_auto_install:
+	# Set up virtualenv and install dependencies
+	/usr/bin/python3 -m venv ./debian/securedrop-app-code/opt/venvs/securedrop-app-code
+	./debian/securedrop-app-code/opt/venvs/securedrop-app-code/bin/pip install $(PIP_ARGS) \
+		setuptools-scm==6.0.1
+	./debian/securedrop-app-code/opt/venvs/securedrop-app-code/bin/pip install $(PIP_ARGS) \
+		pip==21.3
+	./debian/securedrop-app-code/opt/venvs/securedrop-app-code/bin/pip install $(PIP_ARGS) \
+		-r requirements/python3/requirements.txt
+	# Update paths to point to install destination
+	find ./debian/securedrop-app-code/ -type f -exec sed -i "s#$(shell pwd)/debian/securedrop-app-code##" {} \;
+	dh_auto_install $@
+
+override_dh_auto_test:
+	# Skip, we don't run tests at package build time
+
 override_dh_install:
 	# Build translations
 	bash ./debian/translations.sh
@@ -37,21 +54,6 @@ override_dh_strip_nondeterminism:
 	find ./debian/ -type f -name 'RECORD' -delete
 	dh_strip_nondeterminism $@
 
-override_dh_virtualenv:
-	cp requirements/python3/requirements.txt requirements.txt
-	dh_virtualenv \
-		--package=securedrop-app-code \
-		--python=/usr/bin/python3 \
-		--builtin-venv \
-		--preinstall setuptools-scm==6.0.1 \
-		--preinstall pip==21.3 \
-		--extra-pip-arg "--verbose" \
-		--extra-pip-arg "--no-deps" \
-		--extra-pip-arg "--no-binary=:all:" \
-		--extra-pip-arg "--no-cache-dir"
-	# Strip non-reproducible debugging information
-	dh_strip $@ --no-automatic-dbgsym
-
 override_dh_gencontrol:
 	dh_gencontrol -psecuredrop-ossec-agent -- "-v3.6.0+${DEB_VERSION}"
 	dh_gencontrol -psecuredrop-ossec-server -- "-v3.6.0+${DEB_VERSION}"