Repository: freedomofpress/securedrop

Issue:
Consider merging the ossec repo into this one
I'm just going to quote a comment I made in a relevant PR that more or less explains the proposal I'm making and the reasoning behind it:

> @conorsch and I just talked for a minute, and I expressed concerns about the process of building the OSSEC packages via a separate repo being cumbersome. It also seems possible if not likely that a developer could forget to pull, rebuild, and re-copy-over new OSSEC packages as work happens in that repo. I proposed the possibility of merging that repo into this one. By merging the OSSEC repository into the SD repository, I see us gaining two things:

> 1. We could more fully realize the aspiration of this PR, which I see as being to automate the (re-)building and (re-)installation of local deb packages from the latest version of the source for use in the staging test VMs.

> 2. The OSSEC packages might get more love, since they'll be more visible.

---https://github.com/freedomofpress/securedrop/pull/1464#issuecomment-259299390


Discussion:

Resolving patch:
diff --git a/install_files/ansible-base/roles/build-ossec-deb-pkg/library/ossec_urls.py b/install_files/ansible-base/roles/build-ossec-deb-pkg/library/ossec_urls.py
new file mode 100644
--- /dev/null
+++ b/install_files/ansible-base/roles/build-ossec-deb-pkg/library/ossec_urls.py
@@ -0,0 +1,128 @@
+#!/usr/bin/env python
+DOCUMENTATION = '''
+---
+module: ossec_urls
+short_description: Gather facts for OSSEC download URLs
+description:
+  - Gather version, checksum, and URL info for OSSEC downloads
+author:
+    - Conor Schaefer (@conorsch)
+    - Freedom of the Press Foundation (@freedomofpress)
+requirements:
+    - requests
+options:
+  ossec_version:
+    description:
+      - version number of release to download
+    default: "2.8.2"
+    required: no
+notes:
+  - The OSSEC version to download is hardcoded to avoid surprises.
+    If you want a newer version than the current default, you should
+    pass the version in via I(ossec_version).
+'''
+EXAMPLES = '''
+- ossec_urls:
+    ossec_version: "2.8.2"
+'''
+
+from StringIO import StringIO
+from urlparse import urljoin
+import re
+
+HAS_REQUESTS = True
+try:
+    import requests
+except ImportError:
+    HAS_REQUESTS = False
+
+
+
+class OSSECURLs():
+
+    def __init__(self, ossec_version):
+        self.ossec_version = ossec_version
+
+        checksums = self.parse_checksums()
+
+        self.ansible_facts = dict(
+            ossec_version=self.ossec_version,
+            ossec_tarball_filename=self.ossec_tarball_filename,
+            ossec_tarball_url=self.ossec_tarball_url,
+            ossec_checksum_filename=self.ossec_checksum_filename,
+            ossec_checksum_url=self.ossec_checksum_url,
+            )
+
+        self.ansible_facts.update(checksums)
+
+    @property
+    def ossec_tarball_filename(self):
+        return "ossec-hids-{}.tar.gz".format(self.ossec_version)
+
+
+    @property
+    def ossec_tarball_url(self):
+        return "https://github.com/ossec/ossec-hids/archive/{}.tar.gz".format(
+                self.ossec_version)
+
+
+    @property
+    def ossec_checksum_url(self):
+        return "https://github.com/ossec/ossec-hids/releases/download/{}/{}".format(
+                self.ossec_version, self.ossec_checksum_filename)
+
+
+    @property
+    def ossec_checksum_filename(self):
+        return "{}-checksum.txt".format(self.ossec_tarball_filename)
+
+
+    def parse_checksums(self):
+        r = requests.get(self.ossec_checksum_url)
+        checksum_regex = re.compile(r'''
+                                    ^MD5\(
+                                    '''
+                                    +re.escape(self.ossec_tarball_filename)+
+                                    r'''\)=\s+(?P<ossec_md5_checksum>[0-9a-f]{32})\s+
+                                    SHA1\(
+                                    '''
+                                    +re.escape(self.ossec_tarball_filename)+
+                                    r'''\)=\s+(?P<ossec_sha1_checksum>[0-9a-f]{40})$
+                                    ''', re.VERBOSE | re.MULTILINE
+                                    )
+        checksum_list = r.content.rstrip()
+        results = re.match(checksum_regex, checksum_list).groupdict()
+        return results
+
+
+def main():
+    module = AnsibleModule(
+        argument_spec=dict(
+            ossec_version=dict(default="2.8.2" ),
+        ),
+        supports_check_mode=False
+    )
+    if not HAS_REQUESTS:
+      module.fail_json(msg='requests required for this module')
+
+    ossec_version = module.params['ossec_version']
+    try:
+        ossec_config = OSSECURLs(ossec_version=ossec_version)
+    except:
+        msg = ("Failed to find checksum information for OSSEC v{}."
+                "Ensure you have the proper release specified, "
+                "and check the download page to confirm: "
+                "http://www.ossec.net/?page_id=19".format(ossec_version))
+        module.fail_json(msg=msg)
+
+    results = ossec_config.ansible_facts
+
+    if results:
+        module.exit_json(changed=False, ansible_facts=results)
+    else:
+        msg = "Failed to fetch OSSEC URL facts."
+        module.fail_json(msg=msg)
+
+
+from ansible.module_utils.basic import *
+main()


Test patch:
diff --git a/testinfra/build/test_ossec_packages.py b/testinfra/build/test_ossec_packages.py
new file mode 100644
--- /dev/null
+++ b/testinfra/build/test_ossec_packages.py
@@ -0,0 +1,16 @@
+import pytest
+
+
+@pytest.mark.parametrize('apt_package', [
+  'inotify-tools',
+  'libssl-dev',
+  'make',
+  'tar',
+  'unzip',
+])
+def test_build_ossec_apt_dependencies(Package, apt_package):
+    """
+    Ensure that the apt dependencies required for building the OSSEC
+    source deb packages (not the metapackages) are installed.
+    """
+    assert Package(apt_package).is_installed
diff --git a/testinfra/build/test_securedrop_deb_package.py b/testinfra/build/test_securedrop_deb_package.py
--- a/testinfra/build/test_securedrop_deb_package.py
+++ b/testinfra/build/test_securedrop_deb_package.py
@@ -110,7 +110,12 @@ def test_deb_package_control_fields_homepage(File, Command, deb):
         securedrop_test_vars.securedrop_version))
     # The `--field` option will display all fields if none are specified.
     c = Command("dpkg-deb --field {}".format(deb_package.path))
-    assert "Homepage: https://securedrop.org" in c.stdout
+    # The OSSEC source packages will have a different homepage;
+    # all other packages should set securedrop.org as homepage.
+    if os.path.basename(deb_package.path).startswith('ossec-'):
+        assert "Homepage: http://ossec.net" in c.stdout
+    else:
+        assert "Homepage: https://securedrop.org" in c.stdout
 
 
 @pytest.mark.parametrize("deb", deb_packages)