Have app-code depend on apparmor in noble

During a system upgrade, the securedrop-app-code postinst tries to
enable the apparmor profiles for apache2 and tor, except it uses newer
apparmor syntax, which can fail if apparmor hasn't already been
upgraded.

The easiest and correct way to ensure that securedrop-app-code is
upgraded after apparmor is by setting a versioned dependency. We need to
do a bit of makefile magic so it only applies to noble builds though,
and a test verifies that.

builder/tests/test_securedrop_deb_package.py

@@ -104,3 +104,22 @@ def test_app_code_paths_missing(securedrop_app_code_contents: str, path: str):
     for line in securedrop_app_code_contents.splitlines():
         if line.endswith(path):
             pytest.fail(f"found {line}")
+
+
+def test_apparmor_conditional():
+    try:
+        path = [pkg for pkg in DEB_PATHS if pkg.name.startswith("securedrop-app-code")][0]
+    except IndexError:
+        raise RuntimeError("Unable to find securedrop-app-code package in build/ folder")
+    info = subprocess.check_output(["dpkg", "--info", path]).decode()
+    found = False
+    for line in info.splitlines():
+        if line.startswith(" Depends:"):
+            found = True
+            if UBUNTU_VERSION == "focal":
+                assert "apparmor (>=" not in line, "focal has no versioned apparmor dependency"
+            else:
+                assert "apparmor (>=" in line, "noble has versioned apparmor dependency"
+
+    print(info)
+    assert found, "Depends: line wasn't found"

securedrop/debian/control

@@ -10,7 +10,7 @@ Package: securedrop-app-code
 Architecture: amd64
 Conflicts: libapache2-mod-wsgi, supervisor
 Replaces: libapache2-mod-wsgi, supervisor
-Depends: ${dist:Depends}, ${misc:Depends}, ${python3:Depends}, apache2, apparmor-utils, coreutils, gnupg2, libapache2-mod-xsendfile, paxctld, python3, redis-server, securedrop-config, securedrop-keyring, sqlite3
+Depends: ${dist:Depends}, ${misc:Depends}, ${python3:Depends}, ${apparmor:Depends}, apache2, apparmor-utils, coreutils, gnupg2, libapache2-mod-xsendfile, paxctld, python3, redis-server, securedrop-config, securedrop-keyring, sqlite3
 Description: SecureDrop application code, dependencies, Apache configuration, systemd services, and AppArmor profiles. This package will put the AppArmor profiles in enforce mode.
 
 Package: securedrop-config

securedrop/debian/rules

@@ -59,6 +59,11 @@ override_dh_strip_nondeterminism:
 	dh_strip_nondeterminism $@
 
 override_dh_gencontrol:
+ifneq ($(findstring +noble,$(DEB_VERSION)),)
+	dh_gencontrol -psecuredrop-app-code -- "-Vapparmor:Depends=apparmor (>= 4.0.1really4.0.1-0ubuntu0.24.04.3)"
+else
+	dh_gencontrol -psecuredrop-app-code -- "-Vapparmor:Depends="
+endif
 	dh_gencontrol -psecuredrop-ossec-agent -- "-v3.6.0+${DEB_VERSION}"
 	dh_gencontrol -psecuredrop-ossec-server -- "-v3.6.0+${DEB_VERSION}"
 	dh_gencontrol -psecuredrop-keyring -- "-v0.2.2+${DEB_VERSION}"