Noble migration script does not handle use of Ubuntu Mirrors

[nathandyer]

Description

When a SecureDrop user (most likely ones outside of the U.S.) have configured their servers for the local apt mirrors (such as ex. de.archive.ubuntu.com), the noble migration check script fails.

Steps to Reproduce

1. Enable an apt mirror on app or mon
2. Re-run sudo securedrop-noble-migration-check

Expected Behavior

The script reports no errors

Actual Behavior

The script reports an unexpected software source, with output similar to:

app securedrop-noble-migration-check[######]: apt ERROR: unexpected source: de.archive.ubuntu.com

Comments

We'll either need to add supported mirrors to the expected list here: https://github.com/freedomofpress/securedrop/blob/e33a910f3e60caf538dcc0202b0a088acc4e47be/noble-migration/src/bin/check.rs#L210C1-L214C3

Or, ideally, set up a system that allows for wildcards (i.e, *.ubuntu.com).

[legoktm]

This behavior is intentional, as we should be overriding the mirror used during installation. We're discussing whether there's a good reason to support manually selected mirrors.

Technically supporting *.archive.ubuntu.com in the check script should be straightforward.

[zenmonkeykstop]

Given time constraints, and the fact that this is technically a misconfiguration, I'd suggest WONTFIX (or at least WILLMITIGATEWITHDOCS) for this issue. The upgrade script itself overwrites the apt sources config, so customizations would be removed there anyway. Having admins get alerted and then update the focal sources.list as part of upgrade prep seems fine.

[legoktm]

Agreed.