Handle unapplied phased updates in testinfra checks

[legoktm]

Status

Ready for review

Description of Changes

noble now has phased updates, in which the package repository will have pending updates, but they won't be applied yet. We need to look for a different message on noble to handle this change.

Fixes #7419.

Testing

How should the reviewer test this PR?

• visual review
• noble staging job passes

Deployment

Any special considerations for deployment? n/a

Checklist

• Configuration tests pass

[legoktm]

The noble job passed, but I had forgotten to pull develop first so the focal one failed. Anyways, rebased and marked as ready for review.

[legoktm]

E + where 2 = CommandResult(command=b'dpkg -l deb.torproject.org-keyring', exit_status=2, stdout=None, stderr=b"dpkg-query: error: failed to open package info file '/var/lib/dpkg/updates/0000' for reading: No such file or directory\n").rc

that's a new flaky and unrelated failure. thankfully it happened in the focal job so it's irrelevant for this PR, but I'll retrigger it anyways.

[cfm]

This looks good, @legoktm, and CI is happy with it. However, I'm puzzled by the following result in local testing for my own edification:

user@sd:~$ docker run -it -e DEBIAN_FRONTEND=noninteractive ubuntu:noble bash -c "apt update && apt install unattended-upgrades --yes && unattended-upgrades --dry-run --debug" | tail -n 6
pkgs that look like they should be upgraded: 
Fetched 0 B in 0s (0 B/s)
fetch.run() result: 0
Packages blacklist due to conffile prompts: []
No packages found that can be upgraded unattended and no pending auto-removals
The list of kept packages can't be calculated in dry-run mode.

In other words, I'm running the command at —

securedrop/molecule/testinfra/common/test_automatic_updates.py

Line 149 in 5c5607b

c = host.run("sudo unattended-upgrades --dry-run --debug")

—explicitly under Noble, but I'm getting the Focal result at:

securedrop/molecule/testinfra/common/test_automatic_updates.py

Line 161 in 5c5607b

"No packages found that can be upgraded unattended and no pending auto-removals"

Is it worth refining the conditional you've added here? or are we happy with this working as expected in CI?

[legoktm]

I suspect it's because there are currently no phased updates that affect the Docker container, so we get the original all good message.

Let me adjust the logic to check for that message first, and then fallback to our new string if it's missing.

[cfm]

Thanks, @legoktm.