prompt: We are currently solving the following issue within our repository. Here is the issue text:
  --- BEGIN ISSUE ---
  spurious testinfra failures when servers have non-default hostnames
  ## Description
  
  If a production instance is configured with hostnames other than the recommended `app` and `mon`, `securedrop-admin verify` will report spurious testinfra failures.
  
  First noticed in <https://github.com/freedomofpress/securedrop/issues/6127#issuecomment-938342242>.
  
  ## Steps to Reproduce
  
  1. `securedrop-admin sdconfig` with non-default hostnames, e.g. those provisioned by `molecule create -s libvirt-prod-focal`:
      ```yaml
      app_hostname: app-prod
      monitor_hostname: mon-prod
      ```
  2. `securedrop-admin install`
  3. `securedrop-admin setup -t`
  4. `securedrop-admin verify`
  
  ## Expected Behavior
  
  All testinfra tests pass.
  
  ## Actual Behavior
  
  Hostname-dependent testinfra tests fail, including:
  
  * `app/test_ossec_agent.py::test_hosts_files`
  * `mon/test_ossec_server.py::test_ossec_connectivity`
  * `mon/test_ossec_server.py::test_hosts_files`
  * `mon/test_postfix.py::test_postfix_generic_maps`
  
  ## Comments
  
  _Originally posted by @zenmonkeykstop in <https://github.com/freedomofpress/securedrop/issues/6103#issuecomment-946018659>:_
  
  > testinfra tests take their expected values from a bunch of variables in a yaml file, with some of said values (like server IPs) in prod runs being overridden from the `install_files/ansible-base/group_vars/all/site-specific` file created by `./securedrop-admin sdconfig`. Looks like the server hostnames are *not* being overridden. So if they're not named according to the reccos in the docs I'd expect to see this error. Would be an easy fix to override them too methinks - check `molecule/testinfra/conftest.py`.
  
  https://github.com/freedomofpress/securedrop/blob/2882d1ea39175bd98c302000bb506e9b88a18a1f/molecule/testinfra/conftest.py#L49-L50
  
  --- END ISSUE ---
  
  Below are some code segments, each from a relevant file. One or more of these files may contain bugs.
  --- BEGIN FILES ---
  Path: `molecule/testinfra/conftest.py`
  Content:
  ```
  1 """
  2 Configuration for TestInfra test suite for SecureDrop.
  3 Handles importing host-specific test vars, so test functions
  4 can be reused across multiple hosts, with varied targets.
  5 
  6 Vars should be placed in `testinfra/vars/<hostname>.yml`.
  7 """
  8 
  9 import io
  10 import os
  11 import yaml
  12 from typing import Any, Dict
  13 
  14 import testutils
  15 
  16 
  17 # The config tests target staging by default.
  18 target_host = os.environ.get('SECUREDROP_TESTINFRA_TARGET_HOST', 'staging')
  19 
  20 
  21 def securedrop_import_testinfra_vars(hostname, with_header=False):
  22     """
  23     Import vars from a YAML file to populate tests with host-specific
  24     values used in checks. For instance, the SecureDrop docroot will
  25     be under /vagrant in development, but /var/www/securedrop in staging.
  26 
  27     Vars must be stored in `testinfra/vars/<hostname>.yml`.
  28     """
  29     filepath = os.path.join(os.path.dirname(__file__), "vars", hostname+".yml")
  30     with io.open(filepath, 'r') as f:
  31         hostvars = yaml.safe_load(f)
  32 
  33     hostvars['securedrop_venv_site_packages'] = hostvars["securedrop_venv_site_packages"].format("3.8")  # noqa: E501
  34     hostvars['python_version'] = "3.8"
  35     hostvars['apparmor_enforce_actual'] = hostvars['apparmor_enforce']['focal']
  36 
  37     # If the tests are run against a production environment, check local config
  38     # and override as necessary.
  39     prod_filepath = os.path.join(os.path.dirname(__file__),
  40                                  "../../install_files/ansible-base/group_vars/all/site-specific")
  41     if os.path.isfile(prod_filepath):
  42         with io.open(prod_filepath, 'r') as f:
  43             prodvars = yaml.safe_load(f)
  44 
  45         def _prod_override(vars_key, prod_key):
  46             if prod_key in prodvars:
  47                 hostvars[vars_key] = prodvars[prod_key]
  48 
  49         _prod_override('app_ip', 'app_ip')
  50         _prod_override('mon_ip', 'monitor_ip')
  51         _prod_override('sasl_domain', 'sasl_domain')
  52         _prod_override('sasl_username', 'sasl_username')
  53         _prod_override('sasl_password', 'sasl_password')
  54         _prod_override('daily_reboot_time', 'daily_reboot_time')
  55 
  56         # Check repo targeting, and update vars
  57         repo_filepath = os.path.join(os.path.dirname(__file__),
  58                                  "../../install_files/ansible-base/roles/install-fpf-repo/defaults/main.yml")  # noqa: E501
  59         if os.path.isfile(repo_filepath):
  60             with io.open(repo_filepath, 'r') as f:
  61                 repovars = yaml.safe_load(f)
  62                 if 'apt_repo_url' in repovars:
  63                     hostvars['fpf_apt_repo_url'] = repovars['apt_repo_url']
  64 
  65     if with_header:
  66         hostvars = dict(securedrop_test_vars=hostvars)
  67 
  68     return hostvars
  69 
  70 
  71 class TestVars(dict):
  72     managed_attrs = {}  # type: Dict[str, Any]
  73 
  74     def __init__(self, initial: Dict[str, Any]) -> None:
  75         self.securedrop_target_distribution = os.environ.get("SECUREDROP_TARGET_DISTRIBUTION")
  76         self.managed_attrs.update(initial)
  77 
  78     def __getattr__(self, name: str) -> Any:
  79         """
  80         If the requested attribute names a dict in managed_attrs and that
  81         contains a key with the name of the target distribution,
  82         e.g. "focal", return that. Otherwise return the entire item
  83         under the requested name.
  84         """
  85         try:
  86             attr = self.managed_attrs[name]
  87             if isinstance(attr, dict) and self.securedrop_target_distribution in attr:
  88                 return attr[self.securedrop_target_distribution]
  89             return attr
  90         except KeyError:
  91             raise AttributeError(name)
  92 
  93     def __str__(self) -> str:
  94         return str(self.managed_attrs)
  95 
  96 
  97 testutils.securedrop_test_vars = TestVars(securedrop_import_testinfra_vars(target_host))
  98
  ```
  --- END FILES ---
  
  Please first localize the bug based on the issue statement, and then generate a patch according to the `git diff` format fenced by three backticks.
  
  Here is an example:
  
  ```diff
  diff --git a/examples/server_async.py b/examples/server_async.py
  --- a/examples/server_async.py
  +++ b/examples/server_async.py
  @@ -313,4 +313,4 @@
   
   
   if __name__ == "__main__":
  -    asyncio.run(run_async_server("."), debug=True)
  +    asyncio.run(run_async_server(), debug=True)
  diff --git a/examples/server_sync.py b/examples/server_sync.py
  --- a/examples/server_sync.py
  +++ b/examples/server_sync.py
  @@ -313,5 +313,5 @@
   
   
   if __name__ == "__main__":
  -    server = run_sync_server(".")
  +    server = run_sync_server()
       server.shutdown()
  
  ```
  
golden_diff: diff --git a/molecule/testinfra/conftest.py b/molecule/testinfra/conftest.py
  --- a/molecule/testinfra/conftest.py
  +++ b/molecule/testinfra/conftest.py
  @@ -47,7 +47,9 @@
                   hostvars[vars_key] = prodvars[prod_key]
   
           _prod_override('app_ip', 'app_ip')
  +        _prod_override('app_hostname', 'app_hostname')
           _prod_override('mon_ip', 'monitor_ip')
  +        _prod_override('monitor_hostname', 'monitor_hostname')
           _prod_override('sasl_domain', 'sasl_domain')
           _prod_override('sasl_username', 'sasl_username')
           _prod_override('sasl_password', 'sasl_password')
  
verification_info: {"golden_diff": "diff --git a/molecule/testinfra/conftest.py b/molecule/testinfra/conftest.py\n--- a/molecule/testinfra/conftest.py\n+++ b/molecule/testinfra/conftest.py\n@@ -47,7 +47,9 @@\n                 hostvars[vars_key] = prodvars[prod_key]\n \n         _prod_override('app_ip', 'app_ip')\n+        _prod_override('app_hostname', 'app_hostname')\n         _prod_override('mon_ip', 'monitor_ip')\n+        _prod_override('monitor_hostname', 'monitor_hostname')\n         _prod_override('sasl_domain', 'sasl_domain')\n         _prod_override('sasl_username', 'sasl_username')\n         _prod_override('sasl_password', 'sasl_password')\n", "issue": "spurious testinfra failures when servers have non-default hostnames\n## Description\r\n\r\nIf a production instance is configured with hostnames other than the recommended `app` and `mon`, `securedrop-admin verify` will report spurious testinfra failures.\r\n\r\nFirst noticed in <https://github.com/freedomofpress/securedrop/issues/6127#issuecomment-938342242>.\r\n\r\n## Steps to Reproduce\r\n\r\n1. `securedrop-admin sdconfig` with non-default hostnames, e.g. those provisioned by `molecule create -s libvirt-prod-focal`:\r\n    ```yaml\r\n    app_hostname: app-prod\r\n    monitor_hostname: mon-prod\r\n    ```\r\n2. `securedrop-admin install`\r\n3. `securedrop-admin setup -t`\r\n4. `securedrop-admin verify`\r\n\r\n## Expected Behavior\r\n\r\nAll testinfra tests pass.\r\n\r\n## Actual Behavior\r\n\r\nHostname-dependent testinfra tests fail, including:\r\n\r\n* `app/test_ossec_agent.py::test_hosts_files`\r\n* `mon/test_ossec_server.py::test_ossec_connectivity`\r\n* `mon/test_ossec_server.py::test_hosts_files`\r\n* `mon/test_postfix.py::test_postfix_generic_maps`\r\n\r\n## Comments\r\n\r\n_Originally posted by @zenmonkeykstop in <https://github.com/freedomofpress/securedrop/issues/6103#issuecomment-946018659>:_\r\n\r\n> testinfra tests take their expected values from a bunch of variables in a yaml file, with some of said values (like server IPs) in prod runs being overridden from the `install_files/ansible-base/group_vars/all/site-specific` file created by `./securedrop-admin sdconfig`. Looks like the server hostnames are *not* being overridden. So if they're not named according to the reccos in the docs I'd expect to see this error. Would be an easy fix to override them too methinks - check `molecule/testinfra/conftest.py`.\r\n\r\nhttps://github.com/freedomofpress/securedrop/blob/2882d1ea39175bd98c302000bb506e9b88a18a1f/molecule/testinfra/conftest.py#L49-L50\n", "before_files": [{"content": "\"\"\"\nConfiguration for TestInfra test suite for SecureDrop.\nHandles importing host-specific test vars, so test functions\ncan be reused across multiple hosts, with varied targets.\n\nVars should be placed in `testinfra/vars/<hostname>.yml`.\n\"\"\"\n\nimport io\nimport os\nimport yaml\nfrom typing import Any, Dict\n\nimport testutils\n\n\n# The config tests target staging by default.\ntarget_host = os.environ.get('SECUREDROP_TESTINFRA_TARGET_HOST', 'staging')\n\n\ndef securedrop_import_testinfra_vars(hostname, with_header=False):\n    \"\"\"\n    Import vars from a YAML file to populate tests with host-specific\n    values used in checks. For instance, the SecureDrop docroot will\n    be under /vagrant in development, but /var/www/securedrop in staging.\n\n    Vars must be stored in `testinfra/vars/<hostname>.yml`.\n    \"\"\"\n    filepath = os.path.join(os.path.dirname(__file__), \"vars\", hostname+\".yml\")\n    with io.open(filepath, 'r') as f:\n        hostvars = yaml.safe_load(f)\n\n    hostvars['securedrop_venv_site_packages'] = hostvars[\"securedrop_venv_site_packages\"].format(\"3.8\")  # noqa: E501\n    hostvars['python_version'] = \"3.8\"\n    hostvars['apparmor_enforce_actual'] = hostvars['apparmor_enforce']['focal']\n\n    # If the tests are run against a production environment, check local config\n    # and override as necessary.\n    prod_filepath = os.path.join(os.path.dirname(__file__),\n                                 \"../../install_files/ansible-base/group_vars/all/site-specific\")\n    if os.path.isfile(prod_filepath):\n        with io.open(prod_filepath, 'r') as f:\n            prodvars = yaml.safe_load(f)\n\n        def _prod_override(vars_key, prod_key):\n            if prod_key in prodvars:\n                hostvars[vars_key] = prodvars[prod_key]\n\n        _prod_override('app_ip', 'app_ip')\n        _prod_override('mon_ip', 'monitor_ip')\n        _prod_override('sasl_domain', 'sasl_domain')\n        _prod_override('sasl_username', 'sasl_username')\n        _prod_override('sasl_password', 'sasl_password')\n        _prod_override('daily_reboot_time', 'daily_reboot_time')\n\n        # Check repo targeting, and update vars\n        repo_filepath = os.path.join(os.path.dirname(__file__),\n                                 \"../../install_files/ansible-base/roles/install-fpf-repo/defaults/main.yml\")  # noqa: E501\n        if os.path.isfile(repo_filepath):\n            with io.open(repo_filepath, 'r') as f:\n                repovars = yaml.safe_load(f)\n                if 'apt_repo_url' in repovars:\n                    hostvars['fpf_apt_repo_url'] = repovars['apt_repo_url']\n\n    if with_header:\n        hostvars = dict(securedrop_test_vars=hostvars)\n\n    return hostvars\n\n\nclass TestVars(dict):\n    managed_attrs = {}  # type: Dict[str, Any]\n\n    def __init__(self, initial: Dict[str, Any]) -> None:\n        self.securedrop_target_distribution = os.environ.get(\"SECUREDROP_TARGET_DISTRIBUTION\")\n        self.managed_attrs.update(initial)\n\n    def __getattr__(self, name: str) -> Any:\n        \"\"\"\n        If the requested attribute names a dict in managed_attrs and that\n        contains a key with the name of the target distribution,\n        e.g. \"focal\", return that. Otherwise return the entire item\n        under the requested name.\n        \"\"\"\n        try:\n            attr = self.managed_attrs[name]\n            if isinstance(attr, dict) and self.securedrop_target_distribution in attr:\n                return attr[self.securedrop_target_distribution]\n            return attr\n        except KeyError:\n            raise AttributeError(name)\n\n    def __str__(self) -> str:\n        return str(self.managed_attrs)\n\n\ntestutils.securedrop_test_vars = TestVars(securedrop_import_testinfra_vars(target_host))\n", "path": "molecule/testinfra/conftest.py"}], "after_files": [{"content": "\"\"\"\nConfiguration for TestInfra test suite for SecureDrop.\nHandles importing host-specific test vars, so test functions\ncan be reused across multiple hosts, with varied targets.\n\nVars should be placed in `testinfra/vars/<hostname>.yml`.\n\"\"\"\n\nimport io\nimport os\nimport yaml\nfrom typing import Any, Dict\n\nimport testutils\n\n\n# The config tests target staging by default.\ntarget_host = os.environ.get('SECUREDROP_TESTINFRA_TARGET_HOST', 'staging')\n\n\ndef securedrop_import_testinfra_vars(hostname, with_header=False):\n    \"\"\"\n    Import vars from a YAML file to populate tests with host-specific\n    values used in checks. For instance, the SecureDrop docroot will\n    be under /vagrant in development, but /var/www/securedrop in staging.\n\n    Vars must be stored in `testinfra/vars/<hostname>.yml`.\n    \"\"\"\n    filepath = os.path.join(os.path.dirname(__file__), \"vars\", hostname+\".yml\")\n    with io.open(filepath, 'r') as f:\n        hostvars = yaml.safe_load(f)\n\n    hostvars['securedrop_venv_site_packages'] = hostvars[\"securedrop_venv_site_packages\"].format(\"3.8\")  # noqa: E501\n    hostvars['python_version'] = \"3.8\"\n    hostvars['apparmor_enforce_actual'] = hostvars['apparmor_enforce']['focal']\n\n    # If the tests are run against a production environment, check local config\n    # and override as necessary.\n    prod_filepath = os.path.join(os.path.dirname(__file__),\n                                 \"../../install_files/ansible-base/group_vars/all/site-specific\")\n    if os.path.isfile(prod_filepath):\n        with io.open(prod_filepath, 'r') as f:\n            prodvars = yaml.safe_load(f)\n\n        def _prod_override(vars_key, prod_key):\n            if prod_key in prodvars:\n                hostvars[vars_key] = prodvars[prod_key]\n\n        _prod_override('app_ip', 'app_ip')\n        _prod_override('app_hostname', 'app_hostname')\n        _prod_override('mon_ip', 'monitor_ip')\n        _prod_override('monitor_hostname', 'monitor_hostname')\n        _prod_override('sasl_domain', 'sasl_domain')\n        _prod_override('sasl_username', 'sasl_username')\n        _prod_override('sasl_password', 'sasl_password')\n        _prod_override('daily_reboot_time', 'daily_reboot_time')\n\n        # Check repo targeting, and update vars\n        repo_filepath = os.path.join(os.path.dirname(__file__),\n                                 \"../../install_files/ansible-base/roles/install-fpf-repo/defaults/main.yml\")  # noqa: E501\n        if os.path.isfile(repo_filepath):\n            with io.open(repo_filepath, 'r') as f:\n                repovars = yaml.safe_load(f)\n                if 'apt_repo_url' in repovars:\n                    hostvars['fpf_apt_repo_url'] = repovars['apt_repo_url']\n\n    if with_header:\n        hostvars = dict(securedrop_test_vars=hostvars)\n\n    return hostvars\n\n\nclass TestVars(dict):\n    managed_attrs = {}  # type: Dict[str, Any]\n\n    def __init__(self, initial: Dict[str, Any]) -> None:\n        self.securedrop_target_distribution = os.environ.get(\"SECUREDROP_TARGET_DISTRIBUTION\")\n        self.managed_attrs.update(initial)\n\n    def __getattr__(self, name: str) -> Any:\n        \"\"\"\n        If the requested attribute names a dict in managed_attrs and that\n        contains a key with the name of the target distribution,\n        e.g. \"focal\", return that. Otherwise return the entire item\n        under the requested name.\n        \"\"\"\n        try:\n            attr = self.managed_attrs[name]\n            if isinstance(attr, dict) and self.securedrop_target_distribution in attr:\n                return attr[self.securedrop_target_distribution]\n            return attr\n        except KeyError:\n            raise AttributeError(name)\n\n    def __str__(self) -> str:\n        return str(self.managed_attrs)\n\n\ntestutils.securedrop_test_vars = TestVars(securedrop_import_testinfra_vars(target_host))\n", "path": "molecule/testinfra/conftest.py"}]}