prompt: We are currently solving the following issue within our repository. Here is the issue text:
  --- BEGIN ISSUE ---
  SecureDrop desktop shortcuts not displayed correctly on Tails 3.3   
  # Bug
  
  The desktop shortcuts for the SecureDrop Source and Journalist interfaces do not show the correct title and logo on Tail 3.3. Tails 3.3 introduces a fix for the `.desktop` file security issue. The fix requires `.desktop` files to have a `trusted` metadata parameter set before the `.desktop` file is parsed and displayed with a custom name and icon.
  
  The shortcuts are displayed with a name like `source.desktop` and requires a user to click "Trust and Launch" before the shortcut is displayed with the correct name and icon. Requiring users to click-through this warning could cause warning fatigue and result in unsafe user behavior.
  
  ## Steps to reproduce
  
  Click a SecureDrop .desktop shortcut on a Journalist Workstation running Tails 3.3. 
  
  ## Expected Behavior
  
  The SecureDrop .onion opens in Tor Browser.
  
  ## Actual Behavior
  
  The user receives a warning about an untrusted .desktop file.
  
  ## Comments
  
  The SecureDrop `tails-config` Ansible role should set the Nautilus `metadata::trusted` parameter for both the Source and Journalist .desktop files.
  
  
  --- END ISSUE ---
  
  Below are some code segments, each from a relevant file. One or more of these files may contain bugs.
  --- BEGIN FILES ---
  Path: `install_files/ansible-base/roles/tails-config/files/securedrop_init.py`
  Content:
  ```
  1 #!/usr/bin/python
  2 
  3 import os
  4 import sys
  5 import subprocess
  6 
  7 
  8 # check for root
  9 if os.geteuid() != 0:
  10     sys.exit('You need to run this as root')
  11 
  12 # paths
  13 path_torrc_additions = '/home/amnesia/Persistent/.securedrop/torrc_additions'
  14 path_torrc_backup = '/etc/tor/torrc.bak'
  15 path_torrc = '/etc/tor/torrc'
  16 
  17 # load torrc_additions
  18 if os.path.isfile(path_torrc_additions):
  19     torrc_additions = open(path_torrc_additions).read()
  20 else:
  21     sys.exit('Error opening {0} for reading'.format(path_torrc_additions))
  22 
  23 # load torrc
  24 if os.path.isfile(path_torrc_backup):
  25     torrc = open(path_torrc_backup).read()
  26 else:
  27     if os.path.isfile(path_torrc):
  28         torrc = open(path_torrc).read()
  29     else:
  30         sys.exit('Error opening {0} for reading'.format(path_torrc))
  31 
  32     # save a backup
  33     open(path_torrc_backup, 'w').write(torrc)
  34 
  35 # append the additions
  36 open(path_torrc, 'w').write(torrc + torrc_additions)
  37 
  38 # reload tor
  39 try:
  40     subprocess.check_call(['systemctl', 'reload', 'tor@default.service'])
  41 except subprocess.CalledProcessError:
  42     sys.exit('Error reloading Tor')
  43 
  44 # Turn off "automatic-decompression" in Nautilus to ensure the original
  45 # submission filename is restored (see
  46 # https://github.com/freedomofpress/securedrop/issues/1862#issuecomment-311519750).
  47 subprocess.call(['/usr/bin/dconf', 'write',
  48                  '/org/gnome/nautilus/preferences/automatic-decompression',
  49                  'false'])
  50 
  51 # notify the user
  52 subprocess.call(['tails-notify-user',
  53                  'SecureDrop successfully auto-configured!',
  54                  'You can now access the Journalist Interface.\nIf you are an admin, you can now SSH to the servers.'])
  55
  ```
  --- END FILES ---
  
  Please first localize the bug based on the issue statement, and then generate a patch according to the `git diff` format fenced by three backticks.
  
  Here is an example:
  
  ```diff
  diff --git a/examples/server_async.py b/examples/server_async.py
  --- a/examples/server_async.py
  +++ b/examples/server_async.py
  @@ -313,4 +313,4 @@
   
   
   if __name__ == "__main__":
  -    asyncio.run(run_async_server("."), debug=True)
  +    asyncio.run(run_async_server(), debug=True)
  diff --git a/examples/server_sync.py b/examples/server_sync.py
  --- a/examples/server_sync.py
  +++ b/examples/server_sync.py
  @@ -313,5 +313,5 @@
   
   
   if __name__ == "__main__":
  -    server = run_sync_server(".")
  +    server = run_sync_server()
       server.shutdown()
  
  ```
  
golden_diff: diff --git a/install_files/ansible-base/roles/tails-config/files/securedrop_init.py b/install_files/ansible-base/roles/tails-config/files/securedrop_init.py
  --- a/install_files/ansible-base/roles/tails-config/files/securedrop_init.py
  +++ b/install_files/ansible-base/roles/tails-config/files/securedrop_init.py
  @@ -1,6 +1,8 @@
   #!/usr/bin/python
   
  +import grp
   import os
  +import pwd
   import sys
   import subprocess
   
  @@ -13,6 +15,8 @@
   path_torrc_additions = '/home/amnesia/Persistent/.securedrop/torrc_additions'
   path_torrc_backup = '/etc/tor/torrc.bak'
   path_torrc = '/etc/tor/torrc'
  +path_desktop = '/home/amnesia/Desktop/'
  +path_persistent_desktop = '/lib/live/mount/persistence/TailsData_unlocked/dotfiles/Desktop/'
   
   # load torrc_additions
   if os.path.isfile(path_torrc_additions):
  @@ -48,7 +52,29 @@
                    '/org/gnome/nautilus/preferences/automatic-decompression',
                    'false'])
   
  -# notify the user
  +# Set journalist.desktop and source.desktop links as trusted with Nautilus (see
  +# https://github.com/freedomofpress/securedrop/issues/2586)
  +# set euid and env variables to amnesia user
  +amnesia_gid = grp.getgrnam('amnesia').gr_gid
  +amnesia_uid = pwd.getpwnam('amnesia').pw_uid
  +os.setresgid(amnesia_gid, amnesia_gid, -1)
  +os.setresuid(amnesia_uid, amnesia_uid, -1)
  +env = os.environ.copy()
  +env['XDG_RUNTIME_DIR'] = '/run/user/{}'.format(amnesia_uid)
  +env['XDG_DATA_DIR'] = '/usr/share/gnome:/usr/local/share/:/usr/share/'
  +env['HOME'] = '/home/amnesia'
  +env['LOGNAME'] = 'amnesia'
  +env['DBUS_SESSION_BUS_ADDRESS'] = 'unix:path=/run/user/{}/bus'.format(amnesia_uid)
  +
  +# remove existing shortcut, recreate symlink and change metadata attribute to trust .desktop
  +for shortcut in ['source.desktop', 'journalist.desktop']:
  +    subprocess.call(['rm', path_desktop + shortcut], env=env)
  +    subprocess.call(['ln', '-s', path_persistent_desktop + shortcut, path_desktop + shortcut], env=env)
  +    subprocess.call(['gio', 'set', path_desktop + shortcut, 'metadata::trusted', 'yes'], env=env)
  +
  +# reacquire uid0 and notify the user
  +os.setresuid(0,0,-1)
  +os.setresgid(0,0,-1)
   subprocess.call(['tails-notify-user',
                    'SecureDrop successfully auto-configured!',
                    'You can now access the Journalist Interface.\nIf you are an admin, you can now SSH to the servers.'])
  
verification_info: {"golden_diff": "diff --git a/install_files/ansible-base/roles/tails-config/files/securedrop_init.py b/install_files/ansible-base/roles/tails-config/files/securedrop_init.py\n--- a/install_files/ansible-base/roles/tails-config/files/securedrop_init.py\n+++ b/install_files/ansible-base/roles/tails-config/files/securedrop_init.py\n@@ -1,6 +1,8 @@\n #!/usr/bin/python\n \n+import grp\n import os\n+import pwd\n import sys\n import subprocess\n \n@@ -13,6 +15,8 @@\n path_torrc_additions = '/home/amnesia/Persistent/.securedrop/torrc_additions'\n path_torrc_backup = '/etc/tor/torrc.bak'\n path_torrc = '/etc/tor/torrc'\n+path_desktop = '/home/amnesia/Desktop/'\n+path_persistent_desktop = '/lib/live/mount/persistence/TailsData_unlocked/dotfiles/Desktop/'\n \n # load torrc_additions\n if os.path.isfile(path_torrc_additions):\n@@ -48,7 +52,29 @@\n                  '/org/gnome/nautilus/preferences/automatic-decompression',\n                  'false'])\n \n-# notify the user\n+# Set journalist.desktop and source.desktop links as trusted with Nautilus (see\n+# https://github.com/freedomofpress/securedrop/issues/2586)\n+# set euid and env variables to amnesia user\n+amnesia_gid = grp.getgrnam('amnesia').gr_gid\n+amnesia_uid = pwd.getpwnam('amnesia').pw_uid\n+os.setresgid(amnesia_gid, amnesia_gid, -1)\n+os.setresuid(amnesia_uid, amnesia_uid, -1)\n+env = os.environ.copy()\n+env['XDG_RUNTIME_DIR'] = '/run/user/{}'.format(amnesia_uid)\n+env['XDG_DATA_DIR'] = '/usr/share/gnome:/usr/local/share/:/usr/share/'\n+env['HOME'] = '/home/amnesia'\n+env['LOGNAME'] = 'amnesia'\n+env['DBUS_SESSION_BUS_ADDRESS'] = 'unix:path=/run/user/{}/bus'.format(amnesia_uid)\n+\n+# remove existing shortcut, recreate symlink and change metadata attribute to trust .desktop\n+for shortcut in ['source.desktop', 'journalist.desktop']:\n+    subprocess.call(['rm', path_desktop + shortcut], env=env)\n+    subprocess.call(['ln', '-s', path_persistent_desktop + shortcut, path_desktop + shortcut], env=env)\n+    subprocess.call(['gio', 'set', path_desktop + shortcut, 'metadata::trusted', 'yes'], env=env)\n+\n+# reacquire uid0 and notify the user\n+os.setresuid(0,0,-1)\n+os.setresgid(0,0,-1)\n subprocess.call(['tails-notify-user',\n                  'SecureDrop successfully auto-configured!',\n                  'You can now access the Journalist Interface.\\nIf you are an admin, you can now SSH to the servers.'])\n", "issue": "SecureDrop desktop shortcuts not displayed correctly on Tails 3.3   \n# Bug\r\n\r\nThe desktop shortcuts for the SecureDrop Source and Journalist interfaces do not show the correct title and logo on Tail 3.3. Tails 3.3 introduces a fix for the `.desktop` file security issue. The fix requires `.desktop` files to have a `trusted` metadata parameter set before the `.desktop` file is parsed and displayed with a custom name and icon.\r\n\r\nThe shortcuts are displayed with a name like `source.desktop` and requires a user to click \"Trust and Launch\" before the shortcut is displayed with the correct name and icon. Requiring users to click-through this warning could cause warning fatigue and result in unsafe user behavior.\r\n\r\n## Steps to reproduce\r\n\r\nClick a SecureDrop .desktop shortcut on a Journalist Workstation running Tails 3.3. \r\n\r\n## Expected Behavior\r\n\r\nThe SecureDrop .onion opens in Tor Browser.\r\n\r\n## Actual Behavior\r\n\r\nThe user receives a warning about an untrusted .desktop file.\r\n\r\n## Comments\r\n\r\nThe SecureDrop `tails-config` Ansible role should set the Nautilus `metadata::trusted` parameter for both the Source and Journalist .desktop files.\r\n\n", "before_files": [{"content": "#!/usr/bin/python\n\nimport os\nimport sys\nimport subprocess\n\n\n# check for root\nif os.geteuid() != 0:\n    sys.exit('You need to run this as root')\n\n# paths\npath_torrc_additions = '/home/amnesia/Persistent/.securedrop/torrc_additions'\npath_torrc_backup = '/etc/tor/torrc.bak'\npath_torrc = '/etc/tor/torrc'\n\n# load torrc_additions\nif os.path.isfile(path_torrc_additions):\n    torrc_additions = open(path_torrc_additions).read()\nelse:\n    sys.exit('Error opening {0} for reading'.format(path_torrc_additions))\n\n# load torrc\nif os.path.isfile(path_torrc_backup):\n    torrc = open(path_torrc_backup).read()\nelse:\n    if os.path.isfile(path_torrc):\n        torrc = open(path_torrc).read()\n    else:\n        sys.exit('Error opening {0} for reading'.format(path_torrc))\n\n    # save a backup\n    open(path_torrc_backup, 'w').write(torrc)\n\n# append the additions\nopen(path_torrc, 'w').write(torrc + torrc_additions)\n\n# reload tor\ntry:\n    subprocess.check_call(['systemctl', 'reload', 'tor@default.service'])\nexcept subprocess.CalledProcessError:\n    sys.exit('Error reloading Tor')\n\n# Turn off \"automatic-decompression\" in Nautilus to ensure the original\n# submission filename is restored (see\n# https://github.com/freedomofpress/securedrop/issues/1862#issuecomment-311519750).\nsubprocess.call(['/usr/bin/dconf', 'write',\n                 '/org/gnome/nautilus/preferences/automatic-decompression',\n                 'false'])\n\n# notify the user\nsubprocess.call(['tails-notify-user',\n                 'SecureDrop successfully auto-configured!',\n                 'You can now access the Journalist Interface.\\nIf you are an admin, you can now SSH to the servers.'])\n", "path": "install_files/ansible-base/roles/tails-config/files/securedrop_init.py"}], "after_files": [{"content": "#!/usr/bin/python\n\nimport grp\nimport os\nimport pwd\nimport sys\nimport subprocess\n\n\n# check for root\nif os.geteuid() != 0:\n    sys.exit('You need to run this as root')\n\n# paths\npath_torrc_additions = '/home/amnesia/Persistent/.securedrop/torrc_additions'\npath_torrc_backup = '/etc/tor/torrc.bak'\npath_torrc = '/etc/tor/torrc'\npath_desktop = '/home/amnesia/Desktop/'\npath_persistent_desktop = '/lib/live/mount/persistence/TailsData_unlocked/dotfiles/Desktop/'\n\n# load torrc_additions\nif os.path.isfile(path_torrc_additions):\n    torrc_additions = open(path_torrc_additions).read()\nelse:\n    sys.exit('Error opening {0} for reading'.format(path_torrc_additions))\n\n# load torrc\nif os.path.isfile(path_torrc_backup):\n    torrc = open(path_torrc_backup).read()\nelse:\n    if os.path.isfile(path_torrc):\n        torrc = open(path_torrc).read()\n    else:\n        sys.exit('Error opening {0} for reading'.format(path_torrc))\n\n    # save a backup\n    open(path_torrc_backup, 'w').write(torrc)\n\n# append the additions\nopen(path_torrc, 'w').write(torrc + torrc_additions)\n\n# reload tor\ntry:\n    subprocess.check_call(['systemctl', 'reload', 'tor@default.service'])\nexcept subprocess.CalledProcessError:\n    sys.exit('Error reloading Tor')\n\n# Turn off \"automatic-decompression\" in Nautilus to ensure the original\n# submission filename is restored (see\n# https://github.com/freedomofpress/securedrop/issues/1862#issuecomment-311519750).\nsubprocess.call(['/usr/bin/dconf', 'write',\n                 '/org/gnome/nautilus/preferences/automatic-decompression',\n                 'false'])\n\n# Set journalist.desktop and source.desktop links as trusted with Nautilus (see\n# https://github.com/freedomofpress/securedrop/issues/2586)\n# set euid and env variables to amnesia user\namnesia_gid = grp.getgrnam('amnesia').gr_gid\namnesia_uid = pwd.getpwnam('amnesia').pw_uid\nos.setresgid(amnesia_gid, amnesia_gid, -1)\nos.setresuid(amnesia_uid, amnesia_uid, -1)\nenv = os.environ.copy()\nenv['XDG_RUNTIME_DIR'] = '/run/user/{}'.format(amnesia_uid)\nenv['XDG_DATA_DIR'] = '/usr/share/gnome:/usr/local/share/:/usr/share/'\nenv['HOME'] = '/home/amnesia'\nenv['LOGNAME'] = 'amnesia'\nenv['DBUS_SESSION_BUS_ADDRESS'] = 'unix:path=/run/user/{}/bus'.format(amnesia_uid)\n\n# remove existing shortcut, recreate symlink and change metadata attribute to trust .desktop\nfor shortcut in ['source.desktop', 'journalist.desktop']:\n    subprocess.call(['rm', path_desktop + shortcut], env=env)\n    subprocess.call(['ln', '-s', path_persistent_desktop + shortcut, path_desktop + shortcut], env=env)\n    subprocess.call(['gio', 'set', path_desktop + shortcut, 'metadata::trusted', 'yes'], env=env)\n\n# reacquire uid0 and notify the user\nos.setresuid(0,0,-1)\nos.setresgid(0,0,-1)\nsubprocess.call(['tails-notify-user',\n                 'SecureDrop successfully auto-configured!',\n                 'You can now access the Journalist Interface.\\nIf you are an admin, you can now SSH to the servers.'])\n", "path": "install_files/ansible-base/roles/tails-config/files/securedrop_init.py"}]}