We are currently solving the following issue within our repository. Here is the issue text:
--- BEGIN ISSUE ---
Tails NetworkManager hook still running under Python2
## Description
Despite the shebang line in the `securedrop_init.py` pointing to Python3, the script is still run via Python2 due to the calling script hardcoding `/usr/bin/python` in the NetworkManager hook:

https://github.com/freedomofpress/securedrop/blob/1d8484e3d42f63b9cec68be14e587175fa01adfc/install_files/ansible-base/roles/tails-config/files/65-configure-tor-for-securedrop.sh#L17

## Steps to Reproduce

Review diffs and relevant files above.

## Expected Behavior

All Tails 4 admin tooling is Python 3. 

## Actual Behavior
We're still calling the nm hook via Python 2. 

## Comments
The PR to resolve is simple, but we'll have to factor in the QA time to verify we haven't introduced side-effects.


--- END ISSUE ---

Below are some code segments, each from a relevant file. One or more of these files may contain bugs.
--- BEGIN FILES ---
Path: `install_files/ansible-base/roles/tails-config/files/securedrop_init.py`
Content:
```
1 #!/usr/bin/python3
2 
3 import grp
4 import os
5 import io
6 import pwd
7 import sys
8 import subprocess
9 
10 from shutil import copyfile
11 
12 
13 # check for root
14 if os.geteuid() != 0:
15     sys.exit('You need to run this as root')
16 
17 # paths
18 path_torrc_additions = '/home/amnesia/Persistent/.securedrop/torrc_additions'
19 path_torrc_backup = '/etc/tor/torrc.bak'
20 path_torrc = '/etc/tor/torrc'
21 path_desktop = '/home/amnesia/Desktop/'
22 path_persistent_desktop = '/lib/live/mount/persistence/TailsData_unlocked/dotfiles/Desktop/'  # noqa: E501
23 path_securedrop_root = '/home/amnesia/Persistent/securedrop'
24 path_securedrop_admin_venv = os.path.join(path_securedrop_root,
25                                           'admin/.venv3/bin/python')
26 path_securedrop_admin_init = os.path.join(path_securedrop_root,
27                                           'admin/securedrop_admin/__init__.py')
28 path_gui_updater = os.path.join(path_securedrop_root,
29                                 'journalist_gui/SecureDropUpdater')
30 
31 paths_v3_authfiles = {
32         "app-journalist": os.path.join(path_securedrop_root,
33                                        'install_files/ansible-base/app-journalist.auth_private'),
34         "app-ssh": os.path.join(path_securedrop_root,
35                                 'install_files/ansible-base/app-ssh.auth_private'),
36         "mon-ssh": os.path.join(path_securedrop_root,
37                                 'install_files/ansible-base/mon-ssh.auth_private')
38 }
39 path_onion_auth_dir = '/var/lib/tor/onion_auth'
40 
41 # load torrc_additions
42 if os.path.isfile(path_torrc_additions):
43     with io.open(path_torrc_additions) as f:
44         torrc_additions = f.read()
45 else:
46     sys.exit('Error opening {0} for reading'.format(path_torrc_additions))
47 
48 # load torrc
49 if os.path.isfile(path_torrc_backup):
50     with io.open(path_torrc_backup) as f:
51         torrc = f.read()
52 else:
53     if os.path.isfile(path_torrc):
54         with io.open(path_torrc) as f:
55             torrc = f.read()
56     else:
57         sys.exit('Error opening {0} for reading'.format(path_torrc))
58 
59     # save a backup
60     with io.open(path_torrc_backup, 'w') as f:
61         f.write(torrc)
62 
63 # append the additions
64 with io.open(path_torrc, 'w') as f:
65     f.write(torrc + torrc_additions)
66 
67 # check for v3 aths files
68 v3_authfiles_present = False
69 for f in paths_v3_authfiles.values():
70     if os.path.isfile(f):
71         v3_authfiles_present = True
72 
73 # if there are v3 authfiles, make dir and copy them into place
74 debian_tor_uid = pwd.getpwnam("debian-tor").pw_uid
75 debian_tor_gid = grp.getgrnam("debian-tor").gr_gid
76 
77 if not os.path.isdir(path_onion_auth_dir):
78     os.mkdir(path_onion_auth_dir)
79 
80 os.chmod(path_onion_auth_dir, 0o700)
81 os.chown(path_onion_auth_dir, debian_tor_uid, debian_tor_gid)
82 
83 for key, f in paths_v3_authfiles.items():
84     if os.path.isfile(f):
85         filename = os.path.basename(f)
86         new_f = os.path.join(path_onion_auth_dir, filename)
87         copyfile(f, new_f)
88         os.chmod(new_f, 0o400)
89         os.chown(new_f, debian_tor_uid, debian_tor_gid)
90 
91 # restart tor
92 try:
93     subprocess.check_call(['systemctl', 'restart', 'tor@default.service'])
94 except subprocess.CalledProcessError:
95     sys.exit('Error restarting Tor')
96 
97 # Turn off "automatic-decompression" in Nautilus to ensure the original
98 # submission filename is restored (see
99 # https://github.com/freedomofpress/securedrop/issues/1862#issuecomment-311519750).
100 subprocess.call(['/usr/bin/dconf', 'write',
101                  '/org/gnome/nautilus/preferences/automatic-decompression',
102                  'false'])
103 
104 # Set journalist.desktop and source.desktop links as trusted with Nautilus (see
105 # https://github.com/freedomofpress/securedrop/issues/2586)
106 # set euid and env variables to amnesia user
107 amnesia_gid = grp.getgrnam('amnesia').gr_gid
108 amnesia_uid = pwd.getpwnam('amnesia').pw_uid
109 os.setresgid(amnesia_gid, amnesia_gid, -1)
110 os.setresuid(amnesia_uid, amnesia_uid, -1)
111 env = os.environ.copy()
112 env['XDG_CURRENT_DESKTOP'] = 'GNOME'
113 env['DESKTOP_SESSION'] = 'default'
114 env['DISPLAY'] = ':1'
115 env['XDG_RUNTIME_DIR'] = '/run/user/{}'.format(amnesia_uid)
116 env['XDG_DATA_DIR'] = '/usr/share/gnome:/usr/local/share/:/usr/share/'
117 env['HOME'] = '/home/amnesia'
118 env['LOGNAME'] = 'amnesia'
119 env['DBUS_SESSION_BUS_ADDRESS'] = 'unix:path=/run/user/{}/bus'.format(
120         amnesia_uid)
121 
122 # remove existing shortcut, recreate symlink and change metadata attribute
123 # to trust .desktop
124 for shortcut in ['source.desktop', 'journalist.desktop']:
125     subprocess.call(['rm', path_desktop + shortcut], env=env)
126     subprocess.call(['ln', '-s', path_persistent_desktop + shortcut,
127                      path_desktop + shortcut], env=env)
128     subprocess.call(['gio', 'set', path_desktop + shortcut,
129                      'metadata::trusted', 'true'], env=env)
130 
131 # in Tails 4, reload gnome-shell desktop icons extension to update with changes above
132 cmd = ["lsb_release", "--id", "--short"]
133 p = subprocess.check_output(cmd)
134 distro_id = p.rstrip()
135 if distro_id == 'Debian' and os.uname()[1] == 'amnesia':
136     subprocess.call(['gnome-shell-extension-tool', '-r', 'desktop-icons@csoriano'], env=env)
137 
138 # reacquire uid0 and notify the user
139 os.setresuid(0, 0, -1)
140 os.setresgid(0, 0, -1)
141 subprocess.call(['tails-notify-user',
142                  'SecureDrop successfully auto-configured!',
143                  'You can now access the Journalist Interface.\n',
144                  'If you are an admin, you can now SSH to the servers.'])
145 
146 # As the amnesia user, check for SecureDrop workstation updates.
147 os.setresgid(amnesia_gid, amnesia_gid, -1)
148 os.setresuid(amnesia_uid, amnesia_uid, -1)
149 output = subprocess.check_output([path_securedrop_admin_venv,
150                                   path_securedrop_admin_init,
151                                   '--root', path_securedrop_root,
152                                   'check_for_updates'], env=env)
153 
154 flag_location = "/home/amnesia/Persistent/.securedrop/securedrop_update.flag"
155 if 'Update needed' in output or os.path.exists(flag_location):
156     # Start the SecureDrop updater GUI.
157     subprocess.Popen(['python3', path_gui_updater], env=env)
158
```
--- END FILES ---

Please first localize the bug based on the issue statement, and then generate a patch according to the `git diff` format fenced by three backticks.

Here is an example:

```diff
diff --git a/examples/server_async.py b/examples/server_async.py
--- a/examples/server_async.py
+++ b/examples/server_async.py
@@ -313,4 +313,4 @@
 
 
 if __name__ == "__main__":
-    asyncio.run(run_async_server("."), debug=True)
+    asyncio.run(run_async_server(), debug=True)
diff --git a/examples/server_sync.py b/examples/server_sync.py
--- a/examples/server_sync.py
+++ b/examples/server_sync.py
@@ -313,5 +313,5 @@
 
 
 if __name__ == "__main__":
-    server = run_sync_server(".")
+    server = run_sync_server()
     server.shutdown()

```

diff --git a/install_files/ansible-base/roles/tails-config/files/securedrop_init.py b/install_files/ansible-base/roles/tails-config/files/securedrop_init.py
--- a/install_files/ansible-base/roles/tails-config/files/securedrop_init.py
+++ b/install_files/ansible-base/roles/tails-config/files/securedrop_init.py
@@ -138,10 +138,10 @@
 # reacquire uid0 and notify the user
 os.setresuid(0, 0, -1)
 os.setresgid(0, 0, -1)
+success_message = 'You can now access the Journalist Interface.\nIf you are an admin, you can now SSH to the servers.'  # noqa: E501
 subprocess.call(['tails-notify-user',
                  'SecureDrop successfully auto-configured!',
-                 'You can now access the Journalist Interface.\n',
-                 'If you are an admin, you can now SSH to the servers.'])
+                 success_message])
 
 # As the amnesia user, check for SecureDrop workstation updates.
 os.setresgid(amnesia_gid, amnesia_gid, -1)
@@ -152,6 +152,6 @@
                                   'check_for_updates'], env=env)
 
 flag_location = "/home/amnesia/Persistent/.securedrop/securedrop_update.flag"
-if 'Update needed' in output or os.path.exists(flag_location):
+if b'Update needed' in output or os.path.exists(flag_location):
     # Start the SecureDrop updater GUI.
     subprocess.Popen(['python3', path_gui_updater], env=env)

{"golden_diff": "diff --git a/install_files/ansible-base/roles/tails-config/files/securedrop_init.py b/install_files/ansible-base/roles/tails-config/files/securedrop_init.py\n--- a/install_files/ansible-base/roles/tails-config/files/securedrop_init.py\n+++ b/install_files/ansible-base/roles/tails-config/files/securedrop_init.py\n@@ -138,10 +138,10 @@\n # reacquire uid0 and notify the user\n os.setresuid(0, 0, -1)\n os.setresgid(0, 0, -1)\n+success_message = 'You can now access the Journalist Interface.\\nIf you are an admin, you can now SSH to the servers.'  # noqa: E501\n subprocess.call(['tails-notify-user',\n                  'SecureDrop successfully auto-configured!',\n-                 'You can now access the Journalist Interface.\\n',\n-                 'If you are an admin, you can now SSH to the servers.'])\n+                 success_message])\n \n # As the amnesia user, check for SecureDrop workstation updates.\n os.setresgid(amnesia_gid, amnesia_gid, -1)\n@@ -152,6 +152,6 @@\n                                   'check_for_updates'], env=env)\n \n flag_location = \"/home/amnesia/Persistent/.securedrop/securedrop_update.flag\"\n-if 'Update needed' in output or os.path.exists(flag_location):\n+if b'Update needed' in output or os.path.exists(flag_location):\n     # Start the SecureDrop updater GUI.\n     subprocess.Popen(['python3', path_gui_updater], env=env)\n", "issue": "Tails NetworkManager hook still running under Python2\n## Description\r\nDespite the shebang line in the `securedrop_init.py` pointing to Python3, the script is still run via Python2 due to the calling script hardcoding `/usr/bin/python` in the NetworkManager hook:\r\n\r\nhttps://github.com/freedomofpress/securedrop/blob/1d8484e3d42f63b9cec68be14e587175fa01adfc/install_files/ansible-base/roles/tails-config/files/65-configure-tor-for-securedrop.sh#L17\r\n\r\n## Steps to Reproduce\r\n\r\nReview diffs and relevant files above.\r\n\r\n## Expected Behavior\r\n\r\nAll Tails 4 admin tooling is Python 3. \r\n\r\n## Actual Behavior\r\nWe're still calling the nm hook via Python 2. \r\n\r\n## Comments\r\nThe PR to resolve is simple, but we'll have to factor in the QA time to verify we haven't introduced side-effects.\r\n\n", "before_files": [{"content": "#!/usr/bin/python3\n\nimport grp\nimport os\nimport io\nimport pwd\nimport sys\nimport subprocess\n\nfrom shutil import copyfile\n\n\n# check for root\nif os.geteuid() != 0:\n    sys.exit('You need to run this as root')\n\n# paths\npath_torrc_additions = '/home/amnesia/Persistent/.securedrop/torrc_additions'\npath_torrc_backup = '/etc/tor/torrc.bak'\npath_torrc = '/etc/tor/torrc'\npath_desktop = '/home/amnesia/Desktop/'\npath_persistent_desktop = '/lib/live/mount/persistence/TailsData_unlocked/dotfiles/Desktop/'  # noqa: E501\npath_securedrop_root = '/home/amnesia/Persistent/securedrop'\npath_securedrop_admin_venv = os.path.join(path_securedrop_root,\n                                          'admin/.venv3/bin/python')\npath_securedrop_admin_init = os.path.join(path_securedrop_root,\n                                          'admin/securedrop_admin/__init__.py')\npath_gui_updater = os.path.join(path_securedrop_root,\n                                'journalist_gui/SecureDropUpdater')\n\npaths_v3_authfiles = {\n        \"app-journalist\": os.path.join(path_securedrop_root,\n                                       'install_files/ansible-base/app-journalist.auth_private'),\n        \"app-ssh\": os.path.join(path_securedrop_root,\n                                'install_files/ansible-base/app-ssh.auth_private'),\n        \"mon-ssh\": os.path.join(path_securedrop_root,\n                                'install_files/ansible-base/mon-ssh.auth_private')\n}\npath_onion_auth_dir = '/var/lib/tor/onion_auth'\n\n# load torrc_additions\nif os.path.isfile(path_torrc_additions):\n    with io.open(path_torrc_additions) as f:\n        torrc_additions = f.read()\nelse:\n    sys.exit('Error opening {0} for reading'.format(path_torrc_additions))\n\n# load torrc\nif os.path.isfile(path_torrc_backup):\n    with io.open(path_torrc_backup) as f:\n        torrc = f.read()\nelse:\n    if os.path.isfile(path_torrc):\n        with io.open(path_torrc) as f:\n            torrc = f.read()\n    else:\n        sys.exit('Error opening {0} for reading'.format(path_torrc))\n\n    # save a backup\n    with io.open(path_torrc_backup, 'w') as f:\n        f.write(torrc)\n\n# append the additions\nwith io.open(path_torrc, 'w') as f:\n    f.write(torrc + torrc_additions)\n\n# check for v3 aths files\nv3_authfiles_present = False\nfor f in paths_v3_authfiles.values():\n    if os.path.isfile(f):\n        v3_authfiles_present = True\n\n# if there are v3 authfiles, make dir and copy them into place\ndebian_tor_uid = pwd.getpwnam(\"debian-tor\").pw_uid\ndebian_tor_gid = grp.getgrnam(\"debian-tor\").gr_gid\n\nif not os.path.isdir(path_onion_auth_dir):\n    os.mkdir(path_onion_auth_dir)\n\nos.chmod(path_onion_auth_dir, 0o700)\nos.chown(path_onion_auth_dir, debian_tor_uid, debian_tor_gid)\n\nfor key, f in paths_v3_authfiles.items():\n    if os.path.isfile(f):\n        filename = os.path.basename(f)\n        new_f = os.path.join(path_onion_auth_dir, filename)\n        copyfile(f, new_f)\n        os.chmod(new_f, 0o400)\n        os.chown(new_f, debian_tor_uid, debian_tor_gid)\n\n# restart tor\ntry:\n    subprocess.check_call(['systemctl', 'restart', 'tor@default.service'])\nexcept subprocess.CalledProcessError:\n    sys.exit('Error restarting Tor')\n\n# Turn off \"automatic-decompression\" in Nautilus to ensure the original\n# submission filename is restored (see\n# https://github.com/freedomofpress/securedrop/issues/1862#issuecomment-311519750).\nsubprocess.call(['/usr/bin/dconf', 'write',\n                 '/org/gnome/nautilus/preferences/automatic-decompression',\n                 'false'])\n\n# Set journalist.desktop and source.desktop links as trusted with Nautilus (see\n# https://github.com/freedomofpress/securedrop/issues/2586)\n# set euid and env variables to amnesia user\namnesia_gid = grp.getgrnam('amnesia').gr_gid\namnesia_uid = pwd.getpwnam('amnesia').pw_uid\nos.setresgid(amnesia_gid, amnesia_gid, -1)\nos.setresuid(amnesia_uid, amnesia_uid, -1)\nenv = os.environ.copy()\nenv['XDG_CURRENT_DESKTOP'] = 'GNOME'\nenv['DESKTOP_SESSION'] = 'default'\nenv['DISPLAY'] = ':1'\nenv['XDG_RUNTIME_DIR'] = '/run/user/{}'.format(amnesia_uid)\nenv['XDG_DATA_DIR'] = '/usr/share/gnome:/usr/local/share/:/usr/share/'\nenv['HOME'] = '/home/amnesia'\nenv['LOGNAME'] = 'amnesia'\nenv['DBUS_SESSION_BUS_ADDRESS'] = 'unix:path=/run/user/{}/bus'.format(\n        amnesia_uid)\n\n# remove existing shortcut, recreate symlink and change metadata attribute\n# to trust .desktop\nfor shortcut in ['source.desktop', 'journalist.desktop']:\n    subprocess.call(['rm', path_desktop + shortcut], env=env)\n    subprocess.call(['ln', '-s', path_persistent_desktop + shortcut,\n                     path_desktop + shortcut], env=env)\n    subprocess.call(['gio', 'set', path_desktop + shortcut,\n                     'metadata::trusted', 'true'], env=env)\n\n# in Tails 4, reload gnome-shell desktop icons extension to update with changes above\ncmd = [\"lsb_release\", \"--id\", \"--short\"]\np = subprocess.check_output(cmd)\ndistro_id = p.rstrip()\nif distro_id == 'Debian' and os.uname()[1] == 'amnesia':\n    subprocess.call(['gnome-shell-extension-tool', '-r', 'desktop-icons@csoriano'], env=env)\n\n# reacquire uid0 and notify the user\nos.setresuid(0, 0, -1)\nos.setresgid(0, 0, -1)\nsubprocess.call(['tails-notify-user',\n                 'SecureDrop successfully auto-configured!',\n                 'You can now access the Journalist Interface.\\n',\n                 'If you are an admin, you can now SSH to the servers.'])\n\n# As the amnesia user, check for SecureDrop workstation updates.\nos.setresgid(amnesia_gid, amnesia_gid, -1)\nos.setresuid(amnesia_uid, amnesia_uid, -1)\noutput = subprocess.check_output([path_securedrop_admin_venv,\n                                  path_securedrop_admin_init,\n                                  '--root', path_securedrop_root,\n                                  'check_for_updates'], env=env)\n\nflag_location = \"/home/amnesia/Persistent/.securedrop/securedrop_update.flag\"\nif 'Update needed' in output or os.path.exists(flag_location):\n    # Start the SecureDrop updater GUI.\n    subprocess.Popen(['python3', path_gui_updater], env=env)\n", "path": "install_files/ansible-base/roles/tails-config/files/securedrop_init.py"}], "after_files": [{"content": "#!/usr/bin/python3\n\nimport grp\nimport os\nimport io\nimport pwd\nimport sys\nimport subprocess\n\nfrom shutil import copyfile\n\n\n# check for root\nif os.geteuid() != 0:\n    sys.exit('You need to run this as root')\n\n# paths\npath_torrc_additions = '/home/amnesia/Persistent/.securedrop/torrc_additions'\npath_torrc_backup = '/etc/tor/torrc.bak'\npath_torrc = '/etc/tor/torrc'\npath_desktop = '/home/amnesia/Desktop/'\npath_persistent_desktop = '/lib/live/mount/persistence/TailsData_unlocked/dotfiles/Desktop/'  # noqa: E501\npath_securedrop_root = '/home/amnesia/Persistent/securedrop'\npath_securedrop_admin_venv = os.path.join(path_securedrop_root,\n                                          'admin/.venv3/bin/python')\npath_securedrop_admin_init = os.path.join(path_securedrop_root,\n                                          'admin/securedrop_admin/__init__.py')\npath_gui_updater = os.path.join(path_securedrop_root,\n                                'journalist_gui/SecureDropUpdater')\n\npaths_v3_authfiles = {\n        \"app-journalist\": os.path.join(path_securedrop_root,\n                                       'install_files/ansible-base/app-journalist.auth_private'),\n        \"app-ssh\": os.path.join(path_securedrop_root,\n                                'install_files/ansible-base/app-ssh.auth_private'),\n        \"mon-ssh\": os.path.join(path_securedrop_root,\n                                'install_files/ansible-base/mon-ssh.auth_private')\n}\npath_onion_auth_dir = '/var/lib/tor/onion_auth'\n\n# load torrc_additions\nif os.path.isfile(path_torrc_additions):\n    with io.open(path_torrc_additions) as f:\n        torrc_additions = f.read()\nelse:\n    sys.exit('Error opening {0} for reading'.format(path_torrc_additions))\n\n# load torrc\nif os.path.isfile(path_torrc_backup):\n    with io.open(path_torrc_backup) as f:\n        torrc = f.read()\nelse:\n    if os.path.isfile(path_torrc):\n        with io.open(path_torrc) as f:\n            torrc = f.read()\n    else:\n        sys.exit('Error opening {0} for reading'.format(path_torrc))\n\n    # save a backup\n    with io.open(path_torrc_backup, 'w') as f:\n        f.write(torrc)\n\n# append the additions\nwith io.open(path_torrc, 'w') as f:\n    f.write(torrc + torrc_additions)\n\n# check for v3 aths files\nv3_authfiles_present = False\nfor f in paths_v3_authfiles.values():\n    if os.path.isfile(f):\n        v3_authfiles_present = True\n\n# if there are v3 authfiles, make dir and copy them into place\ndebian_tor_uid = pwd.getpwnam(\"debian-tor\").pw_uid\ndebian_tor_gid = grp.getgrnam(\"debian-tor\").gr_gid\n\nif not os.path.isdir(path_onion_auth_dir):\n    os.mkdir(path_onion_auth_dir)\n\nos.chmod(path_onion_auth_dir, 0o700)\nos.chown(path_onion_auth_dir, debian_tor_uid, debian_tor_gid)\n\nfor key, f in paths_v3_authfiles.items():\n    if os.path.isfile(f):\n        filename = os.path.basename(f)\n        new_f = os.path.join(path_onion_auth_dir, filename)\n        copyfile(f, new_f)\n        os.chmod(new_f, 0o400)\n        os.chown(new_f, debian_tor_uid, debian_tor_gid)\n\n# restart tor\ntry:\n    subprocess.check_call(['systemctl', 'restart', 'tor@default.service'])\nexcept subprocess.CalledProcessError:\n    sys.exit('Error restarting Tor')\n\n# Turn off \"automatic-decompression\" in Nautilus to ensure the original\n# submission filename is restored (see\n# https://github.com/freedomofpress/securedrop/issues/1862#issuecomment-311519750).\nsubprocess.call(['/usr/bin/dconf', 'write',\n                 '/org/gnome/nautilus/preferences/automatic-decompression',\n                 'false'])\n\n# Set journalist.desktop and source.desktop links as trusted with Nautilus (see\n# https://github.com/freedomofpress/securedrop/issues/2586)\n# set euid and env variables to amnesia user\namnesia_gid = grp.getgrnam('amnesia').gr_gid\namnesia_uid = pwd.getpwnam('amnesia').pw_uid\nos.setresgid(amnesia_gid, amnesia_gid, -1)\nos.setresuid(amnesia_uid, amnesia_uid, -1)\nenv = os.environ.copy()\nenv['XDG_CURRENT_DESKTOP'] = 'GNOME'\nenv['DESKTOP_SESSION'] = 'default'\nenv['DISPLAY'] = ':1'\nenv['XDG_RUNTIME_DIR'] = '/run/user/{}'.format(amnesia_uid)\nenv['XDG_DATA_DIR'] = '/usr/share/gnome:/usr/local/share/:/usr/share/'\nenv['HOME'] = '/home/amnesia'\nenv['LOGNAME'] = 'amnesia'\nenv['DBUS_SESSION_BUS_ADDRESS'] = 'unix:path=/run/user/{}/bus'.format(\n        amnesia_uid)\n\n# remove existing shortcut, recreate symlink and change metadata attribute\n# to trust .desktop\nfor shortcut in ['source.desktop', 'journalist.desktop']:\n    subprocess.call(['rm', path_desktop + shortcut], env=env)\n    subprocess.call(['ln', '-s', path_persistent_desktop + shortcut,\n                     path_desktop + shortcut], env=env)\n    subprocess.call(['gio', 'set', path_desktop + shortcut,\n                     'metadata::trusted', 'true'], env=env)\n\n# in Tails 4, reload gnome-shell desktop icons extension to update with changes above\ncmd = [\"lsb_release\", \"--id\", \"--short\"]\np = subprocess.check_output(cmd)\ndistro_id = p.rstrip()\nif distro_id == 'Debian' and os.uname()[1] == 'amnesia':\n    subprocess.call(['gnome-shell-extension-tool', '-r', 'desktop-icons@csoriano'], env=env)\n\n# reacquire uid0 and notify the user\nos.setresuid(0, 0, -1)\nos.setresgid(0, 0, -1)\nsuccess_message = 'You can now access the Journalist Interface.\\nIf you are an admin, you can now SSH to the servers.'  # noqa: E501\nsubprocess.call(['tails-notify-user',\n                 'SecureDrop successfully auto-configured!',\n                 success_message])\n\n# As the amnesia user, check for SecureDrop workstation updates.\nos.setresgid(amnesia_gid, amnesia_gid, -1)\nos.setresuid(amnesia_uid, amnesia_uid, -1)\noutput = subprocess.check_output([path_securedrop_admin_venv,\n                                  path_securedrop_admin_init,\n                                  '--root', path_securedrop_root,\n                                  'check_for_updates'], env=env)\n\nflag_location = \"/home/amnesia/Persistent/.securedrop/securedrop_update.flag\"\nif b'Update needed' in output or os.path.exists(flag_location):\n    # Start the SecureDrop updater GUI.\n    subprocess.Popen(['python3', path_gui_updater], env=env)\n", "path": "install_files/ansible-base/roles/tails-config/files/securedrop_init.py"}]}