prompt: You will be provided with a partial code base and an issue statement explaining a problem to resolve.
  <issue>
  determine post-upgrade failure-mode for a SHA-1-signed submission key
  ## Description
  
  After #6948 (for #6399), redwood will refuse to encrypt to a submission key with a SHA-1 signature.
  
  After #6928, `securedrop-admin sdconfig` will reject a submission key with a SHA-1 signature.  This check guarantees that new and reconfigured instances will comply with #6948.
  
  What will happen to an instance with a SHA-1-signed signature after upgrading to v2.7.0?
  
  ## Possible approaches
  
  | Option | Documentation changes | Code changes | Implication |
  | --- | --- | --- | --- |
  | Fail open, but log | optional | ✓ | Admin must monitor logs and/or OSSEC alerts. |
  | Fail open, but document | ✓ | ✗ | Admin must monitor release notes or check documentation. |
  | Fail closed | optional | ✓[1] | Admin can contact us for help. |
  
  **Notes:**
  1. @legoktm observes that, without a code change to handle this case, Apache will come back up after reboot even if the `postinst` script fails under `unattended-upgrades`.
  
  </issue>
  <code>
  [start of securedrop/journalist.py]
  1 from encryption import EncryptionManager, GpgKeyNotFoundError
  2 from execution import asynchronous
  3 from journalist_app import create_app
  4 from models import Source
  5 from sdconfig import SecureDropConfig
  6 
  7 config = SecureDropConfig.get_current()
  8 # app is imported by journalist.wsgi
  9 app = create_app(config)
  10 
  11 
  12 @asynchronous
  13 def prime_keycache() -> None:
  14     """Pre-load the source public keys into Redis."""
  15     with app.app_context():
  16         encryption_mgr = EncryptionManager.get_default()
  17         for source in Source.query.filter_by(pending=False, deleted_at=None).all():
  18             try:
  19                 encryption_mgr.get_source_public_key(source.filesystem_id)
  20             except GpgKeyNotFoundError:
  21                 pass
  22 
  23 
  24 prime_keycache()
  25 
  26 
  27 if __name__ == "__main__":  # pragma: no cover
  28     debug = getattr(config, "env", "prod") != "prod"
  29     # nosemgrep: python.flask.security.audit.app-run-param-config.avoid_app_run_with_bad_host
  30     app.run(debug=debug, host="0.0.0.0", port=8081)
  31
  [end of securedrop/journalist.py]
  </code>
  
  I need you to solve this issue by generating a single patch file that I can apply directly to this repository using git apply. Please respond with a single patch file in the following format.
  <patch>
  diff --git a/file.py b/file.py
  --- a/file.py
  +++ b/file.py
  @@ -1,27 +1,35 @@
   def euclidean(a, b):
  -    while b:
  -        a, b = b, a % b
  -    return a
  +    if b == 0:
  +        return a
  +    return euclidean(b, a % b)
   
   
   def bresenham(x0, y0, x1, y1):
       points = []
       dx = abs(x1 - x0)
       dy = abs(y1 - y0)
  -    sx = 1 if x0 < x1 else -1
  -    sy = 1 if y0 < y1 else -1
  -    err = dx - dy
  +    x, y = x0, y0
  +    sx = -1 if x0 > x1 else 1
  +    sy = -1 if y0 > y1 else 1
   
  -    while True:
  -        points.append((x0, y0))
  -        if x0 == x1 and y0 == y1:
  -            break
  -        e2 = 2 * err
  -        if e2 > -dy:
  -            err -= dy
  -            x0 += sx
  -        if e2 < dx:
  -            err += dx
  -            y0 += sy
  +    if dx > dy:
  +        err = dx / 2.0
  +        while x != x1:
  +            points.append((x, y))
  +            err -= dy
  +            if err < 0:
  +                y += sy
  +                err += dx
  +            x += sx
  +    else:
  +        err = dy / 2.0
  +        while y != y1:
  +            points.append((x, y))
  +            err -= dx
  +            if err < 0:
  +                x += sx
  +                err += dy
  +            y += sy
  +
  +    points.append((x, y))
       return points
  
  </patch>
golden_diff: diff --git a/securedrop/journalist.py b/securedrop/journalist.py
  --- a/securedrop/journalist.py
  +++ b/securedrop/journalist.py
  @@ -1,9 +1,13 @@
  +import sys
  +
   from encryption import EncryptionManager, GpgKeyNotFoundError
   from execution import asynchronous
   from journalist_app import create_app
   from models import Source
   from sdconfig import SecureDropConfig
   
  +import redwood
  +
   config = SecureDropConfig.get_current()
   # app is imported by journalist.wsgi
   app = create_app(config)
  @@ -21,10 +25,28 @@
                   pass
   
   
  -prime_keycache()
  +def validate_journalist_key() -> None:
  +    """Verify the journalist PGP key is valid"""
  +    encryption_mgr = EncryptionManager.get_default()
  +    # First check that we can read it
  +    try:
  +        journalist_key = encryption_mgr.get_journalist_public_key()
  +    except Exception as e:
  +        print(f"ERROR: Unable to read journalist public key: {e}", file=sys.stderr)
  +        app.logger.error(f"ERROR: Unable to read journalist public key: {e}")
  +        sys.exit(1)
  +    # And then what we read is valid
  +    try:
  +        redwood.is_valid_public_key(journalist_key)
  +    except redwood.RedwoodError as e:
  +        print(f"ERROR: Journalist public key is not valid: {e}", file=sys.stderr)
  +        app.logger.error(f"ERROR: Journalist public key is not valid: {e}")
  +        sys.exit(1)
   
   
   if __name__ == "__main__":  # pragma: no cover
  +    validate_journalist_key()
  +    prime_keycache()
       debug = getattr(config, "env", "prod") != "prod"
       # nosemgrep: python.flask.security.audit.app-run-param-config.avoid_app_run_with_bad_host
       app.run(debug=debug, host="0.0.0.0", port=8081)
  
verification_info: {"golden_diff": "diff --git a/securedrop/journalist.py b/securedrop/journalist.py\n--- a/securedrop/journalist.py\n+++ b/securedrop/journalist.py\n@@ -1,9 +1,13 @@\n+import sys\n+\n from encryption import EncryptionManager, GpgKeyNotFoundError\n from execution import asynchronous\n from journalist_app import create_app\n from models import Source\n from sdconfig import SecureDropConfig\n \n+import redwood\n+\n config = SecureDropConfig.get_current()\n # app is imported by journalist.wsgi\n app = create_app(config)\n@@ -21,10 +25,28 @@\n                 pass\n \n \n-prime_keycache()\n+def validate_journalist_key() -> None:\n+    \"\"\"Verify the journalist PGP key is valid\"\"\"\n+    encryption_mgr = EncryptionManager.get_default()\n+    # First check that we can read it\n+    try:\n+        journalist_key = encryption_mgr.get_journalist_public_key()\n+    except Exception as e:\n+        print(f\"ERROR: Unable to read journalist public key: {e}\", file=sys.stderr)\n+        app.logger.error(f\"ERROR: Unable to read journalist public key: {e}\")\n+        sys.exit(1)\n+    # And then what we read is valid\n+    try:\n+        redwood.is_valid_public_key(journalist_key)\n+    except redwood.RedwoodError as e:\n+        print(f\"ERROR: Journalist public key is not valid: {e}\", file=sys.stderr)\n+        app.logger.error(f\"ERROR: Journalist public key is not valid: {e}\")\n+        sys.exit(1)\n \n \n if __name__ == \"__main__\":  # pragma: no cover\n+    validate_journalist_key()\n+    prime_keycache()\n     debug = getattr(config, \"env\", \"prod\") != \"prod\"\n     # nosemgrep: python.flask.security.audit.app-run-param-config.avoid_app_run_with_bad_host\n     app.run(debug=debug, host=\"0.0.0.0\", port=8081)\n", "issue": "determine post-upgrade failure-mode for a SHA-1-signed submission key\n## Description\r\n\r\nAfter #6948 (for #6399), redwood will refuse to encrypt to a submission key with a SHA-1 signature.\r\n\r\nAfter #6928, `securedrop-admin sdconfig` will reject a submission key with a SHA-1 signature.  This check guarantees that new and reconfigured instances will comply with #6948.\r\n\r\nWhat will happen to an instance with a SHA-1-signed signature after upgrading to v2.7.0?\r\n\r\n## Possible approaches\r\n\r\n| Option | Documentation changes | Code changes | Implication |\r\n| --- | --- | --- | --- |\r\n| Fail open, but log | optional | \u2713 | Admin must monitor logs and/or OSSEC alerts. |\r\n| Fail open, but document | \u2713 | \u2717 | Admin must monitor release notes or check documentation. |\r\n| Fail closed | optional | \u2713[1] | Admin can contact us for help. |\r\n\r\n**Notes:**\r\n1. @legoktm observes that, without a code change to handle this case, Apache will come back up after reboot even if the `postinst` script fails under `unattended-upgrades`.\n", "before_files": [{"content": "from encryption import EncryptionManager, GpgKeyNotFoundError\nfrom execution import asynchronous\nfrom journalist_app import create_app\nfrom models import Source\nfrom sdconfig import SecureDropConfig\n\nconfig = SecureDropConfig.get_current()\n# app is imported by journalist.wsgi\napp = create_app(config)\n\n\n@asynchronous\ndef prime_keycache() -> None:\n    \"\"\"Pre-load the source public keys into Redis.\"\"\"\n    with app.app_context():\n        encryption_mgr = EncryptionManager.get_default()\n        for source in Source.query.filter_by(pending=False, deleted_at=None).all():\n            try:\n                encryption_mgr.get_source_public_key(source.filesystem_id)\n            except GpgKeyNotFoundError:\n                pass\n\n\nprime_keycache()\n\n\nif __name__ == \"__main__\":  # pragma: no cover\n    debug = getattr(config, \"env\", \"prod\") != \"prod\"\n    # nosemgrep: python.flask.security.audit.app-run-param-config.avoid_app_run_with_bad_host\n    app.run(debug=debug, host=\"0.0.0.0\", port=8081)\n", "path": "securedrop/journalist.py"}]}