securedrop-workstation
securedrop-workstation copied to clipboard
`provision-all` should fail if salt commands return an error.
The workstation make all
command kicks off several Salt runs for each VM to be created. Currently, if Salt tasks fail, the build proceeds anyway, moving on to the next task and finishing 'successfully.' Because the output from Salt is verbose, it's easy to miss these errors and assume that the build as a success when in fact VMs are in a broken state. make all
should fail loudly in the event of a Salt error to prevent false confidence in build results.
The provision-all
operation will return non-zero exit code if a single step fails during the provisioning process, however the Salt run continues, and it's still difficult to parse the output and discover where/when the error occurs.
This is also an issue for migrations - if it happens within the updater run, the updater doesn't fail but sticks at the current percentage indefinitely (35% as currently calibrated). This is further complicated by the fact that this step takes a while anyway, so without feedback the user doesn't know if it's frozen or just slow without reference to the logs.
Leaving open - this may be technically difficult to do in Salt, but as we investigate other provisioning options, failing early and loudly is a desired feature.