Update securedrop-workstation-grsec for 5.15.41/bullseye

[sssoleileraaa]

Towards #321

• Update changelog for securedrop-workstation-grsec
• Add job for building securedrop-workstation-grsec in CI
  • Change the versioning scheme to $KERNEL-$REVISION~$PLATFORM. This means the package's "upstream version" will be the kernel version, so we can use variables like ${source:Upstream-Version} and $DEB_VERSION_UPSTREAM to substitute in the kernel version without hardcoding it.
  • Skip u2mfn code on bullseye, it's not needed anymore on Qubes 4.1.
  • "Hack" CI to use changelog-bullseye since we need a different version on bullseye.

Cross link to freedomofpress/securedrop-apt-test#158

Test plan

• Build on both buster and bullseye. Use apt show securedrop-workstation-grsec_4.14.241-2~buster_amd64.deb and apt show securedrop-workstation-grsec_5.15.41-1~bullseye_amd64.deb to verify the dependencies have the correct version substituted in
• Extract the control metdata with ar x securedrop-workstation-grsec_5.15.41-1~bullseye_amd64.deb && tar xvf control.tar.xz, and look at the postinst to verify the token was substituted properly.

[legoktm]

I think we still need some of the stuff Conor did in #301, let me take a stab at making it build on bullseye and buster...

[sssoleileraaa]

@legoktm just explained that we can use debian substitution variables to no longer worry about having to manually update the version strings in the control file. This change can be appended to this PR.

[sssoleileraaa]

I'm going to rebuild the kernel anyway before creating a PR with the new debs for dev-lfs. I'll link to that PR once it's ready.

[legoktm]

The CI logic is a bit busted still, I'll fix that up tomorrow. But the package should build as we want it on both bullseye and buster.

[legoktm]

CI correctly built securedrop-workstation-grsec_5.15.38-1~bullseye_amd64.deb and securedrop-workstation-grsec_4.14.241-2~buster_amd64.deb \o/

[legoktm]

The ${source:Upstream-Version} syntax is documented at https://manpages.debian.org/bullseye/dpkg-dev/deb-substvars.5.en.html#source:Upstream

Tokens in postinst are documented at https://manpages.debian.org/bullseye/debhelper/dh_installdeb.1.en.html except the custom --define parameter is bullseye only, so we need to use sed for buster compat.

[sssoleileraaa]

@legoktm It looks like PKG_VERSION=5.15.41 PKG_PLATFORM=bullseye make securedrop-workstation-grsec is failing now (it worked when I tested against these changes: https://github.com/freedomofpress/securedrop-debian-packaging/pull/301/files)... it looks like it has to do with the use of substitution variables maybe... I'll attach the error output from qubes in a followup comment

[legoktm]

Should be fixed with f5d13b3.

[sssoleileraaa]

Only thing left is to make sure we can run scripts/update-changelog so that it automatically formats the debian package version string appropriately for grsec as done manually in f5d13b3.

• Change the versioning scheme to $KERNEL-$REVISION~$PLATFORM. This means the package's "upstream version" will be the kernel version, so we can use variables like ${source:Upstream-Version} and $DEB_VERSION_UPSTREAM to substitute in the kernel version without hardcoding it.

Just making note that the result of this is also that our changelog script will need special casing for grsec.

[sssoleileraaa]

Just tested the recent changes for a new test version of grsec and another package (i chose proxy) for a regression check.

So this lgtm and will need your approval still @legoktm!