From fbcd77be4e18437880d42ab8eb6e3d2e892f6fe3 Mon Sep 17 00:00:00 2001
From: Kunal Mehta <legoktm@debian.org>
Date: Fri, 14 Apr 2023 17:19:08 -0400
Subject: [PATCH] Clean Python cache in prerm only

We are currently cleaning the Python cache in the postinst and postrm,
but that still leaves us with warnings from apt that non-empty
`__pycache__` directories couldn't be deleted.

This mimics what dh-python does, which is to run py3compile in the
postinst (already doing) and run py3clean in the prerm.

During a fresh install, only the postinst is triggered to compile the
cache.

During an upgrade, first the prerm runs, removing the cache, then the
new version is unpacked, then postinst goes, recreating the cache.

Fixes #6743.
---
 .../debian/securedrop-app-code.postinst       |  4 --
 securedrop/debian/securedrop-app-code.postrm  |  6 ---
 securedrop/debian/securedrop-app-code.prerm   | 40 +++++++++++++++++++
 3 files changed, 40 insertions(+), 10 deletions(-)
 create mode 100644 securedrop/debian/securedrop-app-code.prerm

diff --git a/securedrop/debian/securedrop-app-code.postinst b/securedrop/debian/securedrop-app-code.postinst
index b97c2dd146..97e459970e 100644
--- a/securedrop/debian/securedrop-app-code.postinst
+++ b/securedrop/debian/securedrop-app-code.postinst
@@ -109,10 +109,6 @@ migrate_crontab() {
 #
 #
 refresh_bytecode() {
-    # Remove any existing byte code files, to ensure that obsolete
-    # dependencies can't linger after they've been removed.
-    find "${SDVE}" -name '*.py[co]' -delete
-    find /var/www/securedrop -name '*.py[co]' -delete
     # Now generate the new byte-code
     py3compile "${SDVE}"
     py3compile /var/www/securedrop
diff --git a/securedrop/debian/securedrop-app-code.postrm b/securedrop/debian/securedrop-app-code.postrm
index 2cfbb08790..b08ee6b561 100644
--- a/securedrop/debian/securedrop-app-code.postrm
+++ b/securedrop/debian/securedrop-app-code.postrm
@@ -19,17 +19,11 @@ set -e
 # the debian-policy package
 . /usr/share/debconf/confmodule
 
-clean_pyc() {
-    find /var/www/securedrop/ -name '*.pyc' -delete
-    find /var/www/securedrop/ -name __pycache__ -delete
-}
-
 case "$1" in
     upgrade|failed-upgrade)
     ;;
 
     remove|abort-install|abort-upgrade|disappear)
-        clean_pyc
     ;;
 
     purge)
diff --git a/securedrop/debian/securedrop-app-code.prerm b/securedrop/debian/securedrop-app-code.prerm
new file mode 100644
index 0000000000..537d9292ce
--- /dev/null
+++ b/securedrop/debian/securedrop-app-code.prerm
@@ -0,0 +1,40 @@
+#!/bin/sh
+# prerm script for securedrop-app-code
+#
+# See: dh_installdeb(1).
+
+set -e
+
+# Summary of how this script can be called:
+#        * <prerm> 'remove'
+#        * <old-prerm> 'upgrade' <new-version>
+#        * <new-prerm> 'failed-upgrade' <old-version>
+#        * <conflictor's-prerm> 'remove' 'in-favour' <package> <new-version>
+#        * <deconfigured's-prerm> 'deconfigure' 'in-favour'
+#          <package-being-installed> <version> 'removing'
+#          <conflicting-package> <version>
+# for details, see https://www.debian.org/doc/debian-policy/ or
+# the debian-policy package.
+
+
+case "$1" in
+    remove|upgrade|deconfigure)
+        py3clean /opt/venvs/securedrop-app-code
+        py3clean /var/www/securedrop
+    ;;
+
+    failed-upgrade)
+    ;;
+
+    *)
+        echo "prerm called with unknown argument '$1'" >&2
+        exit 1
+    ;;
+esac
+
+# dh_installdeb will replace this with shell code automatically
+# generated by other debhelper scripts.
+
+#DEBHELPER#
+
+exit 0