<commit_before>---
# After installing securedrop-grsec, remove
# old generic kernels to avoid accidental
# boots into a less secure environment.
- name: Remove generic kernel packages.
  apt:
    name: "{{ item }}"
    state: absent
  with_items:
    - linux-signed-generic
    - linux-signed-generic-lts-utopic
    - linux-signed-image-generic
    - linux-signed-image-generic-lts-utopic
    - 'linux-image-*generic'
    - 'linux-headers-*'
  tags:
    - apt

- name: Mark GRUB2 as manually installed so its not removed.
  command: apt-mark manual grub-pc
  register: grubpc_manual_mark
  changed_when: "'grub-pc was already set to manually installed.' not in grubpc_manual_mark.stdout"
  tags:
    - apt
    - kernel
    - grub

- name: Clean old apt packages.
  command: apt-get -y autoremove
  register: apt_autoremove_all
  changed_when: "'The following packages will be REMOVED' in apt_autoremove_all.stdout"
  tags:
    - apt<commit_msg>Remove xenial kernel at install-time<commit_after>---
# After installing securedrop-grsec, remove
# old generic kernels to avoid accidental
# boots into a less secure environment.
- name: Remove generic kernel packages.
  command: apt-get remove -y {{ item }}
  with_items:
    - linux-signed-generic
    - linux-signed-generic-lts-utopic
    - linux-signed-image-generic
    - linux-signed-image-generic-lts-utopic
    - linux-image-generic-lts-xenial
    - 'linux-image-.*generic'
    - 'linux-headers-.*'
  tags:
    - apt

- name: Get list of all installed kernels.
  shell: dpkg-query -f '${Package} ${Status}\n' -W 'linux-image*' | awk '$NF == "installed"{print $1}'
  register: apt_installed_kernels
  tags:
    - apt

- name: Validate that all installed kernels are grsecurity-hardened.
  assert:
    that:
      - item | search('-grsec')
    msg: "Not all non-grsec kernels have been removed, run dpkg-query -W 'linux-image*' for more details."
  with_items: "{{ apt_installed_kernels.stdout_lines }}"
  tags:
    - apt

- name: Mark GRUB2 as manually installed so its not removed.
  command: apt-mark manual grub-pc
  register: grubpc_manual_mark
  changed_when: "'grub-pc was already set to manually installed.' not in grubpc_manual_mark.stdout"
  tags:
    - apt
    - kernel
    - grub

- name: Clean old apt packages.
  command: apt-get -y autoremove
  register: apt_autoremove_all
  changed_when: "'The following packages will be REMOVED' in apt_autoremove_all.stdout"
  tags:
    - apt
{'fraction_non_alphanumeric': 0.1051124744376278, 'fraction_numerical': 0.001226993865030675, 'mean_word_length': 3.1178451178451176, 'pattern_counts': {'":': 0, '<': 3, '<?xml version=': 0, '>': 3, 'https://': 0, 'lorem ipsum': 0, 'www.': 0, 'xml': 0}, 'pii_count': 0, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 0, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
{'dir': 'git-commits-cleaned', 'id': '2370735', 'n_tokens_mistral': 820, 'n_tokens_neox': 779, 'n_words': 235}