We are currently solving the following issue within our repository. Here is the issue text:
--- BEGIN ISSUE ---
SecureDrop backups from previous versions don't work if database migration has occurred
## Description

Backup restore (https://github.com/freedomofpress/securedrop/blob/develop/install_files/ansible-base/roles/restore/files/restore.py) script does not apply database migrations, and as such breaks the application upon backup restore. Manual workaround that appears to have no side-effects is to run `sudo dpkg-reconfigure securedrop-app-code` on the app server.

## Steps to Reproduce

1. Install SecureDrop 0.8.0
2. `securedrop-admin backup`
3. Upgrade to 0.9.0 (or higher)
4. `securedrop-admin restore`
5. Observe source and journalist interface return error 500

## Expected Behavior

The application should be operational.

## Actual Behavior

The source and journalist interfaces return error 500s.

## Comments

Running `sudo dpkg-reconfigure securedrop-app-code` calls the postinst script which will apply migration. Based on my testing, this seems to work reliably.

--- END ISSUE ---

Below are some code segments, each from a relevant file. One or more of these files may contain bugs.
--- BEGIN FILES ---
Path: `install_files/ansible-base/roles/restore/files/restore.py`
Content:
```
1 #!/usr/bin/python2.7
2 """
3 This script and backup archive should be copied to the App server and run by
4 the Ansible playbook. When run (as root), it restores the contents of the 0.3
5 backup file to the machine it's run on.
6 
7 python restore.py sd-backup-TIMESTAMP.tar.gz
8 """
9 
10 import os
11 import subprocess
12 import sys
13 import tarfile
14 
15 
16 def verify_args():
17     usage = """
18 Usage: restore.py <backup file>
19 
20     <backup file>  Path to a SecureDrop 0.3 backup created by backup.py"
21     """
22     if len(sys.argv) != 2:
23         print(usage)
24         sys.exit(1)
25 
26     if not os.path.exists(sys.argv[1]):
27         print("<backup file> '{}' not found".format(sys.argv[1]))
28         sys.exit(1)
29 
30     if os.geteuid() != 0:
31         print("This program must be run as root!")
32         sys.exit(1)
33 
34 
35 def main():
36     verify_args()
37 
38     with tarfile.open(sys.argv[1], 'r:*') as backup:
39         # This assumes that both the old installation (source of the backup)
40         # and the new installation (destination of the restore) used the
41         # default paths for various locations.
42         backup.extractall(path='/')
43 
44     # Reload Tor and the web server so they pick up the new configuration
45     # If the process exits with a non-zero return code, raises an exception.
46     subprocess.check_call(['service', 'apache2', 'restart'])
47     subprocess.check_call(['service', 'tor', 'reload'])
48 
49 
50 if __name__ == "__main__":
51     main()
52
```
--- END FILES ---

Please first localize the bug based on the issue statement, and then generate a patch according to the `git diff` format fenced by three backticks.

Here is an example:

```diff
diff --git a/examples/server_async.py b/examples/server_async.py
--- a/examples/server_async.py
+++ b/examples/server_async.py
@@ -313,4 +313,4 @@
 
 
 if __name__ == "__main__":
-    asyncio.run(run_async_server("."), debug=True)
+    asyncio.run(run_async_server(), debug=True)
diff --git a/examples/server_sync.py b/examples/server_sync.py
--- a/examples/server_sync.py
+++ b/examples/server_sync.py
@@ -313,5 +313,5 @@
 
 
 if __name__ == "__main__":
-    server = run_sync_server(".")
+    server = run_sync_server()
     server.shutdown()

```

diff --git a/install_files/ansible-base/roles/restore/files/restore.py b/install_files/ansible-base/roles/restore/files/restore.py
--- a/install_files/ansible-base/roles/restore/files/restore.py
+++ b/install_files/ansible-base/roles/restore/files/restore.py
@@ -45,6 +45,8 @@
     # If the process exits with a non-zero return code, raises an exception.
     subprocess.check_call(['service', 'apache2', 'restart'])
     subprocess.check_call(['service', 'tor', 'reload'])
+    # Apply database migrations (if backed-up version < version to restore)
+    subprocess.check_call(['dpkg-reconfigure', 'securedrop-app-code'])
 
 
 if __name__ == "__main__":

{"golden_diff": "diff --git a/install_files/ansible-base/roles/restore/files/restore.py b/install_files/ansible-base/roles/restore/files/restore.py\n--- a/install_files/ansible-base/roles/restore/files/restore.py\n+++ b/install_files/ansible-base/roles/restore/files/restore.py\n@@ -45,6 +45,8 @@\n     # If the process exits with a non-zero return code, raises an exception.\n     subprocess.check_call(['service', 'apache2', 'restart'])\n     subprocess.check_call(['service', 'tor', 'reload'])\n+    # Apply database migrations (if backed-up version < version to restore)\n+    subprocess.check_call(['dpkg-reconfigure', 'securedrop-app-code'])\n \n \n if __name__ == \"__main__\":\n", "issue": "SecureDrop backups from previous versions don't work if database migration has occurred\n## Description\r\n\r\nBackup restore (https://github.com/freedomofpress/securedrop/blob/develop/install_files/ansible-base/roles/restore/files/restore.py) script does not apply database migrations, and as such breaks the application upon backup restore. Manual workaround that appears to have no side-effects is to run `sudo dpkg-reconfigure securedrop-app-code` on the app server.\r\n\r\n## Steps to Reproduce\r\n\r\n1. Install SecureDrop 0.8.0\r\n2. `securedrop-admin backup`\r\n3. Upgrade to 0.9.0 (or higher)\r\n4. `securedrop-admin restore`\r\n5. Observe source and journalist interface return error 500\r\n\r\n## Expected Behavior\r\n\r\nThe application should be operational.\r\n\r\n## Actual Behavior\r\n\r\nThe source and journalist interfaces return error 500s.\r\n\r\n## Comments\r\n\r\nRunning `sudo dpkg-reconfigure securedrop-app-code` calls the postinst script which will apply migration. Based on my testing, this seems to work reliably.\n", "before_files": [{"content": "#!/usr/bin/python2.7\n\"\"\"\nThis script and backup archive should be copied to the App server and run by\nthe Ansible playbook. When run (as root), it restores the contents of the 0.3\nbackup file to the machine it's run on.\n\npython restore.py sd-backup-TIMESTAMP.tar.gz\n\"\"\"\n\nimport os\nimport subprocess\nimport sys\nimport tarfile\n\n\ndef verify_args():\n    usage = \"\"\"\nUsage: restore.py <backup file>\n\n    <backup file>  Path to a SecureDrop 0.3 backup created by backup.py\"\n    \"\"\"\n    if len(sys.argv) != 2:\n        print(usage)\n        sys.exit(1)\n\n    if not os.path.exists(sys.argv[1]):\n        print(\"<backup file> '{}' not found\".format(sys.argv[1]))\n        sys.exit(1)\n\n    if os.geteuid() != 0:\n        print(\"This program must be run as root!\")\n        sys.exit(1)\n\n\ndef main():\n    verify_args()\n\n    with tarfile.open(sys.argv[1], 'r:*') as backup:\n        # This assumes that both the old installation (source of the backup)\n        # and the new installation (destination of the restore) used the\n        # default paths for various locations.\n        backup.extractall(path='/')\n\n    # Reload Tor and the web server so they pick up the new configuration\n    # If the process exits with a non-zero return code, raises an exception.\n    subprocess.check_call(['service', 'apache2', 'restart'])\n    subprocess.check_call(['service', 'tor', 'reload'])\n\n\nif __name__ == \"__main__\":\n    main()\n", "path": "install_files/ansible-base/roles/restore/files/restore.py"}], "after_files": [{"content": "#!/usr/bin/python2.7\n\"\"\"\nThis script and backup archive should be copied to the App server and run by\nthe Ansible playbook. When run (as root), it restores the contents of the 0.3\nbackup file to the machine it's run on.\n\npython restore.py sd-backup-TIMESTAMP.tar.gz\n\"\"\"\n\nimport os\nimport subprocess\nimport sys\nimport tarfile\n\n\ndef verify_args():\n    usage = \"\"\"\nUsage: restore.py <backup file>\n\n    <backup file>  Path to a SecureDrop 0.3 backup created by backup.py\"\n    \"\"\"\n    if len(sys.argv) != 2:\n        print(usage)\n        sys.exit(1)\n\n    if not os.path.exists(sys.argv[1]):\n        print(\"<backup file> '{}' not found\".format(sys.argv[1]))\n        sys.exit(1)\n\n    if os.geteuid() != 0:\n        print(\"This program must be run as root!\")\n        sys.exit(1)\n\n\ndef main():\n    verify_args()\n\n    with tarfile.open(sys.argv[1], 'r:*') as backup:\n        # This assumes that both the old installation (source of the backup)\n        # and the new installation (destination of the restore) used the\n        # default paths for various locations.\n        backup.extractall(path='/')\n\n    # Reload Tor and the web server so they pick up the new configuration\n    # If the process exits with a non-zero return code, raises an exception.\n    subprocess.check_call(['service', 'apache2', 'restart'])\n    subprocess.check_call(['service', 'tor', 'reload'])\n    # Apply database migrations (if backed-up version < version to restore)\n    subprocess.check_call(['dpkg-reconfigure', 'securedrop-app-code'])\n\n\nif __name__ == \"__main__\":\n    main()\n", "path": "install_files/ansible-base/roles/restore/files/restore.py"}]}