We are currently solving the following issue within our repository. Here is the issue text:
--- BEGIN ISSUE ---
SecureDrop desktop shortcuts not displayed correctly on Tails 3.3   
# Bug

The desktop shortcuts for the SecureDrop Source and Journalist interfaces do not show the correct title and logo on Tail 3.3. Tails 3.3 introduces a fix for the `.desktop` file security issue. The fix requires `.desktop` files to have a `trusted` metadata parameter set before the `.desktop` file is parsed and displayed with a custom name and icon.

The shortcuts are displayed with a name like `source.desktop` and requires a user to click "Trust and Launch" before the shortcut is displayed with the correct name and icon. Requiring users to click-through this warning could cause warning fatigue and result in unsafe user behavior.

## Steps to reproduce

Click a SecureDrop .desktop shortcut on a Journalist Workstation running Tails 3.3. 

## Expected Behavior

The SecureDrop .onion opens in Tor Browser.

## Actual Behavior

The user receives a warning about an untrusted .desktop file.

## Comments

The SecureDrop `tails-config` Ansible role should set the Nautilus `metadata::trusted` parameter for both the Source and Journalist .desktop files.


--- END ISSUE ---

Below are some code segments, each from a relevant file. One or more of these files may contain bugs.
--- BEGIN FILES ---
Path: `install_files/ansible-base/roles/tails-config/files/securedrop_init.py`
Content:
```
1 #!/usr/bin/python
2 
3 import os
4 import sys
5 import subprocess
6 
7 
8 # check for root
9 if os.geteuid() != 0:
10     sys.exit('You need to run this as root')
11 
12 # paths
13 path_torrc_additions = '/home/amnesia/Persistent/.securedrop/torrc_additions'
14 path_torrc_backup = '/etc/tor/torrc.bak'
15 path_torrc = '/etc/tor/torrc'
16 
17 # load torrc_additions
18 if os.path.isfile(path_torrc_additions):
19     torrc_additions = open(path_torrc_additions).read()
20 else:
21     sys.exit('Error opening {0} for reading'.format(path_torrc_additions))
22 
23 # load torrc
24 if os.path.isfile(path_torrc_backup):
25     torrc = open(path_torrc_backup).read()
26 else:
27     if os.path.isfile(path_torrc):
28         torrc = open(path_torrc).read()
29     else:
30         sys.exit('Error opening {0} for reading'.format(path_torrc))
31 
32     # save a backup
33     open(path_torrc_backup, 'w').write(torrc)
34 
35 # append the additions
36 open(path_torrc, 'w').write(torrc + torrc_additions)
37 
38 # reload tor
39 try:
40     subprocess.check_call(['systemctl', 'reload', 'tor@default.service'])
41 except subprocess.CalledProcessError:
42     sys.exit('Error reloading Tor')
43 
44 # Turn off "automatic-decompression" in Nautilus to ensure the original
45 # submission filename is restored (see
46 # https://github.com/freedomofpress/securedrop/issues/1862#issuecomment-311519750).
47 subprocess.call(['/usr/bin/dconf', 'write',
48                  '/org/gnome/nautilus/preferences/automatic-decompression',
49                  'false'])
50 
51 # notify the user
52 subprocess.call(['tails-notify-user',
53                  'SecureDrop successfully auto-configured!',
54                  'You can now access the Journalist Interface.\nIf you are an admin, you can now SSH to the servers.'])
55
```
--- END FILES ---

Please first localize the bug based on the issue statement, and then generate a patch according to the `git diff` format fenced by three backticks.

Here is an example:

```diff
diff --git a/examples/server_async.py b/examples/server_async.py
--- a/examples/server_async.py
+++ b/examples/server_async.py
@@ -313,4 +313,4 @@
 
 
 if __name__ == "__main__":
-    asyncio.run(run_async_server("."), debug=True)
+    asyncio.run(run_async_server(), debug=True)
diff --git a/examples/server_sync.py b/examples/server_sync.py
--- a/examples/server_sync.py
+++ b/examples/server_sync.py
@@ -313,5 +313,5 @@
 
 
 if __name__ == "__main__":
-    server = run_sync_server(".")
+    server = run_sync_server()
     server.shutdown()

```

diff --git a/install_files/ansible-base/roles/tails-config/files/securedrop_init.py b/install_files/ansible-base/roles/tails-config/files/securedrop_init.py
--- a/install_files/ansible-base/roles/tails-config/files/securedrop_init.py
+++ b/install_files/ansible-base/roles/tails-config/files/securedrop_init.py
@@ -1,6 +1,8 @@
 #!/usr/bin/python
 
+import grp
 import os
+import pwd
 import sys
 import subprocess
 
@@ -13,6 +15,8 @@
 path_torrc_additions = '/home/amnesia/Persistent/.securedrop/torrc_additions'
 path_torrc_backup = '/etc/tor/torrc.bak'
 path_torrc = '/etc/tor/torrc'
+path_desktop = '/home/amnesia/Desktop/'
+path_persistent_desktop = '/lib/live/mount/persistence/TailsData_unlocked/dotfiles/Desktop/'
 
 # load torrc_additions
 if os.path.isfile(path_torrc_additions):
@@ -48,7 +52,29 @@
                  '/org/gnome/nautilus/preferences/automatic-decompression',
                  'false'])
 
-# notify the user
+# Set journalist.desktop and source.desktop links as trusted with Nautilus (see
+# https://github.com/freedomofpress/securedrop/issues/2586)
+# set euid and env variables to amnesia user
+amnesia_gid = grp.getgrnam('amnesia').gr_gid
+amnesia_uid = pwd.getpwnam('amnesia').pw_uid
+os.setresgid(amnesia_gid, amnesia_gid, -1)
+os.setresuid(amnesia_uid, amnesia_uid, -1)
+env = os.environ.copy()
+env['XDG_RUNTIME_DIR'] = '/run/user/{}'.format(amnesia_uid)
+env['XDG_DATA_DIR'] = '/usr/share/gnome:/usr/local/share/:/usr/share/'
+env['HOME'] = '/home/amnesia'
+env['LOGNAME'] = 'amnesia'
+env['DBUS_SESSION_BUS_ADDRESS'] = 'unix:path=/run/user/{}/bus'.format(amnesia_uid)
+
+# remove existing shortcut, recreate symlink and change metadata attribute to trust .desktop
+for shortcut in ['source.desktop', 'journalist.desktop']:
+    subprocess.call(['rm', path_desktop + shortcut], env=env)
+    subprocess.call(['ln', '-s', path_persistent_desktop + shortcut, path_desktop + shortcut], env=env)
+    subprocess.call(['gio', 'set', path_desktop + shortcut, 'metadata::trusted', 'yes'], env=env)
+
+# reacquire uid0 and notify the user
+os.setresuid(0,0,-1)
+os.setresgid(0,0,-1)
 subprocess.call(['tails-notify-user',
                  'SecureDrop successfully auto-configured!',
                  'You can now access the Journalist Interface.\nIf you are an admin, you can now SSH to the servers.'])

{"golden_diff": "diff --git a/install_files/ansible-base/roles/tails-config/files/securedrop_init.py b/install_files/ansible-base/roles/tails-config/files/securedrop_init.py\n--- a/install_files/ansible-base/roles/tails-config/files/securedrop_init.py\n+++ b/install_files/ansible-base/roles/tails-config/files/securedrop_init.py\n@@ -1,6 +1,8 @@\n #!/usr/bin/python\n \n+import grp\n import os\n+import pwd\n import sys\n import subprocess\n \n@@ -13,6 +15,8 @@\n path_torrc_additions = '/home/amnesia/Persistent/.securedrop/torrc_additions'\n path_torrc_backup = '/etc/tor/torrc.bak'\n path_torrc = '/etc/tor/torrc'\n+path_desktop = '/home/amnesia/Desktop/'\n+path_persistent_desktop = '/lib/live/mount/persistence/TailsData_unlocked/dotfiles/Desktop/'\n \n # load torrc_additions\n if os.path.isfile(path_torrc_additions):\n@@ -48,7 +52,29 @@\n                  '/org/gnome/nautilus/preferences/automatic-decompression',\n                  'false'])\n \n-# notify the user\n+# Set journalist.desktop and source.desktop links as trusted with Nautilus (see\n+# https://github.com/freedomofpress/securedrop/issues/2586)\n+# set euid and env variables to amnesia user\n+amnesia_gid = grp.getgrnam('amnesia').gr_gid\n+amnesia_uid = pwd.getpwnam('amnesia').pw_uid\n+os.setresgid(amnesia_gid, amnesia_gid, -1)\n+os.setresuid(amnesia_uid, amnesia_uid, -1)\n+env = os.environ.copy()\n+env['XDG_RUNTIME_DIR'] = '/run/user/{}'.format(amnesia_uid)\n+env['XDG_DATA_DIR'] = '/usr/share/gnome:/usr/local/share/:/usr/share/'\n+env['HOME'] = '/home/amnesia'\n+env['LOGNAME'] = 'amnesia'\n+env['DBUS_SESSION_BUS_ADDRESS'] = 'unix:path=/run/user/{}/bus'.format(amnesia_uid)\n+\n+# remove existing shortcut, recreate symlink and change metadata attribute to trust .desktop\n+for shortcut in ['source.desktop', 'journalist.desktop']:\n+    subprocess.call(['rm', path_desktop + shortcut], env=env)\n+    subprocess.call(['ln', '-s', path_persistent_desktop + shortcut, path_desktop + shortcut], env=env)\n+    subprocess.call(['gio', 'set', path_desktop + shortcut, 'metadata::trusted', 'yes'], env=env)\n+\n+# reacquire uid0 and notify the user\n+os.setresuid(0,0,-1)\n+os.setresgid(0,0,-1)\n subprocess.call(['tails-notify-user',\n                  'SecureDrop successfully auto-configured!',\n                  'You can now access the Journalist Interface.\\nIf you are an admin, you can now SSH to the servers.'])\n", "issue": "SecureDrop desktop shortcuts not displayed correctly on Tails 3.3   \n# Bug\r\n\r\nThe desktop shortcuts for the SecureDrop Source and Journalist interfaces do not show the correct title and logo on Tail 3.3. Tails 3.3 introduces a fix for the `.desktop` file security issue. The fix requires `.desktop` files to have a `trusted` metadata parameter set before the `.desktop` file is parsed and displayed with a custom name and icon.\r\n\r\nThe shortcuts are displayed with a name like `source.desktop` and requires a user to click \"Trust and Launch\" before the shortcut is displayed with the correct name and icon. Requiring users to click-through this warning could cause warning fatigue and result in unsafe user behavior.\r\n\r\n## Steps to reproduce\r\n\r\nClick a SecureDrop .desktop shortcut on a Journalist Workstation running Tails 3.3. \r\n\r\n## Expected Behavior\r\n\r\nThe SecureDrop .onion opens in Tor Browser.\r\n\r\n## Actual Behavior\r\n\r\nThe user receives a warning about an untrusted .desktop file.\r\n\r\n## Comments\r\n\r\nThe SecureDrop `tails-config` Ansible role should set the Nautilus `metadata::trusted` parameter for both the Source and Journalist .desktop files.\r\n\n", "before_files": [{"content": "#!/usr/bin/python\n\nimport os\nimport sys\nimport subprocess\n\n\n# check for root\nif os.geteuid() != 0:\n    sys.exit('You need to run this as root')\n\n# paths\npath_torrc_additions = '/home/amnesia/Persistent/.securedrop/torrc_additions'\npath_torrc_backup = '/etc/tor/torrc.bak'\npath_torrc = '/etc/tor/torrc'\n\n# load torrc_additions\nif os.path.isfile(path_torrc_additions):\n    torrc_additions = open(path_torrc_additions).read()\nelse:\n    sys.exit('Error opening {0} for reading'.format(path_torrc_additions))\n\n# load torrc\nif os.path.isfile(path_torrc_backup):\n    torrc = open(path_torrc_backup).read()\nelse:\n    if os.path.isfile(path_torrc):\n        torrc = open(path_torrc).read()\n    else:\n        sys.exit('Error opening {0} for reading'.format(path_torrc))\n\n    # save a backup\n    open(path_torrc_backup, 'w').write(torrc)\n\n# append the additions\nopen(path_torrc, 'w').write(torrc + torrc_additions)\n\n# reload tor\ntry:\n    subprocess.check_call(['systemctl', 'reload', 'tor@default.service'])\nexcept subprocess.CalledProcessError:\n    sys.exit('Error reloading Tor')\n\n# Turn off \"automatic-decompression\" in Nautilus to ensure the original\n# submission filename is restored (see\n# https://github.com/freedomofpress/securedrop/issues/1862#issuecomment-311519750).\nsubprocess.call(['/usr/bin/dconf', 'write',\n                 '/org/gnome/nautilus/preferences/automatic-decompression',\n                 'false'])\n\n# notify the user\nsubprocess.call(['tails-notify-user',\n                 'SecureDrop successfully auto-configured!',\n                 'You can now access the Journalist Interface.\\nIf you are an admin, you can now SSH to the servers.'])\n", "path": "install_files/ansible-base/roles/tails-config/files/securedrop_init.py"}], "after_files": [{"content": "#!/usr/bin/python\n\nimport grp\nimport os\nimport pwd\nimport sys\nimport subprocess\n\n\n# check for root\nif os.geteuid() != 0:\n    sys.exit('You need to run this as root')\n\n# paths\npath_torrc_additions = '/home/amnesia/Persistent/.securedrop/torrc_additions'\npath_torrc_backup = '/etc/tor/torrc.bak'\npath_torrc = '/etc/tor/torrc'\npath_desktop = '/home/amnesia/Desktop/'\npath_persistent_desktop = '/lib/live/mount/persistence/TailsData_unlocked/dotfiles/Desktop/'\n\n# load torrc_additions\nif os.path.isfile(path_torrc_additions):\n    torrc_additions = open(path_torrc_additions).read()\nelse:\n    sys.exit('Error opening {0} for reading'.format(path_torrc_additions))\n\n# load torrc\nif os.path.isfile(path_torrc_backup):\n    torrc = open(path_torrc_backup).read()\nelse:\n    if os.path.isfile(path_torrc):\n        torrc = open(path_torrc).read()\n    else:\n        sys.exit('Error opening {0} for reading'.format(path_torrc))\n\n    # save a backup\n    open(path_torrc_backup, 'w').write(torrc)\n\n# append the additions\nopen(path_torrc, 'w').write(torrc + torrc_additions)\n\n# reload tor\ntry:\n    subprocess.check_call(['systemctl', 'reload', 'tor@default.service'])\nexcept subprocess.CalledProcessError:\n    sys.exit('Error reloading Tor')\n\n# Turn off \"automatic-decompression\" in Nautilus to ensure the original\n# submission filename is restored (see\n# https://github.com/freedomofpress/securedrop/issues/1862#issuecomment-311519750).\nsubprocess.call(['/usr/bin/dconf', 'write',\n                 '/org/gnome/nautilus/preferences/automatic-decompression',\n                 'false'])\n\n# Set journalist.desktop and source.desktop links as trusted with Nautilus (see\n# https://github.com/freedomofpress/securedrop/issues/2586)\n# set euid and env variables to amnesia user\namnesia_gid = grp.getgrnam('amnesia').gr_gid\namnesia_uid = pwd.getpwnam('amnesia').pw_uid\nos.setresgid(amnesia_gid, amnesia_gid, -1)\nos.setresuid(amnesia_uid, amnesia_uid, -1)\nenv = os.environ.copy()\nenv['XDG_RUNTIME_DIR'] = '/run/user/{}'.format(amnesia_uid)\nenv['XDG_DATA_DIR'] = '/usr/share/gnome:/usr/local/share/:/usr/share/'\nenv['HOME'] = '/home/amnesia'\nenv['LOGNAME'] = 'amnesia'\nenv['DBUS_SESSION_BUS_ADDRESS'] = 'unix:path=/run/user/{}/bus'.format(amnesia_uid)\n\n# remove existing shortcut, recreate symlink and change metadata attribute to trust .desktop\nfor shortcut in ['source.desktop', 'journalist.desktop']:\n    subprocess.call(['rm', path_desktop + shortcut], env=env)\n    subprocess.call(['ln', '-s', path_persistent_desktop + shortcut, path_desktop + shortcut], env=env)\n    subprocess.call(['gio', 'set', path_desktop + shortcut, 'metadata::trusted', 'yes'], env=env)\n\n# reacquire uid0 and notify the user\nos.setresuid(0,0,-1)\nos.setresgid(0,0,-1)\nsubprocess.call(['tails-notify-user',\n                 'SecureDrop successfully auto-configured!',\n                 'You can now access the Journalist Interface.\\nIf you are an admin, you can now SSH to the servers.'])\n", "path": "install_files/ansible-base/roles/tails-config/files/securedrop_init.py"}]}