MT#62899 Improve secret key generation

If we generate the secret key and then change its permissions, we leave
a race-condition where an observer can try to open or read the contents
before the permissions have been reduced.

Improve the progress reporting to print a message when we start and once
we are done.

Change-Id: Idef205ae9e687a0439c68a58793477e9d8347836

debian/repoapi.postinst

@@ -25,10 +25,14 @@ case "$1" in
 
   configure)
     if ! [ -f "${LIB_DIR}/.secret_key" ] ; then
-      mk_dj_secret > "${LIB_DIR}/.secret_key"
+      printf "Generating repoapi secret_key file... "
+      (
+        umask 0077
+        mk_dj_secret >"${LIB_DIR}/.secret_key"
+      )
       chmod 600 "${LIB_DIR}/.secret_key"
       chown www-data:www-data "${LIB_DIR}/.secret_key"
-      echo "generated secret_key"
+      echo "done."
     fi
     cd "${USR_DIR}" && make venv_prod
     service uwsgi restart repoapi || true