Sets apt hold on firefox in dev and staging environments

Changes in #1445 forced installation of a specific version of Firefox,
which caused tests to fail since not all packages were updated.
Carefully modified the tests to permit either "0" or "1" packages not
upgraded.

install_files/ansible-base/roles/app-test/tasks/dev_setup_xvfb_for_functional_tests.yml

@@ -50,6 +50,13 @@
   tags:
     - apt
 
+- name: Set apt hold on Firefox version.
+  command: apt-mark hold firefox
+  register: apt_hold_firefox_result
+  # apt-mark will return output to report changed status; subsequent runs
+  # will report "firefox was already set on hold."
+  changed_when: "'firefox set on hold' in apt_hold_firefox_result.stdout"
+
 - name: Copy xvfb init script.
   copy:
     src: xvfb

spec_tests/spec/common/cron_apt_spec.rb

@@ -86,7 +86,9 @@
 describe command('aptitude --simulate -y safe-upgrade') do
   its(:exit_status) { should eq 0 }
   its(:stdout) { should match /^No packages will be installed, upgraded, or removed\.$/ }
-  its(:stdout) { should match /0 packages upgraded, 0 newly installed, 0 to remove and 0 not upgraded\./ }
+  # Temporarily allowing "1 not upgraded" since we're pinning a version of firefox
+  # known to work well with our version of selenium; see #1445.
+  its(:stdout) { should match /^0 packages upgraded, 0 newly installed, 0 to remove and [01] not upgraded\.$/ }
 end
 
 # TODO: In order to validate the intended system state post-provisioning,

spec_tests/spec/grsecurity/grsec_spec.rb

@@ -96,7 +96,9 @@
 
 # ensure old packages have been autoremoved
 describe command('apt-get --dry-run autoremove') do
-  its(:stdout) { should match /^0 upgraded, 0 newly installed, 0 to remove and 0 not upgraded\.$/ }
+  # Temporarily allowing "1 not upgraded" since we're pinning a version of firefox
+  # known to work well with our version of selenium; see #1445.
+  its(:stdout) { should match /^0 upgraded, 0 newly installed, 0 to remove and [01] not upgraded\.$/ }
   its(:exit_status) { should eq 0 }
 end