Goldeneye128 - Simple script to build whonix on a mac with apple silicon

[Patrick]

• 1. I highly recommend using shellcheck. Available from packages.debian.org.
• 2. Also shell options.

set -e
set -o errexit
set -o nounset
set -o errtrace
set -o pipefail

• 3. And trap ERR.
• That’s how I would start nowadays with the knowledge I didn’t have back then.

ChatGPT is capable of explaining all of these. I’d look them up in ChatGPT and then confirm with authoritative sources.

@Goldeneye128

Also not sure if i will do the automatic verification, but rather have a output with a text directing to the whonix wiki Signing_Key page. So people can do that after?

Yes.

@Goldeneye128

as a output on the build-log so that its included there at least?

Yes.

Well, but the problem is, instead of verifying the real thing (derivative-maker), users would now have to download, trust and use a script to do that.

Even as the script is now in its early stages. Users are unable to audit it. So users would have to verify the script itself. Back to square one. Trying to square a circle so to speak.

If it was possible to have such a script, then that would also raise the issue why isn’t that provided by upstream?

Check out Whonix Linux Installer for VirtualBox. Not for the purpose of using VirtualBox. No need to actually run it. Just to show the usability as simplified as we managed to make it. Related:

• Whonix Linux Installer - Development Discussion
• Kicksecure Linux Installer - Design Documentation

Just 1 script that users can download (and verify) which takes care of downloading, verification, installing Whonix on Linux distributions.

With verify, verification referring to digital software signature verification.

@Goldeneye128

Another thing i was thinking about, but here i wanna hear what people think. For now i have downloaded the repository with a depth of 1 and with shallow submodules. Basically a smaller shallow repository. This is well and all when building from one tag. But i was considering having it all unshallow. So i can make it so that when passing no arguments. It will build from the latest tag available

When you do a normal clone you end up with git head, which is most likely not a (stable) git tag.

A normal clone is fine but to build a git tag, a git tag needs to get checked out.

---

unanswered questions: Dunno. I would have to test this myself to know. It’s a bit similar to driving a car. I can use git but not really explain “after 30 seconds, move the steering wheel by 35 degree”.