modify apt-get parameters during build to prevent need to remove apt-listchanges

[phabricator-migrator]

Information

ID: 282
PHID: PHID-TASK-qpwj2elr2cmbgvpmjsc5
Author: Patrick
Status at Migration Time: resolved
Priority at Migration Time: Normal

Description

! In T278#4002, @nrgaway wrote:
Since I ran whonix_build next after debootstrap I did not have to uninstall apt-listchanges. I mention this since you may want to consider modifying your apt-get parameters to some of the ones I use that prevent the need to uninstall apt-listchanges:

DEBIAN_FRONTEND="noninteractive" DEBIAN_PRIORITY="critical" DEBCONF_NOWARNINGS="yes" \
        chroot apt-get ${APT_GET_OPTIONS} install ${files[@]}

Comments

---

Patrick

2015-04-27 14:57:58 UTC

Environment DEBIAN_FRONTEND="noninteractive" was already the case.

Added to environment:

DEBIAN_PRIORITY="critical"
DEBCONF_NOWARNINGS="yes"

added environment variables DEBIAN_PRIORITY="critical" and DEBCONF_NOWARNINGS="yes" as suggested by @nrgaway - https://phabricator.whonix.org/T282:
https://github.com/Whonix/Whonix/commit/bf74cf3353e88a8a503b959dadd9ecb44d980288

---

What’s inside the APT_GET_OPTIONS variable?

Are there any other missing parameters you recommend adding, @nrgaway?

---

nrgaway

2015-04-27 21:24:34 UTC

! In T282#4029, @Patrick wrote:
Environment DEBIAN_FRONTEND="noninteractive" was already the case.

Added to environment:

DEBIAN_PRIORITY="critical"
DEBCONF_NOWARNINGS="yes"

added environment variables DEBIAN_PRIORITY="critical" and DEBCONF_NOWARNINGS="yes" as suggested by @nrgaway - https://phabricator.whonix.org/T282:
https://github.com/Whonix/Whonix/commit/bf74cf3353e88a8a503b959dadd9ecb44d980288

---

What’s inside the APT_GET_OPTIONS variable?

Are there any other missing parameters you recommend adding, @nrgaway?

The options are fairly basic…

# ------------------------------------------------------------------------------
# apt-get configuration options
# ------------------------------------------------------------------------------
APT_GET_OPTIONS="-o Dpkg::Options::="--force-confnew" --force-yes --yes"

containsFlavor 'no-recommends' && {
    APT_GET_OPTIONS+=" -o APT::Install-Recommends=0  -o APT::Install-Suggests=0" 
} || true

---

Patrick

2015-04-27 22:53:53 UTC

Okay, so let’s go through this one by one.

• Combination of --force-yes and --yes is insecure. Reported a bug: Redirecting to Google Groups (I know that you already know this, because you answered on the mailing list, but I am speaking so that any technical person can track this, and to keep a record for later.)
• --yes: using that already
• -o APT::Install-Recommends=0 using the equivalent --no-install-recommends already
• -o APT::Install-Suggests=0 that’s the default anyhow [and very unlikely to change in Debian, I think), so it it is superfluous, not making a difference, not using it
• -o Dpkg::Options::="--force-confnew": This is TODO. Need to think about that one.

---

nrgaway

2015-04-28 02:43:25 UTC

-o Dpkg::Options::="--force-confnew": This is TODO. Need to think about that one.

You may not need that one. Qubes over-rides 2 configuration files so it is required for unattended installations of initially creating the templates.

The option does show an indication that it replaced a configuration file and also backs up the old one.

---

Patrick

2015-04-28 18:46:19 UTC

Yes. I’d rather not add -o Dpkg::Options::="--force-confnew" if not needed, because also whonix-developer-meta-files/debug-steps/locally-upgrade-whonix-debian-packages uses help-steps/variables. Easier code and less to think through. We can still do it if needed one day.

I’ve succeeded with a build where apt-listchanges was installed by default. It went through without any interactive questions.

Just to make sure, added another environment variable.
add APT_LISTCHANGES_FRONTEND="text" to environment during build - https://phabricator.whonix.org/T282:
https://github.com/Whonix/Whonix/commit/38301f244d0c709fe5fe57c7b079d947ea61f14b

Everything done here? This one should be closeable?

---

nrgaway

2015-04-28 21:22:02 UTC

Great. Will this be part of Whonix 10?

---

Patrick

2015-04-28 21:56:47 UTC

No.

---

Patrick

2015-04-28 21:57:08 UTC

Whonix 10 is out. Will be part of Whonix 11.