Qubes-Whonix build process: install Whonix from Whonix binary APT repository

phabricator-migrator · February 19, 2024, 5:46pm

Information

ID: 498
PHID: PHID-TASK-z34pduokddun6crn65lr
Author: Patrick
Status at Migration Time: resolved
Priority at Migration Time: Normal

Description

advantages:

simpler #qubes-template-whonix code
faster builds, packages no longer need to be build during Qubes-Whonix template build
build dependencies will no longer be installed inside the template
** therefore smaller template sizes
*** therefore less space issues on Qubes installer DVD
solves T416 for free
simpler than trying to have Qubes builder create Whonix packages (T438 ?)

disadvantages:

building Whonix templates with Whonix packages build from source code gets harder

T461

Comments

Patrick

2016-04-19 22:21:37 UTC

Qubes-Whonix build process: install Whonix from Whonix binary APT repository

https://phabricator.whonix.org/T498
Qubes-Whonix build process: install Whonix from Whonix binary APT rep… · adrelanos/qubes-template-whonix@b7b83fe · GitHub

(I will clean up all the comments and todo soon.)

Please have a glimpse if the current 04_install_qubes_post.sh goes into the direction you imagined. @marmarek

04_install_qubes_post.sh:
qubes-template-whonix/whonix-gateway/04_install_qubes_post.sh at b7b83fee56d72abb69617bd8bc8deda239f29ae7 · adrelanos/qubes-template-whonix · GitHub

marmarek

2016-04-19 22:40:24 UTC

Patrick

2016-04-21 04:37:52 UTC

It’s done.

qubes-template-whonix/whonix-gateway/04_install_qubes_post.sh at master · adrelanos/qubes-template-whonix · GitHub

qubes-template-whonix/whonix-gateway/09_cleanup_post.sh at master · adrelanos/qubes-template-whonix · GitHub

As for building Qubes-Whonix templates with Whonix packages build from source…

It would help if Qubes builder worked on top of Debian. (#1907)

Then one could create a local repository of all Whonix packages (using Whonix build script).

By setting whonix_signing_key_fingerprint to none would results into not adding any signing key.

Alternatively, a signing key of ones choice could be added.

As for getting the local packages into the repository, that is not that simple.
** Either one would have to upload them to some remote repository and set a custom whonix_repository_uri.
** Or run a local web server and something like whonix_repository_apt_line="[trusted=yes] deb 127.0.0.1/... jessie main".
** whonix_repository_apt_line="[trusted=yes] deb file:/... jessie main" and then somehow get the local repository mounted inside the chroot. Perhaps by hacking 04_install_qubes_post.sh.