Whonix Host Calamares Branding Suggestion

Development
, ,
1

By default, we use the default branding of Calamares installer for Debian derivatives (as provided by calamares-settings-debian package):

11
111020×763 286 KB

12
121018×570 61.4 KB

13
131017×614 49.2 KB

Fortunately, this is easily configurable:

14
141021×752 286 KB

15
151024×766 93.1 KB

16
161025×764 75.9 KB

What do you think?
I would gladly upload configuration files and pictures on github if needed.

1 Like
2

Yes, much better than default! (Default could even annoy Debian if someone confuses Debian for Whonix.)

Since we put calamares config files into this package too, please add modifications here too:
GitHub - Kicksecure/libvirt-dist: Libvirt XML Files for Derivative Linux Distributions KVM - https:/www.kicksecure.com/wiki/KVM / https://www.whonix.org/wiki/KVM

(I will answer the other thread when I get to it. Done fixing the root/sudo related bugs. Will commit soon.)

3

All right, I have forked the repository and will make a pull request once it is done.
Thanks for your feedback.

2 Likes
5

(Sorry for the deleted post, I pushed the reply button too quickly)

OK, so I’ve uploaded everything on GitHub.

I haven’t made a pull request yet, some explanations first

It is my understanding that most if not all files and settings related to branding with debian live systems are taken care of by calamares-settings-debian package. So we have to modify some of these files for Whonix branding:

root@host:~# dpkg-query -L calamares-settings-debian
/.
/etc
/etc/calamares
/etc/calamares/branding
/etc/calamares/branding/debian
/etc/calamares/branding/debian/branding.desc
/etc/calamares/branding/debian/debian-logo.png
/etc/calamares/branding/debian/show.qml
/etc/calamares/branding/debian/slide1.png
/etc/calamares/branding/debian/welcome.png
/etc/calamares/modules
/etc/calamares/modules/bootloader.conf
/etc/calamares/modules/finished.conf
/etc/calamares/modules/fstab.conf
/etc/calamares/modules/luksopenswaphookcfg.conf
/etc/calamares/modules/machineid.conf
/etc/calamares/modules/mount.conf
/etc/calamares/modules/packages.conf
/etc/calamares/modules/unpackfs.conf
/etc/calamares/modules/users.conf
/etc/calamares/modules/welcome.conf
/etc/calamares/settings.conf
/etc/xdg
/etc/xdg/autostart
/etc/xdg/autostart/calamares-desktop-icon.desktop
/usr
/usr/bin
/usr/bin/add-calamares-desktop-icon
/usr/bin/install-debian
/usr/lib
/usr/lib/calamares
/usr/lib/calamares/modules
/usr/lib/calamares/modules/bootloader-config
/usr/lib/calamares/modules/bootloader-config/module.desc
/usr/lib/calamares/modules/sources-final
/usr/lib/calamares/modules/sources-final/module.desc
/usr/lib/calamares/modules/sources-media
/usr/lib/calamares/modules/sources-media/module.desc
/usr/lib/calamares/modules/sources-media-unmount
/usr/lib/calamares/modules/sources-media-unmount/module.desc
/usr/sbin
/usr/sbin/bootloader-config
/usr/sbin/sources-final
/usr/sbin/sources-media
/usr/share
/usr/share/applications
/usr/share/applications/install-debian.desktop
/usr/share/doc
/usr/share/doc/calamares-settings-debian
/usr/share/doc/calamares-settings-debian/changelog.Debian.gz
/usr/share/doc/calamares-settings-debian/copyright
/usr/share/glib-2.0
/usr/share/glib-2.0/schemas
/usr/share/glib-2.0/schemas/96_calamares-settings-debian.gschema.override
/usr/share/lintian
/usr/share/lintian/overrides
/usr/share/lintian/overrides/calamares-settings-debian
/usr/share/pixmaps
/usr/share/pixmaps/install-debian.png

First, we need to modify the branding line in the file /etc/calamares/settings.conf from “debian” to “whonix”
https://github.com/onions-knight/whonix-libvirt/blob/master/etc/calamares/settings.conf

Then, we create a whonix directory in /etc/calamares/ and add our own files (we don’t need to modify anything, as the branding entry in /etc/calamares/settings.conf file will automatically point to our new directory whonix):

https://github.com/onions-knight/whonix-libvirt/tree/master/etc/calamares/branding/whonix

Last thing is to take care of the Calamares Installer icon on the desktop (named “Debian Installer” by default).

To do that, at least the following files must be modified/replaced:

/usr/share/pixmaps/install-debian.png
/usr/share/applications/install-debian.desktop
/usr/bin/add-calamares-desktop-icon

I have made the necessary changes in the files and changed their filenames when needed (replaced debian by whonix). I hope it won’t cause confusion:

/usr/share/pixmaps/install-debian.png → renamed to /usr/share/pixmaps/install-whonix.png whonix-libvirt/usr/share/pixmaps at master · onions-knight/whonix-libvirt · GitHub

/usr/share/applications/install-debian.desktop → renamed to /usr/share/applications/install-whonix.desktop https://github.com/onions-knight/whonix-libvirt/blob/master/usr/share/applications/install-whonix.desktop’

But now I am thinking, maybe a cleaner option would be to get rid of calamares-settings-debian altogether and create a package calamares-settings-whonix instead with our own configuration files? :slight_smile:

1 Like
6

onion_knight via Whonix Forum:

root@host:~# dpkg-query -L calamares-settings-debian

or: apt-file list calamares-settings-debian

/.
/etc
/etc/calamares

Yes, we need a basic understanding of these files file by file. See what we can leave out and see what we need to emulate.

For example /etc/apt/sources.list handling is already done by Whonix and /usr/sbin/sources-final etc. can cause issues or needs to be disabled.

But now I am thinking, maybe a cleaner option would be to get rid of calamares-settings-debian altogether

Very, very worthwhile to consider.

and create a package calamares-settings-whonix instead with our own configuration files? :slight_smile:

Yes. Either a new package calamares-settings-whonix or existing package whonix-libvirt.

calamares-settings-whonix is slightly cleaner but yet another package. Maybe justified by the complexity of this. Has an advantage if someone later wants to implement Whonix Host VirtualBox.

Is there some way we could reuse that calamares-settings-whonix package also for “hardened debian”? Some more generic name?

On the other hand /etc/calamares/modules and /usr/lib/calamares/modules/bootloader-config folders contains sufficient complexity which we don’t want to understand in detail / maintain / update/compare from buster+1 release upgrade.

Hard decision. On first sight it looks like in this case it is better to curb the calamares-settings-debian package.

I could config-package-dev hide /etc/calamares/branding/debian/branding.desc. (May not even be required, see below.) (Or all files in /etc/calamares/branding/ folder although may not be necessary.)

Our /etc/calamares/settings.conf could change branding: debian to branding: whonix (or more generic name).

Or if we don’t need to make any changes to /etc/calamares/settings.conf besides that we could instead config-package-dev displace /etc/calamares/branding/debian/branding.desc with our own config.

There is probably no need to curb files such as /etc/calamares/branding/debian/debian-logo.png if our forked “/etc/calamares/branding/debian/branding.desc” no longer uses string debian-logo.png but rather our own image.

Summary best way forward as far as I can see for now:

  • Add /etc/calamares/branding/debian/branding.desc and Whonix branding images to package whonix-base-files. (“hardened debian” can later use its own branding.)
  • Create a new package calamares-settings-dist (generic name, later erusable by “hardened debian”). (Or just the files and folders. I can add the /debian folder soon after.) Add any non-branding file we need to modify there.
  • If you want to overwrite a file owned by calamares-settings-debian: just add it to the package. I will add a config-package-dev displace.
  • If you want to remove a file owned by calamares-settings-debian: just let me know. I will add a config-package-dev hide.
7

Ok, I’ll see what I can do (hope it’s not too much work as I don’t have that much free time).

1 Like
8

First thing first…
What name do we choose for “Whonix Host”?
I like “Whonix Desktop”
Or do we keep “Kicksecure”?

1 Like
9

Whonix-Host

(Including the dash -.)

The dash is for consistency with other names Whonix-Gateway, Whonix-Workstation.

Whonix-Host, Whonix-Gateway, Whonix-Workstation

That would be good if Whonix was a new project which wouldn’t have a history of being known as VM focused and no own host operating system. Then we could have Whonix Deskop and maybe later also Whonix Server or even Whonix Enterprise.

For now I think Whonix Desktop would be often misunderstood as “the Whonix desktop inside a Whonix VM”. Discussions are still repeating the old state of things and not mentioning “you can install a host operating system on USB and then install Whonix” or Live Mode for Kicksecure.

For sure not since that branding is Kicksecure ™: A Security-hardened, Non-anonymous Linux Distribution. Independent of Whonix. One day there will be probably its own domain kicksecure.com and there would be no dependency on Whonix. The only connection being that Whonix is based on Kicksecure.

1 Like
10

There you go, file by file:

/etc/calamares/branding
/etc/calamares/branding/debian
/etc/calamares/branding/debian/branding.desc
/etc/calamares/branding/debian/debian-logo.png
/etc/calamares/branding/debian/show.qml
/etc/calamares/branding/debian/slide1.png
/etc/calamares/branding/debian/welcome.png

→ branding config files and directory, these files need to be replaced/modified by whonix-host version (very easy, it’s ready on my end)

/etc/calamares/modules
/etc/calamares/modules/bootloader.conf
/etc/calamares/modules/finished.conf
/etc/calamares/modules/fstab.conf
/etc/calamares/modules/luksopenswaphookcfg.conf
/etc/calamares/modules/machineid.conf
/etc/calamares/modules/mount.conf
/etc/calamares/modules/packages.conf
/etc/calamares/modules/unpackfs.conf
/etc/calamares/modules/users.conf
/etc/calamares/modules/welcome.conf

→ modules used during the installation sequence. We don’t use all of them, we can get rid of the unnecessary ones or just let them live there (maybe better in case we want to add/modify stuff later)

/etc/calamares/settings.conf
→ general calamares installation settings. We already have our modified version. See https://github.com/Whonix/whonix-libvirt/blob/master/etc/calamares/settings.conf

/etc/xdg/autostart/calamares-desktop-icon.desktop
→ shell script to add the Install-Whonix (Calamares launcher) on the desktop. We need it, but we don’t need to modify it.

/usr/bin/add-calamares-desktop-icon
/usr/bin/install-debian

→ two simple shell scripts related to Calamares desktop launcher (see above). Need to be modified/renamed (replacing ‘debian’ by ‘Whonix-Host’. images, etc.).

/usr/lib/calamares/modules/bootloader-config
/usr/lib/calamares/modules/bootloader-config/module.desc
/usr/lib/calamares/modules/sources-final
/usr/lib/calamares/modules/sources-final/module.desc
/usr/lib/calamares/modules/sources-media
/usr/lib/calamares/modules/sources-media/module.desc
/usr/lib/calamares/modules/sources-media-unmount
/usr/lib/calamares/modules/sources-media-unmount/module.desc

→ Calamares installation sequence modules. We may not need all of them, but we can as well let them live there (same as with /etc/calamares/modules).

/usr/sbin/bootloader-config
/usr/sbin/sources-final
/usr/sbin/sources-media

→ also configuration files for Calamares installer. Same remark as above.

/usr/share/applications/install-debian.desktop

→ config file for desktop launcher. Needs to be modified and renamed.

/usr/share/doc/calamares-settings-debian/changelog.Debian.gz
/usr/share/doc/calamares-settings-debian/copyright

→ debian doc/copyright files. Do we need to modify them?

/usr/share/glib-2.0/schemas/96_calamares-settings-debian.gschema.override
→ gnome shell config file. Don’t know whether it is used now or not?

# Launcher icons
[org.gnome.shell]
favorite-apps=['install-debian.desktop', 'firefox-esr.desktop', 'org.gnome.Evolution.desktop', 'rhythmbox.desktop', 'libreoffice-writer.desktop', 'org.gnome.Nautilus.desktop', 'org.gnome.Software.desktop', 'yelp.desktop']

# We don't want the screensaver to enable on the live media while installing
[org.gnome.desktop.lockdown]
disable-lock-screen=true

[org.gnome.desktop.session]
idle-delay=0

/usr/share/lintian/overrides/calamares-settings-debian
→ debian package related files. No idea.

# Only meant to be run by calamares, so its scripts wouldn't have manpages
calamares-settings-debian: binary-without-manpage

# We don't provide this file on purpose
calamares-settings-debian: diversion-for-unknown-file

/usr/share/pixmaps/install-debian.png
→ icon for Calamares desktop launcher. Needs to be replaced/renamed.

1 Like
11

Tell me how do you want to proceed next and I’ll launch the pull requests :slight_smile:

2 Likes
12

Yes. Please overwrite.
(I’ll sort out the config-package-dev displace if needed/not included.)

Yes. Just leave them there. Deleting them is actually more complicated (in case of later resurrection.)

OK.

Yes.
As long as these are not auto used? I guess these are not auto used since our config excludes these?

Yes.

Please add a new one.

/usr/share/applications/install-debian.desktop can be a config-package-dev hide. I could do that.

No need to modify.

Please copy/paste that file into the repository. I will modify on top.
(It sets favorite-apps - we don’t want that.)

Just lintian (a package sanity checker). No need to do anything.

Could you please modify config to point to some file included in anon-icon-pack?

Same about the other png’s in branding folder? Unless that looks much more difficult/hard to maintain.

Yes, please! :slight_smile:

13

All clear, then if you don’t mind I will upload/modify files in /Whonix/whonix-libvirt/ git repository and let you sort it out.

I wouldn’t know how to do it.

2 Likes
14

Yes. Please add to git. I’ll sort out any file conflicts.

me wrote:

Could you please modify config to point to some file included in anon-icon-pack?

Seems not possible.

Seems good.

Yes.

Rename in config file better.

15

see pull request

Hope it’s not too messy…
I’ll test it again once it’s merged/

You may also want to have a closer look at /usr/bin/install-whonix-host, which is the wrapper that invokes Calamares (when one clicks on the install icon on the desktop. It’s the default calamares-settings-debian version, I just changed the name debian → Whonix-Host).

#!/bin/sh
###
# Wrapper for running calamares on Whonix-Host live media
###

# Stale file left behind by live-build that messes with partitioning
sudo mv /etc/fstab /etc/fstab.orig.calamares

# Access control to run calamares as root for xwayland
xhost +si:localuser:root
pkexec calamares
xhost -si:localuser:root

# Restore stale fstab, for what it's worth
sudo mv /etc/fstab.orig.calamares /etc/fstab
1 Like
16

All merged. Looks really good in theory. But untested. Added some git commits on top (config-package-dev, overwrite files owned by other packages). Could you please review the commit history? Let me know if there are any package installation issues or if any more files should be hidden.

17

Even if not using gnome shell, these files configure gnome apps. I think the way this works is that the config copiles to a gschema file which is then used by gnome applications. Since we don’t want to do what that file implements (and less so we want that to leak into the installed system), I added a config-package-dev hide just now.

18

Great. Tested here:

1 Like
19

Simple Whonix-Host new visual suggestion:

  • Default desktop image changed to white-greyish color
  • Desktop icons: home, file system, trash, mounted devices
  • Xfce4-panel up, not down (also helps differentiating from Whonix gw and ws).

Thoughts?

30
301023×769 42.8 KB

1 Like
20

Looks good!

Would be useful for both gateway and host? I.e. different settings for workstation. Or better different background image everywhere, gateway, workstation, host?

New package required? Or fits elsewhere? Ideally we won’t be inventing 3 new packages.
maybe…
anon-ws-base-files
anon-gw-base-files

Can you create these settings files? I think described somewhere in forums how to invent these.

21

Setting files are here, right?
https://github.com/Whonix/whonix-xfce-desktop-config/tree/master/etc/skel/.config/xfce4

I don’t know how you wish to integrate it in your code, but I guess there will be some kind of check whether running ws, gw or host and based on that right setting files would apply during build?

Yes, I think ideally we should at least slightly differentiate between the gw and the ws. Could be enough to change Desktop background images.

What I could already do is upload new skel setting files on github and then you could have a look and see how it best fits.

1 Like