Whonix-Host Operating System (OS) ISO

[Patrick]

Yay! Welcome back!

Whonix-Host Firewall is rather difficult to invent. → Whonix-Host KVM Firewall

Maybe now after working on other things I’ll have new inspiration.

@onion_knight

I will contact the debian-live team on Gitlab, see if they can help. I will post the link here once it’s posted.
EDIT: I cannot post any issue there, only pull requests.

They use mailing lists.

https://lists.debian.org/debian-live/

@onion_knight

n the meantime, if we want the EFI installation to work, we must add the modules
sources-media
and
sources-media-unmount
in /etc/calamares/settings.conf otherwise it will fail to download the package grub-efi-amd64 during the installation process and the installation will abort.
See pull request: Update settings.conf.dist by onions-knight · Pull Request #4 · Kicksecure/live-config-dist · GitHub

Merged. Now included in 15.0.1.5.2-developers-only.

A bit non-ideal to download during installation but we can perfect that later (somehow cache the package during build process).

EFI booting might be broken because of this. In a VM with grub-pc installed:

sudo apt install grub-efi-amd64

The following NEW packages will be installed:
efibootmgr grub-efi-amd64 grub-efi-amd64-bin grub-efi-amd64-signed mokutil shim-helpers-amd64-signed shim-signed shim-signed-common
shim-unsigned

Most of these packages seem to be Recommends:.

When using

sudo apt install grub-efi-amd64 --no-install-recommends

The following NEW packages will be installed:
grub-efi-amd64 grub-efi-amd64-bin

These Recommends: in Debian packaging terms might actually be required for successful EFI booting.

Since Whonix source code doesn’t mention grub-efi or other packages in the build script or in anon-meta-packages, I guess that could be why EFI booting is broken.