Whonix Linux Installer - Development Discussion

Patrick · February 17, 2023, 10:45am

https://manpages.debian.org/bullseye/curl/curl.1.en.html

–proto-default
Tells curl to use protocol for any URL missing a scheme name.

An unknown or unsupported protocol causes error CURLE_UNSUPPORTED_PROTOCOL (1).

This option does not change the default proxy protocol (http).

Without this option set, curl guesses protocol based on the host name, see –url for details.

–url
Specify a URL to fetch. This option is mostly handy when you want to specify URL(s) in a config file.

If the given URL is missing a scheme name (such as “http://” or “ftp://” etc) then curl will make a guess based on the host.

If you specify URL without protocol:// prefix, curl will attempt to guess what protocol you might want.

PROTOCOLS

curl supports numerous protocols, or put in URL terms: schemes. Your particular build may not support them all.

HTTP(S)
curl supports HTTP with numerous options and variations. It can speak HTTP version 0.9, 1.0, 1.1, 2 and 3 depending on build options and the correct command line options.

Looking at `curl --verbose’ it can also be seen that curl makes a difference for http vs https.

related:
https://phabricator.whonix.org/T673

Patrick · February 17, 2023, 10:49am

By looking at the old tickets at curl all of this seems to have improved. So when using https:// there’s no need to use --proto =https. Wiki updated.

Patrick · March 15, 2023, 6:19am

Patrick · March 18, 2023, 9:52am

new bug on Debian stable (currently: bullseye):

The following packages have unmet dependencies:
virtualbox : Depends: libtpms0 (>= 0.8.0~dev1) but it is not installable

Need to enable backports.

Does not happen on Kicksecure because Kicksecure enables the APT backports repository by default.

Patrick · March 18, 2023, 11:35am

Fixed. Along with other improvements.

Patrick · March 18, 2023, 11:35am

New version of Whonix Installer has been uploaded just now.

grass · March 18, 2023, 10:28pm

debian 11 vm.
on whonix, the problem doesn’t appear.

dpkg: dependency problems prevent configuration of virtualbox:
 virtualbox depends on virtualbox-dkms (>= 7.0.6-dfsg-1~fto11+1) | virtualbox-source (>= 7.0.6-dfsg-1~fto11+1) | virtualbox-modules; however:
  Package virtualbox-dkms is not configured yet.
  Package virtualbox-source is not installed.
  Package virtualbox-modules is not installed.
  Package virtualbox-dkms which provides virtualbox-modules is not configured yet.

dpkg: error processing package virtualbox (--configure):
 dependency problems - leaving unconfigured
Processing triggers for man-db (2.9.4-2) ...
Errors were encountered while processing:
 virtualbox-dkms
 virtualbox
E: Sub-process /usr/bin/dpkg returned an error code (1)

Patrick · March 19, 2023, 10:22pm

In a Qubes Debian VM or real Debian?

Assuming a Qubes Debian VM:
This is unfortunately an invalid test. In Qubes this is expected to fail. So the log above from what you pasted. It’s because DKMS is failing to compile the VirtualBox kernel module. And that is failing because the kernel in Qubes is “weird”. It’s the dom0 kernel. Not the VM kernel. That causes various issues including this one.

github.com/QubesOS/qubes-issues

Simplify and promote using in-vm kernel

opened 01:21PM - 01 Aug 19 UTC

marmarek

T: enhancement C: kernel C: doc P: major release notes security

**The problem you're addressing (if any)** Currently by default all qubes use k…ernel provided by dom0. This has multiple issues: - kernel build for dom0 environment has incompatible kernel-devel package (especially painful for Debian templates, but also an issue for different Fedora versions): #2844 #3835 - template doesn't control kernel options: #4088 - kernel config not necessary matching template expectation (https://github.com/QubesOS/qubes-linux-kernel/commit/96b8fba8769951659fb9413b1d50a7e2172b90dd) Using in-vm kernel isn't enabled by default and it's not straightforward: - for HVM, one needs to choose "(none)" / "" kernel - for PV, one needs to choose "pvgrub2" kernel - for PVH, one needs to choose "pvgrub2-pvh" kernel (only recently available) **Describe the solution you'd like** Unify setting in-vm kernel - possibly translate "(none)" to "pvgrub2" if virt_mode is PV and to "pvgrub2-pvh" if virt_mode is PVH. Note that "(none)" normally is an invalid choice for PV/PVH. This would require adjusting "(none)" label at UI level, to be less confusing/magic. Something like "(use kernel from within the qube)". Set is as default value. **Where is the value to a user, and who might that user be?** Less deviation from template's system, according to https://www.qubes-os.org/faq/#what-is-qubes-attitude-toward-changing-guest-distros **Possible drawbacks** This change may lead also to some issues: - less control over qube kernel means we won't be able to quickly apply qubes-specific fixes there - we'll need to wait until relevant distribution pick up updated kernel - less control over qube kernel config - for example if some kernel feature is disabled, we may have a problem - harder to provide extra kernel modules (fortunately we [don't need u2mfn in R4.1](https://github.com/QubesOS/qubes-issues/issues/4280) anymore) - different grub2 version - for example the one in Fedora is heavily patched and grub.cfg may rely on it (for example support for "Boot Loader Specification") **Describe alternatives you've considered** Implement automatic pvgrub choice for kernel "(none)", but don't set it as default. **Relevant [documentation](https://www.qubes-os.org/doc/) you've consulted** https://www.qubes-os.org/doc/managing-vm-kernel/

You’d have to use https://www.qubes-os.org/doc/managing-vm-kernels/#using-kernel-installed-in-the-vm.

Patrick · March 19, 2023, 10:35pm

Should the installer check if it’s run in Qubes and exit with an error or warn that this will likely fail unless using Qubes VM kernel?

Or we could go fancy and check similar as DKMS is doing this when it is saying:

It is likely that xxx.qubes.fc32.x86_64 belongs to a chroot’s host

Also the minimum RAM check might show a false positive warning because of Qubes dynamic RAM assignment. That test should then also be skipped in Qubes.

With these modifications, an installation of VirtualBox inside Qubes would probably succeed. But I didn’t test if any VMs could be actually started and I don’t know if anyone would want that. Maybe useful during development / for testing?

It might still be possible to install VirtualBox in a Qubes Debian VM. The VirtualBox kernel module and VirtualBox VMs would be broken but vboxmanage might be functional. I used this in the past to build Non-Qubes-Whonix from inside a Qubes VM. That might also be handy here for developer testing.

grass · March 20, 2023, 11:45pm

For testing on qubes, I use the dirty mode --allow-errors. But that is not “good” because I just want to skip the precheck, not all the errors.

It is, on whonix vms, it works, but I have to review. Vbox is installed. Of course it can’t start.

grass · March 21, 2023, 8:29pm

I am pushing to the master branch now.

grass · March 21, 2023, 8:31pm

It currently fails in some steps, I will see how to not fail on qubes…, although it might require dealing differently with a lot of the steps.

grass · March 27, 2023, 6:09pm

Disabling apt recommends has the effect of not installing the virtualbox graphical interface, more specifically, virtualbox-qt.

Edit: fixed and pushed.

grass · March 27, 2023, 6:34pm

Commits can be merge, tested with --onion and --proxy.

nyxnor · March 30, 2023, 2:25pm

The CI runs as root, it is broken now because root was blocked on the last commit. Fixing the CI.

nyxnor · March 31, 2023, 9:51am

Fixed build running as root.

Patrick · March 31, 2023, 8:23pm

CI still broken.

2023-03-31T08:47:09.4130706Z + sudo -- echo 'Successful root login'
2023-03-31T08:47:09.4131187Z installer-dist: [e[1me[32mNOTICEe[0m]: Executing: $ sudo -- echo Successful root login
2023-03-31T08:47:09.4191491Z 
2023-03-31T08:47:09.4191738Z We trust you have received the usual lecture from the local System
2023-03-31T08:47:09.4192125Z Administrator. It usually boils down to these three things:
2023-03-31T08:47:09.4192321Z 
2023-03-31T08:47:09.4192447Z     #1) Respect the privacy of others.
2023-03-31T08:47:09.4192690Z     #2) Think before you type.
2023-03-31T08:47:09.4192976Z     #3) With great power comes great responsibility.
2023-03-31T08:47:09.4193161Z 
2023-03-31T08:47:09.4193653Z sudo: a terminal is required to read the password; either use the -S option to read from standard input or configure an askpass helper
2023-03-31T08:47:09.4194198Z sudo: a password is required
2023-03-31T08:47:09.4200564Z + return 1
2023-03-31T08:47:09.4200940Z + die 1 'Failed to run test command as root.'
2023-03-31T08:47:09.4201477Z + log error 'Failed to run test command as root.'
2023-03-31T08:47:09.4201875Z + test 1 = 1

Needs setting up passwordless sudo.

(Based on Kicksecure /etc/sudoers.d/user-passwordless)

%sudo   ALL=(ALL:ALL) NOPASSWD:ALL

Probably needs to be setup by .github/workflows/builds.yml.

nyxnor · April 3, 2023, 3:30pm

Strange, I don’t know why your merge did not get my last commits, maybe you forgot to fetch them before merging?

Anyway, was trying to trigger the build not only when the installer is changed, but also when the workflow has changed:

github.com

nyxnor/usability-misc/blob/master/.github/workflows/builds.yml#L27-L30


      
          # needs: changes
          # if: ${{ (needs.changes.outputs.installer == 'true') }}
          # if: ${{ (needs.changes.outputs.builds == 'true') }}
          # if: ${{ (needs.changes.outputs.installer == 'true' || needs.changes.outputs.builds == 'true') }}

It eases testing and avoids making extraneous commits to the installer, but couldn’t get it to work last time, will try again.

nyxnor · April 3, 2023, 3:49pm

Fixed that problem with CI outputs.

Patrick · April 16, 2023, 11:32am

Uploaded new version just now.