Whonix minimal template?

Qubes-Whonix
1

I am a fan of minimal templates 1 in Qubes OS, as it allows one-app-per-qube compartmentalization without extra overhead (RAM, disk usage, package count).

By “minimal” I consider all non-app-specific Whonix security/privacy/anti-fingerprinting features and maybe Tor Browser, as used in most cases.

Current approach is manual uninstall of packages:

apt purge youtube-dl qubes-core-agent-passwordless-root monero-gui thunderbird hexchat onionshare qtox xpdf vlc keepassxc mousepad ristretto libimage-exiftool-perl thunar gpa
rm -rf /usr/share/binaries-freedom/electrum-appimage/
apt autoremove

, which reduces size and packages considerably, but isn’t optimal. E.g. I am not sure, what libraries are required by “core” Whonix components, and surely forgot different packages.

qubes-template-whonix 2 seems to allow for custom installs, but by looking at the scripts, I did not find any config option concerning package inclusion.

Is there already a solution or recipe available for minimal Whonix-Workstation templates?

TIA for suggestions.

1 Minimal templates | Qubes OS
2 GitHub - QubesOS/qubes-template-whonix

2 Likes
2

This might help:

Yeah. Currently not configurable.

But should be doable to add support for environment variables there.

No.

And quite unlikely to happen:

…unless contributed. For get started, a review of these ones would be useful:

1 Like
3

Done.

Untested.

And also usage, setting environment variables passed there by qubes-builder to qubes-template-whonix might be non-trivial (undocumented?). Unspecific to Whonix. Specific to qubes-builder.

4

Thank you very much for the infos and the commit @Patrick .

…unless contributed.

Let me see what I can do. Need to dig in a bit further and do some more reading first.

By the way:
Your link about Whonix Debian packages has been very helpful. qubes-whonix-gateway and qubes-whonix-workstation were uninstalled in my VMs.

Reason is: I had done

sudo apt purge qubes-core-agent-passwordless-root

, which triggered:

The following packages will be REMOVED:
qubes-core-agent-passwordless-root*
qubes-whonix-shared-packages-recommended* qubes-whonix-workstation*

A warning in this docs might be useful, if not already happened.

5

That’s what Debian Packages - Whonix is supposedly for.

6

I’m sorry to revive this thread, but I wanted to see if there has been any progress towards building a minimal Whonix template for Qubes?

7

I am not aware of any.

8

You mention POWER9 and similar - things that require adding stuff, not removing existing stuff.
The current issue is not about adding stuff but about the opposite - not adding it by default.

Unimportant detail and depending on viewpoint what is add vs remove. Adding/removing doesn’t change anything about what I said above.

It’s kinda also adding new stuff, that is a new build target and a different package selection.

“Removing” vs “adding” isn’t more complicated, doesn’t result in more questions just because of “removing” vs “adding”.

For example, debian-12-minimal differs from debian-12-xfce by the later having additional packages installed. The later is built from the former, so the xfce version is just a few more steps made after the minimal. Don’t do the extra steps and you have a minimal template.

This would be kinda similar here.

Considering Whonix is based on Debian, what is the great difference?

Does it not start from Debian minimal?

It does.

Is it not possible to simply install only Whonix specific packages in Debian minimal (I assume e.g. Thunderbird is not one of them, as one can remove it and still use Whonix)?

Possible.