Whonix minimal template?

Qubes-Whonix
#1

I am a fan of minimal templates 1 in Qubes OS, as it allows one-app-per-qube compartmentalization without extra overhead (RAM, disk usage, package count).

By “minimal” I consider all non-app-specific Whonix security/privacy/anti-fingerprinting features and maybe Tor Browser, as used in most cases.

Current approach is manual uninstall of packages:

apt purge youtube-dl qubes-core-agent-passwordless-root monero-gui thunderbird hexchat onionshare qtox xpdf vlc keepassxc mousepad ristretto libimage-exiftool-perl thunar gpa
rm -rf /usr/share/binaries-freedom/electrum-appimage/
apt autoremove

, which reduces size and packages considerably, but isn’t optimal. E.g. I am not sure, what libraries are required by “core” Whonix components, and surely forgot different packages.

qubes-template-whonix 2 seems to allow for custom installs, but by looking at the scripts, I did not find any config option concerning package inclusion.

Is there already a solution or recipe available for minimal Whonix-Workstation templates?

TIA for suggestions.

1 _https://www.qubes-os.org/doc/templates/minimal/
2 _https://github.com/QubesOS/qubes-template-whonix

#2

This might help:

Yeah. Currently not configurable.

But should be doable to add support for environment variables there.

No.

And quite unlikely to happen:

…unless contributed. For get started, a review of these ones would be useful:

#3

Done.

Untested.

And also usage, setting environment variables passed there by qubes-builder to qubes-template-whonix might be non-trivial (undocumented?). Unspecific to Whonix. Specific to qubes-builder.

#4

Thank you very much for the infos and the commit @Patrick .

…unless contributed.

Let me see what I can do. Need to dig in a bit further and do some more reading first.

By the way:
Your link about Whonix Debian packages has been very helpful. qubes-whonix-gateway and qubes-whonix-workstation were uninstalled in my VMs.

Reason is: I had done

sudo apt purge qubes-core-agent-passwordless-root

, which triggered:

The following packages will be REMOVED:
qubes-core-agent-passwordless-root*
qubes-whonix-shared-packages-recommended* qubes-whonix-workstation*

A warning in this docs might be useful, if not already happened.

#5

That’s what Debian Packages - Whonix is supposedly for.