Augsch123
commented
8 months ago I think distributing a salt file to configure a Qubes OS developing environment is better than maintaining and distributing a full template.
In fact I have made something for myself:
fed-min-qubes-dev.sls:
```
{% set fedoraver = salt['pillar.get']('fedoraver', 'fedora-38') %}
{% if grains['id'] == 'dom0' %}
ensure-{{ fedoraver }}-minimal-installed:
qvm.template_installed:
- name: {{ fedoraver }}-minimal
- fromrepo: qubes-templates-itl
create-{{ fedoraver }}-builder:
qvm.clone:
- name: {{ fedoraver }}-builder
- source: {{ fedoraver }}-minimal
- require:
- qvm: ensure-{{ fedoraver }}-minimal-installed
create-qubes-builder-dvm:
qvm.vm:
- name: qubes-builder-dvm
- present:
- template: {{ fedoraver }}-builder
- label: red
- prefs:
- virt_mode: pvh
- label: red
- template-for-dispvms: true
- memory: 800
- maxmem: 8000
- vcpus: 6
- require:
- qvm: create-{{ fedoraver }}-builder
create-qubes-work:
qvm.vm:
- name: qubes-work
- present:
- template: {{ fedoraver }}-builder
- label: red
- prefs:
- virt_mode: pvh
- label: red
- memory: 400
- maxmem: 1000
- default-dispvm: qubes-builder-dvm
- require:
- qvm: create-qubes-builder-dvm
resize-builder-volume:
cmd.run:
- name: qvm-volume resize qubes-builder-dvm:private 32212254720 ;qvm-volume resize qubes-work:private 32212254720
builder-policy:
file.managed:
- name: /etc/qubes/policy.d/30-qubesbuilder.policy
- contents: |
admin.vm.CreateDisposable * qubes-work qubes-builder-dvm allow target=dom0
admin.vm.Start * qubes-work @tag:disp-created-by-qubes-work allow target=dom0
admin.vm.Kill * qubes-work @tag:disp-created-by-qubes-work allow target=dom0
qubesbuilder.FileCopyIn * qubes-work @tag:disp-created-by-qubes-work allow
qubesbuilder.FileCopyOut * qubes-work @tag:disp-created-by-qubes-work allow
qubes.Filecopy * qubes-work @tag:disp-created-by-qubes-work allow
qubes.WaitForSession * qubes-work @tag:disp-created-by-qubes-work allow
qubes.VMShell * qubes-work @tag:disp-created-by-qubes-work allow
{% elif grains['id'] == [fedoraver, '-builder']|join %}
update:
cmd.run:
- name: dnf install -y qubes-core-agent-networking qubes-core-agent-passwordless-root qubes-core-agent-thunar xfce4-terminal unzip wqy-microhei-fonts python3-packaging createrepo_c devscripts gpg python3-pyyaml rpm reprepro python3-pathspec mktorrent rpm-sign tree mock openssl python3-jinja2-cli m4 asciidoc rsync qubes-gpg-split dnf-plugins-core debootstrap dpkg-dev git mock pbuilder which perl-Digest-MD5 perl-Digest-SHA python3-sh rpm-build rpmdevtools wget python3-debian python3-lxml systemd-udev python3-click qubes-gpg-split
{% elif grains['id'] == 'qubes-builder-dvm' %}
builderdirectory:
cmd.run:
- name: mkdir -p /rw/bind-dirs/builder /rw/config/qubes-bind-dirs.d ; echo "binds+=('/builder')" > /rw/config/qubes-bind-dirs.d/builder.conf ;
appendrc:
file.append:
- name: /rw/config/rc.local
- text: mount /builder -o dev,suid,remount
{% elif grains['id'] == 'qubes-work' %}
git-fetch:
cmd.run:
- name: cd /home/user ; git clone https://github.com/QubesOS/qubes-infrastructure-mirrors ; git clone /https://github.com/QubesOS/qubes-builderv2
- runas: user
install-infrastructure:
cmd.run:
- name: cd /home/user/qubes-infrastructure-mirrors ; python3 setup.py build ; python3 setup.py install
{% endif %}
```
fed-min-qubes-dev.top:
```
{% set fedoraver = salt['pillar.get']('fedoraver', 'fedora-38') %}
user:
dom0 or {{ fedoraver }}-builder or qubes-builder-dvm or qubes-work:
- fed-min-qubes-dev
```
So this basically creates a template fedora-38-builder and configures it to be able to work as both the actual qubes executor and where qubes-builderv2 locates. And it creates qubes-builder-dvm which is the executor, and qubes-work which is where you work with the source code and issue commands to build the packages.
Update: Fixed the top file.
Update2: Fixed the sls file.
Update3: Keep up with builderv2 code changes.
ddevz
tlaurion
andrewdavidwong
ben-grande
antler5
How to file a helpful issue
The problem you're addressing (if any)
When following the "qubes builder" instructions at https://www.qubes-os.org/doc/qubes-builder/ (and therefore https://www.qubes-os.org/doc/qubes-iso-building/) and it does not work (one example would be aborting the build with
make[1]: *** [Makefile:74: linux-6.1.62.tar.UNTRUSTED] Error 1), it is not obvious if it is because the version of fedora you chose is not in sync with the version of qubes-builder you are using. (For example, you could be using a new version of fedora that hasn't been tested with the build process yet). It is also not obvious if the part of the instructions which mentions fedora versions is out of date.The solution you'd like
Distribute the build environment needed to run qubes builder without error. One option would be to make a template for "qubes builder" which allows people to install with something like:
sudo qubes-dom0-update qubes-template-qubes-builderThe value to a user, and who that user might be
Easier way to figure out the build process for the first time. Easier way for people to build the non-distributed templates (example: ubuntu)