From ab933ae0a7decca01bda2dcd4311ca5bc7a467e0 Mon Sep 17 00:00:00 2001
From: Joanna Rutkowska <joanna@invisiblethingslab.com>
Date: Sat, 22 Nov 2014 14:01:49 +0000
Subject: [PATCH] QubesR3Building changed

Initial version
---
 QubesR3Building.md | 49 ++++++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 49 insertions(+)
 create mode 100644 QubesR3Building.md

diff --git a/QubesR3Building.md b/QubesR3Building.md
new file mode 100644
index 00000000..9d245b2a
--- /dev/null
+++ b/QubesR3Building.md
@@ -0,0 +1,49 @@
+---
+layout: wiki
+title: QubesR3Building
+permalink: /wiki/QubesR3Building/
+---
+
+Building Qubes OS 3.0 ISO
+=========================
+
+Get the necessary keys to verify the sources:
+
+``` {.wiki}
+$ wget https://keys.qubes-os.org/keys/qubes-master-signing-key.asc
+$ gpg --import qubes-master-signing-key.asc 
+$ gpg --edit-key 36879494
+# Verify fingerprint!, set trust to *ultimate*
+$ wget https://keys.qubes-os.org/keys/qubes-developers-keys.asc
+$ gpg --import qubes-developers-keys.asc
+```
+
+Note we do *not* relay above on the security of our server (keys.qubes-os.org) nor the connection (ssl, cert) -- we only rely on you getting the Qubes Master Signing Key fingerprint *somehow* and ensure they match!
+
+Now lets bootstrap the builder. Unfortunately the builder cannot verify itself (the classic Chicken and Egg problem), so we need to verify the signature manually:
+
+``` {.wiki}
+$ git clone git://git.qubes-os.org/qubes-r3/qubes-builder.git
+$ cd qubes-builder
+$ git describe --exact-match HEAD
+<some tag>
+$ git tag -v <some tag>
+```
+
+Assuming the verification went fine, we're good to go with all the rest without ever thinking more about verifying digital signatures on all the rest of the components, as the builder will do that for us, for each component, every time we, even for all aux files (e.g. Xen or Linux kernel sources).
+
+Let's configure the builder first (we can use one of the example configs, either for R2 or "master", which currently means pre-released R3):
+
+``` {.wiki}
+cp example-configs/qubes-os-master.conf builder.conf
+```
+
+You can take a loot at the `builder.conf.default` for a description of all available options. Nevertheless, the default config should be enough for start:
+
+``` {.wiki}
+$ make get-sources qubes
+$ make sign-all # this requires setting SIGN_KEY in the builder.conf, can be skipped for test builds.
+$ make iso
+```
+
+Enjoy your new ISO!