mirror of
https://github.com/QubesOS/qubes-doc.git
synced 2024-10-01 01:25:40 -04:00
367 lines
12 KiB
Markdown
367 lines
12 KiB
Markdown
---
|
|
layout: doc
|
|
title: Archlinux Template
|
|
permalink: /doc/templates/archlinux/
|
|
redirect_from:
|
|
- /doc/archlinux/
|
|
- /en/doc/templates/archlinux/
|
|
- /doc/Templates/Archlinux/
|
|
- /wiki/Templates/Archlinux/
|
|
---
|
|
|
|
Archlinux Template
|
|
===============
|
|
|
|
Archlinux template is one of the templates made by Qubes community. It should
|
|
be considered experimental as Qubes developers team use mainly Fedora-based VMs
|
|
to test new features/updates.
|
|
|
|
Main maintainer of this template is [Olivier Médoc](mailto:o_medoc@yahoo.fr).
|
|
|
|
Updates for this template are provided by [Olivier Médoc](mailto:o_medoc@yahoo.fr) and are signed by the following key:
|
|
|
|
|
|
pub 2048R/2043E7ACC1833B9C 2014-03-27 [expires: 2018-03-29]
|
|
Key fingerprint = D85E E12F 9678 51CC F433 515A 2043 E7AC C183 3B9C
|
|
uid Olivier MEDOC (Qubes-OS signing key) <o_medoc@yahoo.fr>
|
|
|
|
The key is not installed when you install (signed) template package. You can however choose to trust it by registering it into pacman:
|
|
|
|
# pacman-key --recv-key 2043E7ACC1833B9C
|
|
# pacman-key --finger 2043E7ACC1833B9C
|
|
|
|
If the fingerprint is correct, you can then sign the key:
|
|
|
|
# pacman-key --lsign-key 2043E7ACC1833B9C
|
|
|
|
<br>
|
|
|
|
Install
|
|
-------
|
|
|
|
A prebuilt template is available only for Qubes 3.2. Before Qubes 3.2, it should be compiled from source as described in [building-archlinux-template](/doc/building-archlinux-template/).
|
|
|
|
[user@dom0 ~]$ sudo qubes-dom0-update --enablerepo=qubes-templates-community qubes-template-archlinux
|
|
|
|
## **Package Manager Proxy Setup Section** ##
|
|
|
|
|
|
Powerpill is a full Pacman wrapper that not only give easy proxy configuration but further offers numerous other advantages.
|
|
|
|
Please check out:
|
|
|
|
[Archlinux Powerpill](https://wiki.archlinux.org/index.php/powerpill)
|
|
|
|
[XYNE's (dev) Powerpill](http://xyne.archlinux.ca/projects/powerpill/)
|
|
|
|
|
|
**Important Note:** As you are working in a template vm, by default, you will have to open network access to the template to download files manually, except for package managed which should be handled by the Qubes proxy. You can use the "allow full access for" a given time period in the FW settings of the template in the VMM or open up the various services through the same window. Remember to change it back if you choose the later route. Actions needing network access will be noted with (needs network access)
|
|
|
|
<br>
|
|
<br>
|
|
|
|
##### **1: Editing Pacman's configuration file (pacman.conf)** #####
|
|
|
|
* Open archlinux terminal app
|
|
|
|
* edit /etc/pacman.conf
|
|
|
|
* **$ sudo nano -w /etc/pacman.conf**
|
|
|
|
* Below is the output of a correct pacman.conf file Make the changes so your file matches this one or rename the original and create a new one and copy and paste this text into it. Text should be justified left in the file. The changes from your default are to make gpg sig signing mandatory for packages but not required for DBs for the archlinux repos. Also to add the repo (at the end) for the Powerpill package.
|
|
|
|
|
|
<br>
|
|
<br>
|
|
|
|
|
|
# /etc/pacman.conf
|
|
#
|
|
# See the pacman.conf(5) manpage for option and repository directives
|
|
|
|
#
|
|
# GENERAL OPTIONS
|
|
#
|
|
[options]
|
|
# The following paths are commented out with their default values listed.
|
|
# If you wish to use different paths, uncomment and update the paths.
|
|
# RootDir = /
|
|
# DBPath = /var/lib/pacman/
|
|
# CacheDir = /var/cache/pacman/pkg/
|
|
# LogFile = /var/log/pacman.log
|
|
GPGDir = /etc/pacman.d/gnupg/
|
|
HoldPkg = pacman glibc
|
|
# XferCommand = /usr/bin/curl -C - -f %u > %o
|
|
# XferCommand = /usr/bin/wget --passive-ftp -c -O %o %u
|
|
# CleanMethod = KeepInstalled
|
|
# UseDelta = 0.7
|
|
Architecture = auto
|
|
|
|
|
|
# Pacman won't upgrade packages listed in IgnorePkg and members of IgnoreGroup
|
|
# IgnorePkg =
|
|
# IgnoreGroup =
|
|
# NoUpgrade =
|
|
NoUpgrade = /etc/X11/xinit/xinitrc.d/pulseaudio
|
|
NoUpgrade = /etc/X11/xinit/xinitrc.d/pulseaudio
|
|
NoUpgrade = /etc/X11/xinit/xinitrc.d/pulseaudio
|
|
# NoExtract =
|
|
|
|
# Misc options
|
|
# UseSyslog
|
|
# Color
|
|
# TotalDownload
|
|
CheckSpace
|
|
# VerbosePkgLists
|
|
|
|
# By default, pacman accepts packages signed by keys that its local keyring
|
|
# trusts (see pacman-key and its man page), as well as unsigned packages.
|
|
|
|
**Edited Line:** `# SigLevel = Required DatabaseOptional`
|
|
|
|
LocalFileSigLevel = Optional
|
|
# RemoteFileSigLevel = Required
|
|
|
|
# NOTE: You must run `pacman-key --init` before first using pacman; the local
|
|
# keyring can then be populated with the keys of all official Arch Linux
|
|
# packagers with `pacman-key --populate archlinux`.
|
|
|
|
#
|
|
# REPOSITORIES
|
|
# - can be defined here or included from another file
|
|
# - pacman will search repositories in the order defined here
|
|
# - local/custom mirrors can be added here or in separate files
|
|
# - repositories listed first will take precedence when packages
|
|
# have identical names, regardless of version number
|
|
# - URLs will have $repo replaced by the name of the current repo
|
|
# - URLs will have $arch replaced by the name of the architecture
|
|
#
|
|
# Repository entries are of the format:
|
|
# [repo-name]
|
|
# Server = ServerName
|
|
# Include = IncludePath
|
|
#
|
|
# The header [repo-name] is crucial - it must be present and
|
|
# uncommented to enable the repo.
|
|
#
|
|
|
|
# The testing repositories are disabled by default. To enable, uncomment the
|
|
# repo name header and Include lines. You can add preferred servers immediately
|
|
# after the header, and they will be used before the default mirrors.
|
|
|
|
# [testing]
|
|
# SigLevel = PackageRequired
|
|
# Include = /etc/pacman.d/mirrorlist
|
|
|
|
[core]
|
|
|
|
**Edited Line:** `SigLevel = PackageRequired`
|
|
|
|
Include = /etc/pacman.d/mirrorlist
|
|
|
|
[extra]
|
|
|
|
**Edited Line:** `SigLevel = PackageRequired`
|
|
|
|
Include = /etc/pacman.d/mirrorlist
|
|
|
|
# [community-testing]
|
|
# SigLevel = PackageRequired
|
|
# Include = /etc/pacman.d/mirrorlist
|
|
|
|
[community]
|
|
|
|
**Edited Line:** `SigLevel = PackageRequired`
|
|
|
|
Include = /etc/pacman.d/mirrorlist
|
|
|
|
# If you want to run 32 bit applications on your x86_64 system,
|
|
# enable the multilib repositories as required here.
|
|
|
|
# [multilib-testing]
|
|
# Include = /etc/pacman.d/mirrorlist
|
|
|
|
# [multilib]
|
|
# Include = /etc/pacman.d/mirrorlist
|
|
|
|
# An example of a custom package repository. See the pacman manpage for
|
|
# tips on creating your own repositories.
|
|
# [custom]
|
|
# SigLevel = Optional TrustAll
|
|
# Server = file:///home/custompkgs
|
|
|
|
[multilib]
|
|
|
|
**Edited Line:** `SigLevel = PackageRequired`
|
|
|
|
Include = /etc/pacman.d/mirrorlist
|
|
|
|
**Edited Line:** `# [qubes]`
|
|
|
|
**Edited Line:** `# Server = http://olivier.medoc.free.fr/archlinux/pkgs/`
|
|
|
|
**Add Section Below:**
|
|
|
|
[xyne-x86_64]
|
|
# A repo for Xyne's own projects: http://xyne.archlinux.ca/projects/
|
|
# Packages for the "x86_64" architecture.
|
|
# Added for PowerPill app
|
|
# Note that this includes all packages in [xyne-any].
|
|
SigLevel = Required
|
|
Server = http://xyne.archlinux.ca/repos/xyne
|
|
|
|
----------
|
|
|
|
<br>
|
|
|
|
##### **2: Setting Up GPG** (needs network access) #####
|
|
|
|
* Initialize GPG Keyring
|
|
|
|
* **$ sudo pacman-key --init**
|
|
|
|
* Populate the keyring with Archlinux master keys
|
|
|
|
* **$ sudo pacman-key --populate archlinux**
|
|
|
|
* Confirm keys with those at [Archlinux Master Keys](https://www.archlinux.org/master-keys/)
|
|
|
|
* For more information on Pacman key signing: [Pacman Package Key Signing](https://wiki.archlinux.org/index.php/Pacman/Package_signing)
|
|
|
|
<br>
|
|
<br>
|
|
|
|
##### **3: Install Powerpill (Pacman wrapper)** #####
|
|
|
|
* **$ sudo pacman -S powerpill**
|
|
|
|
<br>
|
|
<br>
|
|
|
|
##### **4: Install Reflector** #####
|
|
|
|
*Note: It scripts mirror updating. Grabbing the most up to date gen mirror list. It ranks them by most recently sync'd. Then ranks them on fastest speed. Also can be used by Powerpill config to allow a once stop conf file for all if so wanted.*
|
|
|
|
* **$ sudo pacman -S reflector**
|
|
|
|
|
|
Note: You can combine package downloads: **$ sudo pacman -S powerpill reflector**
|
|
|
|
<br>
|
|
<br>
|
|
|
|
##### **5: Backup mirrorlist prior to first running Reflector.** #####
|
|
|
|
Note: For info on Reflector and its configs: [Reflector](https://wiki.archlinux.org/index.php/Reflector)
|
|
|
|
* **$ sudo cp /etc/pacman.d/mirrorlist /etc/pacman.d/mirrorlist.bkup**
|
|
|
|
<br>
|
|
<br>
|
|
|
|
##### **6: Setup mirrolist with Reflector** (needs network access)** #####
|
|
|
|
*Note: Look at the Reflector page to decide what filter and argument string you wish to run. Below is a default string that will work for most all to setup a working basic mirrorlist.
|
|
|
|
*Look to Reflector pages or --help for more info on args and filters.*
|
|
|
|
* **$ sudo reflector --verbose -l 5 --sort rate --save /etc/pacman.d/mirrorlist**
|
|
|
|
* The above ranks all the most up to date and sorts for the 5 fastest
|
|
|
|
* You can confirm the new list by opening the newly created mirrorlist.
|
|
|
|
<br>
|
|
<br>
|
|
|
|
|
|
##### **7: Configure Powerpill configuration file to use Qubes Proxy Service** #####
|
|
|
|
* Qubes Proxy Address: **10.137.255.254:8082**
|
|
|
|
* Edit **powerpill.json** (powerpill config file)
|
|
|
|
* **$ sudo nano -w /etc/powerpill/powerpill.json**
|
|
|
|
* Add line '**--all-proxy=10.137.255.254:8082**' at the bottom of the list under the **"aria2"** section under the **"args"** line. Example below:
|
|
|
|
<br>
|
|
|
|
{
|
|
"aria2": {
|
|
"args": [
|
|
"--allow-overwrite=true",
|
|
"--always-resume=false",
|
|
"--auto-file-renaming=false",
|
|
"--check-integrity=true",
|
|
"--conditional-get=true",
|
|
"--continue=true",
|
|
"--file-allocation=none",
|
|
"--log-level=error",
|
|
"--max-concurrent-downloads=100",
|
|
"--max-connection-per-server=5",
|
|
"--min-split-size=5M",
|
|
"--remote-time=true",
|
|
"--show-console-readout=true",
|
|
"--all-proxy=10.137.255.254:8082"
|
|
],
|
|
"path": "/usr/bin/aria2c"
|
|
},
|
|
|
|
<br>
|
|
<br>
|
|
|
|
##### **8: Test Powerpill Configuration** #####
|
|
|
|
*Note: Powerpill uses and passes the same syntax as pacman*
|
|
|
|
* Configure Archlinux Template to only use the Qubes Proxy Update Service
|
|
* In the Qubes VM Manager under Archlinux FW tab make sure only the access check box for update proxy is on. All others should be set to deny.
|
|
|
|
* **$ sudo powerpill -Syu**
|
|
|
|
* You should get a similar output as below:
|
|
|
|
<br>
|
|
<br>
|
|
|
|
<br>
|
|
<br>
|
|
|
|
|
|
**Remember you must open up network access anytime you wish to run the Reflector script to update the mirrorlist. This page will be updated when/if this situation changes.**
|
|
|
|
|
|
### **If the above checks out, you can start using your new Archlinux Template** ###
|
|
|
|
<br>
|
|
<br>
|
|
|
|
#### **Known Issues:** ####
|
|
|
|
* If there is an Arch upgrade of Pulse Audio it will require rebuilding and installing Qubes component: gui-agent-linux
|
|
|
|
* There May also be a similar issue of dependencies with Xorg.
|
|
|
|
* Upgrade Relfector functionality to allow its use through the QUPS
|
|
|
|
* Pacman functionality changes and allows it to be directly configured to work through QUPS.
|
|
|
|
<br>
|
|
|
|
#### **Qubes Mailing List Threads on the Archlinux build process:** ####
|
|
|
|
* [Qubes-Devel](https://groups.google.com/forum/#!forum/qubes-devel): [Qubes Builder failed Archlinux repository is missing](https://groups.google.com/forum/#!topic/qubes-devel/tIFkS-rPVx8)
|
|
|
|
* [Qubes-Users](https://groups.google.com/forum/#!forum/qubes-users): [Trying to compile archlinux template](https://groups.google.com/forum/#!topic/qubes-users/7wuwr3LgkQQ)
|
|
|
|
<br>
|
|
|
|
#### **Want to contribute?** ####
|
|
|
|
* [How can I contribute to the Qubes Project?](/doc/contributing/)
|
|
|
|
* [Guidelines for Documentation Contributors](/doc/doc-guidelines/)
|
|
|
|
<br>
|