Git-Mirrors/qusal
1
0
Fork 0
mirror of https://github.com/ben-grande/qusal.git synced 2025-07-28 17:04:10 -04:00
Code Issues Projects Releases Packages Wiki Activity

feat: unattended qubes-builder build

Browse source 
Split-gpg2 allows to isolate GPG home directories. In the future,
enforcing this setting via drop-in configuration would be safer, depends
on https://github.com/QubesOS/qubes-issues/issues/8792.
This commit is contained in:
Ben Grande 2024-01-05 17:24:14 +01:00
parent 6bf6da56fb
commit 132431aebd
No known key found for this signature in database
GPG key ID: 00C64E14F51F9E56
2 changed files with 4 additions and 6 deletions
Download patch file Download diff file Expand all files Collapse all files

6
salt/qubes-builder/README.md
View file

@ -49,10 +49,8 @@ qubesctl --skip-dom0 --targets=qubes-builder state.apply qubes-builder.configure
The policy is based on `qubes-builderv2/rpc/50-qubesbuilder.policy`. The policy is based on `qubes-builderv2/rpc/50-qubesbuilder.policy`.
Extra services added are `qubes.Gpg2`, `qusal.GitInit`, `qusal.GitFetch`, Extra services added are `qubes.Gpg2`, `qusal.GitInit`, `qusal.GitFetch`,
`qusal.GitPush`, `qusal.SshAgent`. `qusal.GitPush`, `qusal.SshAgent`. Necessary services are allowed to have an
unattended build.
Out of these services, if an argument `+qubes-builder` can be specified to
limit the scope, the action is `allowed`, else the action is to `ask`.
## Usage ## Usage

4
salt/qubes-builder/files/admin/policy/default.policy
View file

@ -5,11 +5,11 @@
## Do not modify this file, create a new policy with with a lower number in the ## Do not modify this file, create a new policy with with a lower number in the
## file name instead. For example `30-user.policy`. ## file name instead. For example `30-user.policy`.
qubes.Gpg2 * {{ sls_path }} @default ask target=sys-pgp default_target=sys-pgp qubes.Gpg2 * {{ sls_path }} @default allow target=sys-pgp
qusal.GitInit +qubes-builder {{ sls_path }} @default allow target=sys-git qusal.GitInit +qubes-builder {{ sls_path }} @default allow target=sys-git
qusal.GitFetch +qubes-builder {{ sls_path }} @default allow target=sys-git qusal.GitFetch +qubes-builder {{ sls_path }} @default allow target=sys-git
qusal.GitPush +qubes-builder {{ sls_path }} @default ask target=sys-git default_target=sys-pgp qusal.GitPush +qubes-builder {{ sls_path }} @default ask target=sys-git default_target=sys-git
qusal.SshAgent +qubes-builder {{ sls_path }} @default allow target=sys-ssh-agent qusal.SshAgent +qubes-builder {{ sls_path }} @default allow target=sys-ssh-agent
qusal.SshAgent +qubes-builder {{ sls_path }} @anyvm deny qusal.SshAgent +qubes-builder {{ sls_path }} @anyvm deny