diff --git a/.reuse/dep5 b/.reuse/dep5 index ab0ea51..b8f30b9 100644 --- a/.reuse/dep5 +++ b/.reuse/dep5 @@ -57,6 +57,10 @@ Copyright: The Qubes OS Project Simon Gaiser License: CC0-1.0 +Files: salt/qubes-builder/files/client/qusal/keys/* +Copyright: 2023 - 2024 Benjamin Grande M. S. +License: CC0-1.0 + Files: salt/kicksecure-minimal/files/template/ld.so.preload Copyright: 2014 Patrick Schleizer License: CC0-1.0 diff --git a/salt/qubes-builder/README.md b/salt/qubes-builder/README.md index ea27c38..26b8598 100644 --- a/salt/qubes-builder/README.md +++ b/salt/qubes-builder/README.md @@ -56,6 +56,11 @@ is recommended to install some development goodies: sudo qubesctl --skip-dom0 --targets=tpl-qubes-builder state.apply qubes-builder.install-dev ``` +If you plan on building Qusal packages (Development only): +```sh +sudo qubesctl --skip-dom0 --targets=qubes-builder state.apply qubes-builder.configure-qusal +``` + ## Access Control The policy is based on `qubes-builderv2/rpc/50-qubesbuilder.policy`. @@ -94,3 +99,19 @@ executor: ``` Setting the Disposable VM to Dom0 works because it will use the `default_dispvm` preference of `qubes-builder`, which is `dvm-qubes-builder`. + +### Build Qusal + +**Warning**: development only. + +You can easily build Qusal as a default configuration is provided. + +Place only the following in `builder.yml`: +```yaml +include: + - ../qusal-builder/qusal.yml +``` + +To run the `sign` state, you will need to change the configuration option +`sign-key:rpm:KEY` to your key fingerprint as well as import the same key to +the default GnuPG home directory `~/.gnupg`. diff --git a/salt/qubes-builder/configure-qusal.sls b/salt/qubes-builder/configure-qusal.sls new file mode 100644 index 0000000..ca295c8 --- /dev/null +++ b/salt/qubes-builder/configure-qusal.sls @@ -0,0 +1,69 @@ +{# +SPDX-FileCopyrightText: 2023 - 2024 Benjamin Grande M. S. + +SPDX-License-Identifier: AGPL-3.0-or-later +#} + +{% if grains['nodename'] != 'dom0' -%} + +include: + - .configure + +"{{ slsdotpath }}-makedir-qusal-builder": + file.directory: + - name: /home/user/src/qusal-builder + - user: user + - group: user + - mode: '0755' + - makedirs: True + +"{{ slsdotpath }}-qusal-save-configuration": + file.recurse: + - require: + - file: "{{ slsdotpath }}-makedir-qusal-builder" + - name: /home/user/src/qusal-builder + - source: salt://{{ slsdotpath }}/files/client/qusal/ + - user: user + - group: user + - file_mode: '0644' + - dir_mode: '0755' + - makedirs: True + +"{{ slsdotpath }}-qusal-gnupg-home": + file.directory: + - name: /home/user/.gnupg/qusal-builder + - user: user + - group: user + - mode: '0700' + - makedirs: True + +"{{ slsdotpath }}-qusal-save-keys": + file.recurse: + - require: + - file: "{{ slsdotpath }}-qusal-gnupg-home" + - name: /home/user/.gnupg/qusal-builder/download/ + - source: salt://{{ slsdotpath }}/files/client/qusal/keys/ + - user: user + - group: user + - file_mode: '0600' + - dir_mode: '0700' + - makedirs: True + +"{{ slsdotpath }}-qusal-import-keys": + cmd.run: + - require: + - file: "{{ slsdotpath }}-qusal-save-keys" + - name: gpg --status-fd=2 --homedir . --import download/*.asc + - cwd: /home/user/.gnupg/qusal-builder + - runas: user + - success_stderr: IMPORT_OK + +"{{ slsdotpath }}-qusal-import-ownertrust": + cmd.run: + - require: + - cmd: "{{ slsdotpath }}-qusal-import-keys" + - name: gpg --homedir . --import-ownertrust download/otrust.txt + - cwd: /home/user/.gnupg/qusal-builder + - runas: user + +{% endif -%} diff --git a/salt/qubes-builder/configure-qusal.top b/salt/qubes-builder/configure-qusal.top new file mode 100644 index 0000000..86a6c74 --- /dev/null +++ b/salt/qubes-builder/configure-qusal.top @@ -0,0 +1,9 @@ +{# +SPDX-FileCopyrightText: 2024 Benjamin Grande M. S. + +SPDX-License-Identifier: AGPL-3.0-or-later +#} + +base: + 'qubes-builder': + - qubes-builder.configure-qusal diff --git a/salt/qubes-builder/files/client/qusal/keys/DF3834875B65758713D93E91A475969DE4E371E3.asc b/salt/qubes-builder/files/client/qusal/keys/DF3834875B65758713D93E91A475969DE4E371E3.asc new file mode 100644 index 0000000..763367f --- /dev/null +++ b/salt/qubes-builder/files/client/qusal/keys/DF3834875B65758713D93E91A475969DE4E371E3.asc @@ -0,0 +1,25 @@ +-----BEGIN PGP PUBLIC KEY BLOCK----- + +mDMEZGZAKxYJKwYBBAHaRw8BAQdAzFB23KFLShkm+1ES6N8i6HVJ1B7Krqj0yXo3 +L/l30NCIywQfFgoAfQWCZGZAKwMLCQcJEKR1lp3k43HjRxQAAAAAAB4AIHNhbHRA +bm90YXRpb25zLnNlcXVvaWEtcGdwLm9yZyeI6TGfVTZAp3yhEOrLKTMwsOPF/yIH +mt8kAJlr2HGmAxUKCAKbAQIeARYhBN84NIdbZXWHE9kukaR1lp3k43HjAABdQwEA +whLqF/ei31DnMQKwvg+b7zPYbm/q8D9uyGkfcVkbZygA/0ddoR7N2btc+Xkq9YO0 +HUBq0fh4kZKoXhigN80rM1oBtDZCZW4gR3JhbmRlIChDb2RlIHNpZ25pbmcga2V5 +KSA8YmVuLmdyYW5kZS5iQGdtYWlsLmNvbT6IzgQTFgoAgAWCZGZAKwMLCQcJEKR1 +lp3k43HjRxQAAAAAAB4AIHNhbHRAbm90YXRpb25zLnNlcXVvaWEtcGdwLm9yZ2Nk +JbOh6BctVi8+X8FzBteAzpLjefrZYuRm6rkYv8ZDAxUKCAKZAQKbAQIeARYhBN84 +NIdbZXWHE9kukaR1lp3k43HjAAA+vgD/Sejx9K2Zvre5upU6C7ir2WZRqEPCKvy5 +wFU1h4N+40wBAMr/WsLSJSD6TOwgdYfBDczEue1gc6zP+xA7Or7VujICuDMEZGZA +KxYJKwYBBAHaRw8BAQdALj8b1CVE4cqUI3gSFGaZW+af9DIwCzBygvo83iG1xJKJ +AYIEGBYKATQFgmRmQCsJEKR1lp3k43HjRxQAAAAAAB4AIHNhbHRAbm90YXRpb25z +LnNlcXVvaWEtcGdwLm9yZ2iMz6GUuNxM1dDPp3PXPgsGGGlKi/vU+sojIkznrYCc +ApsCAh4BvqAEGRYKAG8FgmRmQCsJEADGThT1H55WRxQAAAAAAB4AIHNhbHRAbm90 +YXRpb25zLnNlcXVvaWEtcGdwLm9yZwTyiHExlhRK2ulMEfrIv0IhSOEhTWDj8oi7 +aXjg7pt0FiEE79pdfpoB+pm/oGLhAMZOFPUfnlYAAMIvAQDB/ARSBZyN+L8L7OA9 +RLfUyNSUuQJltnIj0ljM2V8FZQD/b2mwtdYsSm1C10ftPSbTpeFVCTkkAK626QWQ +yXQTxQcWIQTfODSHW2V1hxPZLpGkdZad5ONx4wAAfzIA/R1eIybunPwpAziHhMxN +IP6iA/8/w1F6Li4ImZ/QhYW5AQCi8+0e8/NgQaI4FEqs/36cfi17XL5C5VbvbKi4 +0g+rDQ== +=CkKA +-----END PGP PUBLIC KEY BLOCK----- diff --git a/salt/qubes-builder/files/client/qusal/keys/otrust.txt b/salt/qubes-builder/files/client/qusal/keys/otrust.txt new file mode 100644 index 0000000..fc1a991 --- /dev/null +++ b/salt/qubes-builder/files/client/qusal/keys/otrust.txt @@ -0,0 +1,3 @@ +# List of assigned trustvalues, created Thu 02 Nov 2023 09:43:48 PM UTC +# (Use "gpg --import-ownertrust" to restore them) +DF3834875B65758713D93E91A475969DE4E371E3:6: diff --git a/qubesbuilder/qusal-cache.yml b/salt/qubes-builder/files/client/qusal/qusal-cache.yml similarity index 100% rename from qubesbuilder/qusal-cache.yml rename to salt/qubes-builder/files/client/qusal/qusal-cache.yml diff --git a/qubesbuilder/qusal.yml b/salt/qubes-builder/files/client/qusal/qusal.yml similarity index 98% rename from qubesbuilder/qusal.yml rename to salt/qubes-builder/files/client/qusal/qusal.yml index b671fbf..048714d 100644 --- a/qubesbuilder/qusal.yml +++ b/salt/qubes-builder/files/client/qusal/qusal.yml @@ -15,7 +15,7 @@ git: - DF3834875B65758713D92E91A475969DE4E371E3 key-dirs: - - ../qusal/keys/ + - ../qusal-builder/keys/ backend-vmm: xen debug: true verbose: true