mirror of
https://github.com/ben-grande/qusal.git
synced 2024-10-01 02:35:49 -04:00
feat: fetch mirage tarball
Fixes: https://github.com/ben-grande/qusal/issues/32
This commit is contained in:
parent
f9ead06408
commit
cb59a9a5b3
@ -8,6 +8,11 @@ SPDX-License-Identifier: MIT
|
||||
|
||||
{%- from "qvm/template.jinja" import load -%}
|
||||
|
||||
{% set mirage_version = 'v0.8.6' -%}
|
||||
{% set mirage_file_archive = 'mirage-firewall.tar.bz2' -%}
|
||||
{% set mirage_url_archive = 'https://github.com/mirage/qubes-mirage-firewall/releases/download/' ~ mirage_version ~ '/' ~ mirage_file_archive -%}
|
||||
{% set mirage_sha256sum = 'b2a568dde165384cf041c577ffbfc4522a02115d95cc0830bff125ef1781a10c' %}
|
||||
|
||||
{# Use the netvm of the default_netvm. #}
|
||||
{% set default_netvm = salt['cmd.shell']('qubes-prefs default_netvm') -%}
|
||||
{% set netvm = salt['cmd.shell']('qvm-prefs ' + default_netvm + ' netvm') -%}
|
||||
@ -19,28 +24,68 @@ the chain (sys-net).
|
||||
{% set netvm = default_netvm %}
|
||||
{% endif %}
|
||||
|
||||
"sys-mirage-firewall-create-vm-kernels-dir":
|
||||
file.directory:
|
||||
- name: /var/lib/qubes/vm-kernels/mirage-firewall
|
||||
- mode: '0755'
|
||||
- user: root
|
||||
- group: root
|
||||
- makedirs: True
|
||||
{# The 'updatevm' has networking and 'curl' present. #}
|
||||
{% set updatevm = salt['cmd.shell']('qubes-prefs updatevm') %}
|
||||
|
||||
"sys-mirage-firewall-start-updatevm-{{ updatevm }}":
|
||||
qvm.start:
|
||||
- name: {{ updatevm }}
|
||||
|
||||
"sys-mirage-firewall-fetch-tarball":
|
||||
cmd.run:
|
||||
- require:
|
||||
- qvm: "sys-mirage-firewall-start-updatevm-{{ updatevm }}"
|
||||
- name: |
|
||||
qvm-run {{ updatevm }} -- "
|
||||
mkdir -p /tmp/mirage-firewall-download
|
||||
cd /tmp/mirage-firewall-download
|
||||
curl --location \
|
||||
--connect-timeout 10 \
|
||||
--tlsv1.3 --proto =https \
|
||||
--fail --fail-early \
|
||||
--no-progress-meter --silent --show-error \
|
||||
--remote-name {{ mirage_url_archive }}"
|
||||
- timeout: 30
|
||||
- runas: user
|
||||
|
||||
{# Tarball is brought to dom0 instead of just 'vmlinuz' because:
|
||||
- checksum on releases is only of the tarball, not of individual files;
|
||||
- updatevm may not have 'bzip2' and 'tar';
|
||||
- if we don't trust the provided tarball, we shouldn't even download it.
|
||||
#}
|
||||
"sys-mirage-firewall-bring-tarball-to-dom0":
|
||||
cmd.run:
|
||||
- require:
|
||||
- cmd: "sys-mirage-firewall-fetch-tarball"
|
||||
- name:
|
||||
qvm-run --pass-io {{ updatevm }} -- "cat /tmp/mirage-firewall-download/mirage-firewall.tar.bz2" | tee /tmp/mirage-firewall.tar.bz2 >/dev/null
|
||||
- runas: user
|
||||
- timeout: 10
|
||||
|
||||
"{{ slsdotpath }}-remove-tarball-from-updatevm":
|
||||
cmd.run:
|
||||
- name: qvm-run {{ updatevm }} -- "rm -rf /tmp/mirage-firewall-download"
|
||||
|
||||
"sys-mirage-firewall-extract-to-vm-kernels":
|
||||
archive.extracted:
|
||||
- name: /var/lib/qubes/vm-kernels/
|
||||
- require:
|
||||
- file: sys-mirage-firewall-create-vm-kernels-dir
|
||||
- source: salt://sys-mirage-firewall/files/admin/mirage-firewall.tar.bz2
|
||||
- source_hash: salt://sys-mirage-firewall/files/admin/mirage-firewall.sha256
|
||||
- cmd: "sys-mirage-firewall-bring-tarball-to-dom0"
|
||||
- name: /var/lib/qubes/vm-kernels/
|
||||
- source: /tmp/mirage-firewall.tar.bz2
|
||||
- source_hash: sha256={{ mirage_sha256sum }}
|
||||
- archive_format: tar
|
||||
- options: -j
|
||||
|
||||
"{{ slsdotpath }}-dom0-archive":
|
||||
file.absent:
|
||||
- name: /tmp/mirage-firewall.tar.bz2
|
||||
|
||||
"sys-mirage-firewall-save-version":
|
||||
file.managed:
|
||||
- require:
|
||||
- archive: "sys-mirage-firewall-extract-to-vm-kernels"
|
||||
- name: /var/lib/qubes/vm-kernels/mirage-firewall/version.txt
|
||||
- source: salt://sys-mirage-firewall/files/admin/version.txt
|
||||
- contents: {{ mirage_version }}
|
||||
- mode: '0644'
|
||||
- user: root
|
||||
- group: root
|
||||
|
Loading…
Reference in New Issue
Block a user