Archlinux template for QubesOS 4.0

[na--]

Qubes OS version:

R4.0

Affected TemplateVMs:

archlinux
(template used for building: fedora-25)

---

Steps to reproduce the behavior:

Try to build the archlinux template:

1. Install and set up the needed prerequisites for building QubesOS
2. Clone qubes-builder
3. Copy example-configs/qubes-os-master.conf as builder.conf
4. Set DISTS_VM to archlinux and add builder-archlinux to COMPONENTS and BUILDER_PLUGINS
5. Run make get-sources, make qubes-vm, make template

Expected behavior:

Build the archlinux packages for the qubes components and the dom0 archlinux template package.

Actual behavior:

Some packages fail: core-agent-linux, linux-utils, vmm-xen

General notes:

This is just an issue to track all the changes across the different repos that fix the archlinux template for QubesOS 4.0. In a few minutes I will submit pull requests to core-agent-linux, linux-utils and vmm-xen that fix the build and produce a somewhat working archlinux template. I tested the resulting template a bit in a fresh fully-updated (including the current-testing repo) 4.0 RC1 install and it worked. There were some peculiarities with VM startup and shutdown which I'll probably need help to track down.

---

Related issues:

None that I could find

[0spinboson]

building this using your instructions worked for me as well (fc26, incidentally), and it even boots, so I'm good for now. :)

[mannp]

Is this something thats in any early beta repos, or is it only build yourself for the moment?

[0spinboson]

For now, home brewing only, I'm afraid. :)

…

On Oct 19, 2017 16:00, "mannp" ***@***.***> wrote: Is this something thats in any early beta repos, or is it only build yourself for the moment? — You are receiving this because you commented. Reply to this email directly, view it on GitHub <#3185 (comment)>, or mute the thread <https://github.com/notifications/unsubscribe-auth/AUGeHGqESV3rMDA-Zce-Sna7qqXeedfZks5st1X3gaJpZM4P90RU> .

[mannp]

Ok thanks for the quick reply @0spinboson, I will have to add to my to do list for now :)

If only there was a docker with the build environment already in, will have to do some googling and see if such a thing exists.

Cheers

[na--]

When I launch an Archlinux AppVM, something strange happens. First, an initialization/BIOS screen appears for a few seconds:

then it disappears but a larger blank screen appears:

then it disappears as well and the window of the launched application is shown. I am not sure what the reason is, maybe a missed patch with vmm-xen. Anyone else having the same issue or have any idea why this happens?

Also, I noticed a few other minor issues:

• /dev/shm is smaller than expected and some applications crash
• qubes-usb-proxy is not installed by default in the template
• dom0 did not know any of the template applications on the first install, but updating the template populates the available applications list.

I think the first 2 are easy to track down and will fix them when I have the time. Does anyone else notice any other issues?

[marmarek]

dom0 did not know any of the template applications on the first install, but updating the template populates the available applications list.

This looks related to the "window issue". It means qubes.PostInstall service wasn't called at template installation. It should be done automatically as part of rpm installation.
You can do it manually and see what happens:

qvm-run -u root -p --service archlinux qubes.PostInstall

[ptitdoc]

Additionnal note: core-qubes-db supports python 2.7 and python 3 bindings, but archlinux PKGBUILD only builds the 2.7 bindings.

The following pull request build core-qubesdb python bindings for both versions:
QubesOS/qubes-core-qubesdb#6

[ptitdoc]

Additionnal note: imgconverter in linux-utils should also be built both for python2 and python3. A created a Push Request which is concurrent to yours:
QubesOS/qubes-linux-utils#22

[ptitdoc]

Additionnal note: core-agent-linux changed the logic of calling qrexec from using su, to using a pam enabled qrexec agent.
I took your commits and added the required changes in my own pull request:
QubesOS/qubes-core-agent-linux#63

However, I'm not 100% sure that all su problems are fixed for archlinux (I only tested building but I'm not able to test the package on r4.0 yet).

More references to these su/bash/zsh problems are tracked in the following thread:
#2888

[ptitdoc]

Additionnal note: gui-agent-linux now use a separate pulseaudio and agent packages. Archlinux PKGBUILD has been updated acordingly:
QubesOS/qubes-gui-agent-linux#20

As a side note, I plan to separate the xorg module in order to deal more easily with new xorg versions.

[ptitdoc]

I uploaded the binary packages for Qubes 4.0 in testing.

You can try them by changing current to testing in the repository URL.

[ptitdoc]

I confirm the template with all the linked Pull Requests is properly starting and has basic support for:

• gui
• network
• sound

Other features have not been tested yet.

I also experience the qubes.PostInstall error when installing the template, but I have not been able to find related logs. This does not prevent the template or AppVMs to start properly.

[na--]

Thanks! I will try to test everything tomorrow. If everything works and RC2 is officially released, I may event attempt to switch to 4.0 full-time for easier testing and development.

[ptitdoc]

The qubes.PostInstall bug is caused by broken sed commands in the PKGBUILD. I fixed it in the same pull request:
QubesOS/qubes-core-agent-linux#63

[ptitdoc]

I also noticed that there are still problems with bash not loading /etc/profile.

[na--]

Not sure about /etc/profile, but regarding the small size of /dev/shm: I think this is the commit that fixed the original issue, but it looks like /etc/fstab is removed in the archlinux package.

[marmarek]

tmp.mount dropin should also work, if installed there

[na--]

@ptitdoc: do you think that the fstab file in core-agent-linux is suitable for archlinux? At first I thought that we could just add a line for a larger /dev/shm here, but I think that we are also missing the discard option for /rw in the arch template... So probably using the fstab file as-is or modifying it in place is better.

[ptitdoc]

/tmp and /dev/shm are following archlinux default value. I would not change it on behalf of the user.

But maybe the size is based on available RAM which is small when QubesVMs are starting.

If we need to change it, I would add it in template customization in archlinux-builder, maybe through a systemd .mount dropin as @marmarek suggests.

[na--]

Yeah, I think the small size is because it's based on the initially available RAM. I'm a big fan of the arch way, but this makes the system unusable (browser video in fullscreen is almost guaranteed to crash), so I think we have to increase it by default. I'm not sure how to do this via a systemd dropin, there does not seem to be a unit for /dev/shm, only for /tmp, we probably need a separate unit file.

[marmarek]

Yeah, I think the small size is because it's based on the initially available RAM

Exactly, see this commit and issue linked from there.
As for dropin - see that commit - it already contain appropriate file. Just needs to be installed in Archlinux.

[ptitdoc]

I did additionnal testing.

There is still a bug because X11 session is not registered properly by loginctl. As a consequence, running systemctl --user will fail.
A temporary workaround is to copy /etc/pam.d/qrexec to /etc/pam.d/su and /etc/pam.d/su-l.

@marmarek Following issue #2903, you changed qrexec to use pam instead of calling su. Is it possible to do the same to call xinit instead of calling it via su ?

[marmarek]

Well, it should be possible (in fact, it should be implementing proper "display manager" in terms of session handling), but not sure how much work is it.

[zander]

Doing the 'make template' part causes a significant amount of downloads from the arch servers.
The pacman mirrors only uses one server, the rackspace com one. This not only caused a slow download for me in Europe, but after some time my IP got a temporary block from them. So downloads started timing out.

It may be useful to use 'rankmirrors' (see their wiki) before doing all the downloads. This should already be done immediately after the initial template download.

Sorry, I really don't understand the build system or I would be able to help.

[zander]

Seems like a change was made that causes a regression in the creation of this template.
Building of the gui-agent fails. See the make output attached here;

output.log

[marmarek]

That include line is there since 2010... Probably some change in X server headers. What X server version currently live in Arch?

[zander]

On my laptop;

$pacman -Qo /usr/include/X11/Intrinsic.h
/usr/include/X11/Intrinsic.h is owned by libxt 1.1.5-1

And generic; xorg-server 1.19.5-1

[marmarek]

Maybe just missing build dependency?

[zander]

Thanks for the hint, it was indeed due to an upstream archlinux change.

Fix in QubesOS/qubes-gui-agent-linux#29

[zander]

Using this task to register some more issues;

• the template doesn't have a proper locale. See ArchLinux Installation guide, the /etc/locale.conf should have content like; LANG=en_US.UTF-8, in the template the file is just missing.

• while sudo works fine, just plain su doesn't give you password-less root.

• any templateVM or appVM based on the archlinux template fails to have the standard setup for networking. Specifically: the iptables is empty.

[viq]

Amusingly enough this currently fails for me on installing libbluray :P

[viq]

Ah, that was me not knowing how to apply override.conf properly. Now with upstream core_agent_linux it builds, haven't tried installing yet though.

[arjan-s]

The binary repository in my templates from a few months back has stopped working due to a PGP error. Should I be using a new repo, or build my own packages?
What are the chances of an official Arch Linux template for QubesOS 4.0?

[fosslinux]

@na-- @mannp Is there a binary Arch Linux template available yet in Qubes 4.0 or is DYI?

[na--]

I don't think so, sorry, Arch is not one of the officially supported distros. But I had no issues the last few times I tried to build the template (see "Steps to reproduce the behavior"), so I should probably close this issue... I think a few of the minor problems mentioned here still remain, but they would probably be better off in separate issues rather than in this huge one. @marmarek, @andrewdavidwong ?

[andrewdavidwong]

But I had no issues the last few times I tried to build the template (see "Steps to reproduce the behavior"), so I should probably close this issue... I think a few of the minor problems mentioned here still remain, but they would probably be better off in separate issues rather than in this huge one.

Correct. Please file separate issues for them.

[JohnDoe02]

While building up to date qubes arch packages (make get-sources; make qubes-vm) used to work for me in the past, it fails since a week or so with a compilation error in building vmm-xen:

dsdt_pvh.c:3494:25: error: 'dsdt_pvh' undeclared here (not in a function); did you mean 'dsdt_pvh_len'?
 int dsdt_pvh_len=sizeof(dsdt_pvh);

Starting again from scratch (i.e., from a fresh qubes-builder clone) does not fix this. Anyone, for whom building the template is working at the moment?

[arjan-s]

@JohnDoe02 I have the exact same issue and not been able to find a solution yet

[JohnDoe02]

@arjan-s So I am not the only one. I filed an issue.

[arjan-s]

I created two PRs currently needed to be able to build this template again:
QubesOS/qubes-vmm-xen#42
QubesOS/qubes-gui-agent-linux#44

[na--]

Closing this huge issue, if someone wants to report anything else, please open a separate dedicated issue 😄

[0spinboson]

Question: is qubes-thunderbird building for anyone?
own Answer: It's not because, there's no archlinux PKGBUILD file for it. Never mind.

[andrewdavidwong]

Question: is qubes-thunderbird building for anyone else? I only recently started using arch a VM in which I use thunderbird, and I noticed that it's missing, and that it's not being built by the qubes-builder. Also, pasting data to arch-based clipboards isn't working for me either.

Looks like this question is off-topic for this (closed) issue. Please consider sending it to the qubes-users mailing list instead.