Configuring a "Multimedia" TemplateVM

Community Guides
, ,
1

Note: This Howto has been written and was tested under Qubes 4rc4

You can consolidate most of your media streaming tasks into one “multimedia” App-VM. This howto explains how to create a multimedia template which can be used to play multimedia content. This includes:

  • Spotify
  • Amazon Prime
  • Netflix
  • DVDs

Installation

Start by cloning the default debian template in dom0. Hint: t-multimedia is just the template VM where we will install all packages. In the last step we will create an AppVM from this template.

qvm-clone debian-10 t-multimedia

Launch a Terminal in the new template VM:

qvm-run --auto t-multimedia gnome-terminal

Important: Enter all the following commands in the terminal of the template VM. Become the root user to run all following command without the need to use sudo in the multimedia template VM.

sudo -i

This howto assumes that you have xclip available in the AppVM where you download the Repository Signing keys. xclip will be used to paste the content of the clipboard to a file. You can install xclip via:

apt-get install xclip on Debian dnf install xclip on Fedora

You can of course install xclip just into the AppVM where you download the signing keys to have it available for this howto and it will be deleted if you reboot the AppVM. To have xclip available also after a reboot you need to install it in the Template VM on which your Internet AppVM is based (make sure to reboot the AppVM after you’ve installed any package in its template)

Installation of Spotify

Import GPG-Key for spotify As the template VM can’t connect to internet you need to get the public key file from another AppVM and copy it to the template VM. The easiest way is to use the Qubes Clipboard to copy the keys from the AppVM where you get the key to the Template VM.

In an AppVM which has Internet access:

Copy the public signing key over to the multimedia template VM

  • copy the file via qvm-copy-to-vm t-multimedia spotify.pubkey
  • or create a new file on the Template VM and copy the content of the clipboard (the public key) Copy content of page to the Qubes Clipboard (Ctrl+C and then Shift+Ctrl+C) Switch to the gnome terminal in the Multimedia Template VM nano spotify.pubkey Paste the content from the Qubes Clipboard into nano (Shift+Ctrl+V and then Paste) Save the file (Ctrl+O Ctrl+X)

Check the signature of the signing key (in the multimedia Template VM). Hint: depending on your installed version of GnuPG the command to show a public might slightly be different. See this StackExchange question for more information. If this command doesn’t show a fingerprint choose one of the other commands mentioned in the above link.

gpg --keyid-format long --with-fingerprint spotify.pubkey

This should look like:

[user@t-multimedia ~]$ gpg --keyid-format long --with-fingerprint spotify.pubkey 

gpg: WARNING: no command supplied.  Trying to guess what you mean ...
pub   rsa4096/D1742AD60D811D58 2020-09-08 [SC] [expires: 2021-12-02]
  Key fingerprint = 8FD3 D9A8 D380 0305 A9FF  F259 D174 2AD6 0D81 1D58
uid                           Spotify Public Repository Signing Key <tux@spotify.com>

You can (and should) lookup the fingerprint on at least one (or more) keyservers as the above information might be outdated.

https://keyserver.ubuntu.com/pks/lookup?op=vindex&search=0x4773BD5E130D1D45&fingerprint=on

Add the public key to the repository keyring apt-key add spotify.pubkey

Add the Spotify repository to your list of package sources:

echo deb http://repository.spotify.com stable non-free > /etc/apt/sources.list.d/spotify.list

Update the list of all known packages

apt-get update

Install Spotify apt-get install -y spotify-client

Create a spotify desktop-entry

cp -p /usr/share/spotify/spotify.desktop /usr/share/applications/

cp /usr/share/spotify/icons/spotify-linux-16.png /usr/share/icons/hicolor/16x16/apps/spotify.png

Installation of VLC

To play DVDs you can install VLC with the needed Codecs

Download the public key which signs the VLC package repositories In an AppVM which has Internet access:

Copy the public signing key over to the multimedia template VM

  • copy the file via qvm-copy-to-vm t-multimedia videolan.pubkey
  • or create a new file on the Template VM and copy the content of the clipboard (the public key) Copy content of page to the Qubes Clipboard (Ctrl+C and then Shift+Ctrl+C) Switch to the gnome terminal in the Multimedia Template VM nano videolan.pubkey Paste the content from the Qubes Clipboard into nano (Shift+Ctrl+V and then Paste) Save the file (Ctrl+O Ctrl+X)

Check the signature of the signing key

gpg --keyid-format long --with-fingerprint videolan.pubkey

This should look like:

[user@t-multimedia ~]$ gpg --keyid-format long --with-fingerprint videolan.pubkey

gpg: WARNING: no command supplied.  Trying to guess what you mean ...
pub   rsa2048/6BCA5E4DB84288D9 2013-08-27 [SC]
      Key fingerprint = 8F08 45FE 77B1 6294 429A  7934 6BCA 5E4D B842 88D9
uid                           VideoLAN APT Signing Key <videolan@videolan.org>
sub   rsa2048/ED1466D0288D4A2C 2013-08-27 [E]

You can (and should) lookup the fingerprint on at least one (or more) keyservers as the above information might be outdated.

https://keyserver.ubuntu.com/pks/lookup?op=vindex&search=0x6BCA5E4DB84288D9&fingerprint=on

Add the public key to the repository keyring apt-key add videolan.pubkey

Add the new VLC package repositories to your list of sources

echo "deb http://download.videolan.org/pub/debian/stable/ /" > /etc/apt/sources.list.d/vlc.list

echo "deb-src http://download.videolan.org/pub/debian/stable/ /" >> /etc/apt/sources.list.d/vlc.list

Update package repositories

apt-get update

Install libdvdcss and VLC

apt-get install -y libdvdcss2 vlc

Installation Google Chrome

To play Videos with Netflix, Amazon Prime & Co using Chrome is a good option as it has all needed codecs included. Hint: Using Chromium will not work for some reasons.

Download the public key which signs the Google package repositories In an AppVM which has Internet access:

Copy the public signing key over to the multimedia template VM

  • copy the file via qvm-copy-to-vm t-multimedia google.pubkey
  • or create a new file on the Template VM and copy the content of the clipboard (the public key) Copy content of page to the Qubes Clipboard (Ctrl+C and then Shift+Ctrl+C) Switch to the gnome terminal in the Multimedia Template VM nano google.pubkey Paste the content from the Qubes Clipboard into nano (Shift+Ctrl+V and then Paste) Save the file (Ctrl+O Ctrl+X)

Check the signature of the signing key (still in the AppVM where you downloaded the key)

gpg --keyid-format long --with-fingerprint google.pubkey

This should look like:

[user@t-multimedia ~]$ gpg --keyid-format long --with-fingerprint videolan.pubkey

gpg: WARNING: no command supplied.  Trying to guess what you mean ...
pub   rsa4096/7721F63BD38B4796 2016-04-12 [SC]
      Key fingerprint = EB4C 1BFD 4F04 2F6D DDCC  EC91 7721 F63B D38B 4796
uid                           Google Inc. (Linux Packages Signing Authority) <linux-packages-keymaster@google.com>
sub   rsa4096/1397BC53640DB551 2016-04-12 [S] [expired: 2019-04-12]
sub   rsa4096/6494C6D6997C215E 2017-01-24 [S] [expired: 2020-01-24]
sub   rsa4096/78BD65473CB3BD13 2019-07-22 [S] [expires: 2022-07-21]

You can (and should) lookup the fingerprint on at least one (or more) keyservers as the above information might be outdated.

https://keyserver.ubuntu.com/pks/lookup?op=vindex&search=0x7721F63BD38B4796&fingerprint=on

or

https://www.google.com/linuxrepositories/

Add the public key to the repository keyring

apt-key add google.pubkey

Add the Google package repositories to your list of sources

echo "deb http://dl.google.com/linux/chrome/deb/ stable main"> /etc/apt/sources.list.d/google.list

Update package repositories

apt-get update

Install Chrome

apt-get install google-chrome-stable

Create a Multimedia AppVM

The last step is to create a multimedia AppVM (named “my-multimedia” here) based on the new multimedia template.

qvm-create --template t-multimedia --label orange my-multimedia

This document was migrated from the qubes-community project
  • Page archive
  • First commit: 08 Dec 2020. Last commit: 03 May 2021.
  • Applicable Qubes OS releases based on commit dates and supported releases: 4.0
  • Original author(s) (GitHub usernames): RooneyMcNibNug
  • Original author(s) (forum usernames):
  • Document license: GPLv2