I have one concern, however, which is that some files are copied to dom0 and then salted from there. Look at the multimedia qube. It contains a precompiled file, which is then copied from dom0 in install.sls by using salt://.... Would it be better to copy such files from a non-dom0 trustworthy qube? Is there a way to achieve this without something like qvm-run and piping data through dom0? Ideally, salt would allow for specifying the source as in qubes://somevm:/home/user/this_one.txt.
I have one concern, however, which is that some files are copied to dom0 and then salted from there. Look at the multimedia qube. It contains a precompiled file, which is then copied from dom0 in install.sls by using salt://.... Would it be better to copy such files from a non-dom0 trustworthy qube? Is there a way to achieve this without something like qvm-run and piping data through dom0? Ideally, salt would allow for specifying the source as in qubes://somevm:/home/user/this_one.txt.
This is true, in the multimedia example.
VLC provides src for this, and a Debian package which will install all
build tools, download the source, and build the library. That’s overkill
in a minimal template.
You could build this new every time, and copy it in to the multimedia
qube.
You cant salt it as you would like to do.
Since I trust myself, (as do other people who use that formula), I
use a prebuilt library.
Here are some interesting questions - which qube is more trustworthy than
dom0? What would count as “better” about using a qube?
Well I just don’t want to copy extra unnecessary things to dom0, even if I compiled them myself. I’m happy with storing them in another qube based on something minimal, called for instance, precompiled_stuff.