What’s the best approach in downloading VSC + Unity? I was going to do it via a template, but because I would be required to connect to the internet, a lot of people say as soon as you do that consider your template compromised.
What are the alternatives? Download these from a “downloader” App qube, copy the files to development template qube, and install through that way?
The following assumes you have a debian template.
you can either download the .deb in a dispvm and then transfer it to the template or you can install the snap backend in the template and then download the snap package in the app vm.
Alternatively VScodium provides a repo (scroll down to
Debian / Ubuntu (deb package):
you also have a couple of options to accomplish that: you can either use the dispvm approach or you can use qrexec to download it directly from the template:
curl --proxy http://127.0.0.1:8082/ https://gitlab.com/paulcarroty/vscodium-deb-rpm-repo/raw/master/pub.gpg | sudo tee /usr/share/keyrings/vscodium-archive-keyring.gpg
then add the repo:
echo 'deb [ signed-by=/usr/share/keyrings/vscodium-archive-keyring.gpg ] https://download.vscodium.com/debs vscodium main' | sudo tee /etc/apt/sources.list.d/vscodium.list
sudo apt update && sudo apt install codium
Just checked the Unity docs and they also made available a repo, so you can follow the steps above. You can either specify a different keyring name (ie unity.gpg) or remove that part and use
apt-key add - instead and remove the
[ signed-by= ] part from the repo.
Edit: Extended PoC of this idea is here. This is the blocking version (where non-networked TemplateVM will not translate curl/wget to curl-proxy/wget-proxy in the wrapper scripts.
Edit2: PoC code download here
Edit3: A non-blocking example for curl-wrapper automatically translates curl calls to curl-proxy calls under this post.
Edit4: No go. MOTD is a better approach. Proxy with static port is now considered risky by thread participants.
I created issue Deploy curl-…
I was curious to trying out the various methods mentioned above so I made a deb-signal template only to find out none seem to work:
$ export https_proxy=http://127.0.0.1:8082
$ wget -O- https://updates.signal.org/desktop/apt/keys.asc
Connecting to 127.0.0.1:8082… connected.
Proxy tunneling failed: CONNECT denied (ask the admin to allow HTTPS tunnels)Unable to establish SSL connection.
$ curl --proxy http://127.0.0.1:8082/ --tlsv1.2 --proto =https --max-time 1…
Installing Software in Qubes (all methods).
VScode provides a portable version (tar.gz).
Updating Visual Studio Code this way, as well as installing extensions, and updating them seems to not be possible, since it reverts back to the version of the template, right?
Might have to go the standalone route.
For VSC you’d update the Template, not the AppVM. The extensions on the other hand are downloaded in the AppVM so that’s where you’ll be updating them, as they’re located in $HOME.
No need for a standalone