Mono-project template installation?

qubeyqube · May 9, 2022, 8:18pm

Got Visual Studio code installed within a template, not connected to the network. However, I’ve hit a stumbling block with getting Mono on the system, securely.

Their installation instructions for Linux based systems requires downloading via:

sudo apt install apt-transport-https dirmngr gnupg ca-certificates
sudo apt-key adv --keyserver hkp://keyserver.ubuntu.com:80 --recv-keys 3FA7E0328081BFF6A14DA29AA6A19B38D3D831EF
echo "deb https://download.mono-project.com/repo/debian stable-buster main" | sudo tee /etc/apt/sources.list.d/mono-official-stable.list
sudo apt update

However, this can’t be done without being connected to the internet, they don’t seem to offer a .deb version, only a .pkg (which I believe is Mac). Any ideas what to do here? Compile from source, maybe?

tzwcfq · May 9, 2022, 9:29pm

github.com

unman/notes/blob/master/gpg_in_templates

Since templates are not network connected, you may think you can't use gpg to get keys.  
But there's a proxy listening on :8082: normally used to pull down packages using qrexec.  
This is a standard "using gpg behind firewall" problem, and the solution is to use that proxy.  

Here's a script:  
Save it as get_key  

```
#!/usr/bin/sh
if [ $# != 1 ]
then
echo "need a search term"
exit
fi

#wget "https://hkps.pool.sks-keyservers.net/pks/lookup?op=vindex&search=$1" -e use_proxy=on -e https_proxy=127.0.0.1:8082 -O $1  --ca-certificate=./sks-keyservers.netCA.pem
wget "https://keyserver.ubuntu.com/pks/lookup?op=get&search=$1" -e use_proxy=on -e https_proxy=127.0.0.1:8082 -O $1

```
An advantage of using a keyserver like keyserver.ubuntu.com is that you can use a search term and it will return *all* keys using that term.

This file has been truncated. show original

Also related discussion:

github.com/QubesOS/qubes-issues

Saltstack is not pulling gpg keys in vm templates because 8082-proxy is not honored

opened 06:21PM - 05 Dec 21 UTC

closed 09:25PM - 08 Dec 21 UTC

100111001

R: duplicate T: enhancement C: other R: not our bug P: default

### The problem you're addressing (if any) After creating a repository in a vm …template with saltstack, it's not usable because saltstack fails to download the gpg key. This is due to the fact that vm templates are using a proxy listening at port 8082 which is not used by saltstack for downloading keys. Example: > add-repo: > pkgrepo.managed: > - name: deb http://repository.spotify.com stable non-free > - file: /etc/apt/sources.list.d/spotify-client.list > - humanname: spotify > - keyid: 5E3C45D7B312C643 > - keyserver: keys.openpgpg.org > - gpgkey: https://download.spotify.com/debian/pubkey_5E3C45D7B312C643.gpg > - gpgcheck: 1 This state is supposed to create a spotify repository. Neither the parameter `gpgkey` nor `keyid/keyserver` are working. After executing this state in a vm template, you get this error: > ID: add-repo > Function: pkgrepo.managed > Name: deb http://repository.spotify.com stable non-free > Result: False > Comment: Failed to configure repo 'deb [trusted=yes] http://repository.spotify.com stable non-free': Error: key retrieval failed: Executing: /tmp/apt-key-gpghome.xyY44SvGz1/gpg.1.sh --batch --keyserver keys.openpgpg.org --logger-fd 1 --recv-keys 5E3C45D7B312C643 > **gpg: keyserver receive failed: Network is unreachable** Of course there are workaround e.g. described here by @unman: https://github.com/unman/notes/blob/master/gpg_in_templates ### The solution you'd like Retrieving of keys should be possible by using saltstack. ### The value to a user, and who that user might be Users don't need to use workarounds to create a fully workable template. Scripts to create a template can completely rely on saltstack.

enmus · May 10, 2022, 1:11am

adw · May 10, 2022, 2:08am