New Arch Template

General Discussion
1

I have just uploaded a fresh build of the Arch template.

It’s possible to build arch templates using qubes builder. Simply select
archlinux as a target in ./setup, run make get-sources, make qubes-vm, and make template.

If you are not sure about building for yourself, or don’t have time, you
can download a pre-built template for 4.0 from https://qubes.3isec.org/Templates

All my templates, packages and repositories are signed with
my Qubes Signing key - you can get this from any keyserver. You
should check this against other sources - the Qubes-Users mailing list,
GitHub, maybe another keyserver
over Tor.

You should do something like this, in a Fedora based disposableVM:
Download the arch template from https://qubes.3isec.org/Templates

Once you have downloaded and confirmed my “Qubes OS signing key”, add it to
your rpm keyring:
sudo rpm --import <downloaded_key>

Check the signature on the template:
rpm -K <Template_file>
If all is well you will see “digests signatures OK”

Once you are satisfied, install the Template.
To do this you will need to copy it to dom0. In dom0 run:
qvm-run -p <qube where you downloaded template> 'cat <path to template>' > archtemplate

Then install, in dom0 :
sudo dnf install <path to archtemplate>

This version has the Qubes arch repository enabled. It’s been pointed
out to me that that repository isn’t being updated for some reason, but
this should be fixed soon.
Also, I noticed tonight that sound isn’t working in this template -
annoying. I’ll fix it.

3 Likes
2

I use my own built template and repository.

But thank you for all Qubes-OS users that can’t build or don’t want to build by themselves.

Your update will help to enlarge the number of ArchLinux users with Qubes-OS. :+1:

3

thanks unman!!
:+1::+1:
hopefully soon I will be able to build my own templates but for now I am still learning Qubes and all that it has to offer, which coming from windows can be very challenging even though I use Linux on occasions but now going full time Linux.

Thank you for all that you do for the community, without people like you it would be very hard for us new comers to progress

4

What is current state of Archlinux template on 4.1 ?

5

Do you want one? I have assumed that people working on 4.1 would be
building their own.

6

Yes, if you can, I was glad Unman :slight_smile:

7

@unman how to fix this?

[user@archlinux ~]$ sudo pacman -Suuy
:: Synchronizing package databases...
 qubes-r4.0-current is up to date
 core                  133.8 KiB   198 KiB/s 00:01 [----------------------] 100%
 extra                1549.6 KiB   473 KiB/s 00:03 [----------------------] 100%
 community               5.6 MiB   675 KiB/s 00:08 [----------------------] 100%
 multilib is up to date
:: Starting full system upgrade...
warning: qubes-gpg-split: downgrading from version 2.0.50-1 to version 2.0.49-1
warning: qubes-vm-core: downgrading from version 4.0.61-15 to version 4.0.57-15
warning: qubes-vm-gui: downgrading from version 4.0.36-10 to version 4.0.35-10
warning: qubes-vm-pulseaudio: downgrading from version 4.0.36-10 to version 4.0.35-10
warning: qubes-vm-utils: downgrading from version 4.0.32-10 to version 4.0.31-10
resolving dependencies...
warning: cannot resolve "python2-pillow", a dependency of "qubes-vm-utils"
warning: cannot resolve "python2-pillow", a dependency of "qubes-vm-utils"
:: The following package cannot be upgraded due to unresolvable dependencies:
      qubes-vm-utils

:: Do you want to skip the above package for this upgrade? [y/N]
8

Dont downgrade - the Qubes repository hasnt been updated for months.
Why? I dont know.

9

Sometimes I wonder if Qubes OS is still maintained… I would be very sad, if not.

i.e. at the moment I can’t even

qubes-dom0-update qubes-template-fedora-33-minimal

in dom0. So I had to use fedora-33 as underlying template. Then the arch-build process hangs in a loop which produces

[user@arch-builder qubes-builder]$ make template

[user@arch-builder build-logs]$ tail -n30 template-archlinux.log
warning: cannot resolve “qubes-libvchan-xen”, a dependency of “qubes-vm-gui”
warning: cannot resolve “qubes-vm-gui”, a dependency of “qubes-vm-dependencies”
warning: cannot resolve “pulseaudio<14.3”, a dependency of “qubes-vm-pulseaudio”
warning: cannot resolve “qubes-vm-pulseaudio”, a dependency of “qubes-vm-dependencies”
:: The following package cannot be upgraded due to unresolvable dependencies:
qubes-vm-dependencies

:: Do you want to skip the above package for this upgrade? [y/N] error: failed to prepare transaction (could not satisfy dependencies)

:: unable to satisfy dependency ‘python2-lxml’ required by qubes-vm-xen
:: unable to satisfy dependency ‘qubes-vm-xen’ required by qubes-vm-dependencies
:: unable to satisfy dependency ‘python2-lxml’ required by qubes-vm-xen
:: unable to satisfy dependency ‘qubes-vm-xen’ required by qubes-libvchan-xen
:: unable to satisfy dependency ‘qubes-libvchan’ required by qubes-vm-utils
:: unable to satisfy dependency ‘python2-pillow’ required by qubes-vm-utils
:: unable to satisfy dependency ‘qubes-vm-utils’ required by qubes-vm-core
:: unable to satisfy dependency ‘python2-lxml’ required by qubes-vm-xen
:: unable to satisfy dependency ‘qubes-vm-xen’ required by qubes-libvchan-xen
:: unable to satisfy dependency ‘qubes-libvchan’ required by qubes-vm-core
:: unable to satisfy dependency ‘python2-lxml’ required by qubes-vm-xen
:: unable to satisfy dependency ‘qubes-vm-xen’ required by qubes-libvchan-xen
:: unable to satisfy dependency ‘qubes-libvchan-xen’ required by qubes-db-vm
:: unable to satisfy dependency ‘qubes-db-vm’ required by qubes-vm-core
:: unable to satisfy dependency ‘qubes-vm-core’ required by qubes-vm-dependencies
:: unable to satisfy dependency ‘python2-lxml’ required by qubes-vm-xen
:: unable to satisfy dependency ‘qubes-vm-xen’ required by qubes-libvchan-xen
:: unable to satisfy dependency ‘qubes-libvchan-xen’ required by qubes-vm-gui
:: unable to satisfy dependency ‘qubes-vm-gui’ required by qubes-vm-dependencies
:: unable to satisfy dependency ‘pulseaudio<14.3’ required by qubes-vm-pulseaudio
:: unable to satisfy dependency ‘qubes-vm-pulseaudio’ required by qubes-vm-dependencies

Which raises the question: why are we still using python2?

10

My writeup… this time using fedora-30-minimal as builder-template.

in dom0:

sudo qubes-dom0-update qubes-template-fedora-30-minimal
qvm-run -u root fedora-33-minimal xterm

in fedora-30-minimal template:

dnf upgrade
dnf install qubes-core-agent-passwordless-root qubes-core-agent-networking iproute
vi /etc/profile.d/99-makeflags.sh

using vi:

export GNUMAKEFLAGS=“-j$(nproc) -l$(nproc)”
export MAKEFLAGS=“-j$(nproc) -l$(nproc)”
[esc]:wq

shutdown fedora-30-minimal template:

shutdown now

in dom0:

qvm-create -r fedora-30-minimal -l red arch-builder
qvm-prefs arch-builder vcpus $(nproc)
qvm-prefs arch-builder memory 4000
qvm-prefs arch-builder maxmem 4000

set “private storage max. size” to 16000MB with Qube-Manager-GUI.

fire up arch-builder and run in terminal:

resize -s 30 100
sudo dnf install -y git make
gpg2 --import /usr/share/qubes/qubes-master-key.asc
gpg2 --edit-key 0x427F11FD0FAA4B080123F01CDDFA1A3E36879494

fpr
trust

5 (+y)

quit

curl -O https://keys.qubes-os.org/keys/qubes-developers-keys.asc
gpg2 --import qubes-developers-keys.asc
git clone GitHub - QubesOS/qubes-builder: Qubes Builder $HOME/qubes-builder/
cd $HOME/qubes-builder/
git tag -v $(git describe)
make install-deps
./setup

Yes
Yes
* Qubes Release 4.0
* QubesOS/qubes- Stable - Default Repo
No (normal cloning)
* current - Stable repository
No (complete build)
* archlinux (only)
* builder-rpm
* builder-archlinux
*mgmt-salt
Yes (download and merge sources)
OK (use Pre-built Packages)

make remount
make install-deps
make get-sources
make qubes-vm

There I run into errors, while untar-ing stuff and missing a mountpoint. After retries, I get errors like “coulnd_t open file /tmp/qubes-packages-mirror–rop/pkgs/qubes.db”.

make template

See my post above.

1 Like
11

@unman can we get an own Arch Linux “subreddit” in this forum?

Since I couldn’t get the build to go through I tried your pre-built which works great. However, I got issues with NetworkManager (can’t make a VPN config persistent), which I use for VPN connectivity and noticed that i.e.

/usr/lib/systemd/system/NetworkManager.service.d/30_qubes.conf

is missing, but a different Drop-in is loaded:

/usr/lib/systemd/system/NetworkManager.service.d/NetworkManager-ovs.conf

So, this very probably is a Qubes issue, and I would like to start a thread if possible in a seperate “arch subreddit”.

12

@unman can we get an own Arch Linux “subreddit” in this forum?

Since I couldn’t get the build to go through I tried your pre-built which works great. However, I got issues with NetworkManager (can’t make a VPN config persistent), which I use for VPN connectivity and noticed that i.e.

/usr/lib/systemd/system/NetworkManager.service.d/30_qubes.conf

is missing, but a different Drop-in is loaded:

/usr/lib/systemd/system/NetworkManager.service.d/NetworkManager-ovs.conf

So, this very probably is a Qubes issue, and I would like to start a thread if possible in a seperate “arch subreddit”.

I suspect this is not particularly an Arch issue - what steps have you
taken to make sure that that file persists across reboots? Or are you
saying that that file persists?

Have you tried to use bind-dirs?

As to the Arch build, it seems fine at the moment. What issues did
you have? Make a separate issue under user Support.

Whether there is sufficient interest in a separate Arch Linux section, I
don’t know. I’ll leave that to others.

13

I’d also be highly interested in a section for Arch Linux, and if I have to guess based on these survey results: 1, 2 many others do as well, specially since there’s usually the need to do “custom patching” to make the building work (and the repos not being updated since a long time makes it even harder).

Ideally, the isos and pkgs should be built by the CI environment (even if they won’t be officially supported for the time being), so all our efforts are targeted in a single place instead of everyone spending countless hours individually to make these work.

1 Like
14

The Arch build is relatively stable apart from the difficulties you
expect when working with any rolling distro, so I’m surprised it should
cause such grief.
I raised an open issue about updating the repository - after 4.1 is out,
there may be time to get the official Arch builds back up to date.

1 Like
15

Thanks for your quick reply. I’m going to make a new thread for the VPN-issue.

Since I use your Arch Linux pre-build now (downloaded from a complete stranger at the internet :wink: ), I might want to leave the build-issue to others who encounter problems. Or come back to it in case I am overcome by ambition.

16

See the latest issues for example:

I’ve seen this cycle a lot of times since I’m using qubes (for many years), collective effort is being wasted troubleshooting these issues, and that PRs that solve the issues hangs for days without supervision slow downs the process:

I understand archlinux is not officially supported, however it has proven to be very valuable for users to use in Qubes (and the userbase is not so small after all based on the survey results). So if you need any support to complete the CI integration, please open an issue with the list of tasks to be done and I (along with other interested community members) will help to get it done.

1 Like
17

Just installed ArchLinux with https://qubes.3isec.org/Templates/

I was able to install the template. When I try to pacman -Suuy this appears:

[user@archlinux ~]$ sudo pacman -Suuy
:: Synchronizing package databases...
 core is up to date
 extra is up to date
 community is up to date
 multilib is up to date
:: Starting full system upgrade...
resolving dependencies...
looking for conflicting packages...
error: failed to prepare transaction (could not satisfy dependencies)
:: installing pulseaudio (16.1-1) breaks dependency 'pulseaudio<=15.0' required by qubes-vm-pulseaudio

How to solve?

18

It’s a known issue and updated packages are on the way.
Rolling distros (as with Debian testing) are always prone to playing
catchup like this.

19

I see!
Thank you a lot for your immediate answer, I appreciate a lot.

20

I believe @unman signing key has also expired, which impacts on the updating of the arch template.