Saltstack Package Manager Feature Request

huaopeng · October 27, 2022, 7:24pm

Would it make sense to have Saltstack configuration and management integrated as a Qubes system tool?

This package manage could download a Qubes public GPG key and then download various saltstack recipes for implementing different appVM, template VM states.

fsflover · October 27, 2022, 7:32pm

github.com/QubesOS/qubes-issues

Design and create salt formulas distribution method

opened 03:31AM - 01 May 16 UTC

marmarek

T: enhancement P: major release notes ux C: mgmt

Since we've [completed VM configuration stack](https://github.com/QubesOS/qubes-…issues/issues/1541), we need some method for distributing salt formulas. Currently the base formulas (default VMs, Whonix etc) are installed as rpm packages. But this doesn't scale well, especially for community-developed formulas (because rpm package can do a lot more than putting a simple text file in `/srv/salt`, so one should install packages in dom0 only from ultimately trusted places). Standard approach for Saltstack is using git or [Salt Package Manager](https://docs.saltstack.com/en/latest/topics/spm/index.html). We may use something based on either of them, but need to add a "qrexec proxy", which will verify signatures (similar to qubes-dom0-update) (it isn't clear to me whether SPM support signatures at all...). Or we may design/use something different. Then, we'd need some UI to import/select trusted keys. The whole point here is to support 3rd-party formulas, not only those provided by ITL. While Salt formula can do whatever it like to the system (same as rpm package), it is much easier to audit, because it is just a text file, usually very short. A single formula may consists of multiple files. Example formula for installing Martus, based on https://github.com/QubesOS/qubes-issues/issues/1836#issuecomment-213575740: https://gist.github.com/marmarek/29f9a4a1f3a7a457cf2b449ab0b0e2f4 (place those files in `/srv/salt/martus`, then execute `qubesctl top.enable martus && qubesctl --all state.highstate` - only in Qubes 3.2) cc @mfc @bnvk @andrewdavidwong

huaopeng · October 27, 2022, 11:25pm

how to copy https://qubes.3isec.org/3isec-qubes-task-manager-0.1-1.x86_64.rpm into dom0?

enmus · October 28, 2022, 6:37pm

You are long enough here already to learn how to use search term “How to copy to dom0”. All I see from you are questions and doubts. Not a single try of a contribution. Sorry.
I am no of those to use aliases to say such things.

huaopeng · October 29, 2022, 3:01am

I found the wiki article…thx