Signal Desktop - how to install for use in multiple app VMs

pmb-nl · July 20, 2021, 5:26pm

What is the best practice for installing apps that I would like to use in more VMs?
In the template OS VM that App VMs are based on?

I tried to install Signal Desktop but with the key installation I already got the first error.
Any suggestions would be appreciated.

Would be nice if the standard list op applications could be extended with more applications that are commonly used for work or private life. This can lower the barrier for the non-Linux guru users to actually use the OS and to also supply feedback for the usability side that can aid in making this initiative more successful.

Sven · July 20, 2021, 7:52pm

This is how to install signal in a debian-10-minimal template, it will
for sure work for a debian-10 template too. I don’t know how to install
it in Fedora.

sudo su -

apt install --no-install-recommends curl qubes-core-agent-networking dunst

curl --proxy http://127.0.0.1:8082/ -s
https://updates.signal.org/desktop/apt/keys.asc | apt-key add -

echo “deb [arch=amd64] http://HTTPS///updates.signal.org/desktop/apt
xenial main” | tee -a /etc/apt/sources.list.d/signal-xenial.list

apt update
apt full-upgrade
apt install --no-install-recommends signal-desktop

Sven · July 20, 2021, 8:22pm

Sorry, I made a mistake in copy & paste there. The like should be:

echo "deb [arch=amd64]https://updates.signal.org/desktop/apt xenial 
main" | tee -a /etc/apt/sources.list.d/signal-xenial.list

pmb-nl · July 21, 2021, 1:04pm

Hello Sven,

Thanks for the help! It worked and I could install Signal successfully.
At first there was an error but I discovered that a space was missing in the echo command between …amd64] and https://…

Best regards,

Peter

Jac11 · July 29, 2021, 9:18pm

hi Sven,
I am a not familiar with linux command line.

I tried to copy-paste commands in Debian template terminal, as mentioned in Singal website

But it gave error - resolving updates.signal.org…failed : temporary failure in name resolution.
wget : unable to resolve host address ‘updates.signal.org’
gpg : no valid OpenPGP data found.

Can you help explain in detail how to install Signal in Qubes-Debian ?

Thanks.

Sven · July 29, 2021, 10:14pm

Hi @Jac11, I’ll explain in more detail:

The first line installs the curl program needed to download the signal signing key. This is just like on the signal website. I added two more packages: one to enable networking and the other to install a basic notifications daemon (xfce4-notifyd would be an alternative to dunst). These additions are only needed for debian-minimal templates and if you are using the standard debian template you only need to install curl.

apt install --no-install-recommends curl qubes-core-agent-networking dunst

The next line is also straight from the signal website, but I added --proxy http://127.0.0.1:8082/ to the curl command:

curl --proxy http://127.0.0.1:8082/ -s https://updates.signal.org/desktop/apt/keys.asc | apt-key add -

You wrote:

I tried to copy-paste commands in Debian template terminal, as mentioned in Singal website. But it gave error - resolving updates.signal.org…failed : temporary failure in name resolution. wget : unable to resolve host address ‘updates.signal.org’

The reason for the error is that curl was not able to connect to the internet to download the signing key for the signal package. In Qubes OS templates do not have networking access for good reason. However, to be able to install software via the ‘apt’ command there is a proxy service provided that gives network access. This proxy is at localhost (127.0.0.1) port 8082.

So by adding the --proxy http://127.0.0.1:8082/ parameter to the curl command you are telling it how to connect to the internet. Then the download works.

You also saw:

gpg : no valid OpenPGP data found.

The later part of the above command apt-key add - adds the downloaded key to your system so signal packages can be verified. However since your download failed there was not key, hence the error.

The next lines are straight from the signal homepage again:

echo "deb [arch=amd64] https://updates.signal.org/desktop/apt xenial main" | tee -a /etc/apt/sources.list.d/signal-xenial.list

… adds the signal repository to your system.

apt update

… fetches all repositories (now including the newly added signal repository)

apt full-upgrade

… brings your qube up-to-date.

apt install --no-install-recommends signal-desktop

… actually and finally installs signal.

deeplow · August 5, 2021, 7:35pm

There is a signal guide on the community docs. Maybe it needs an update (haven’t checked if it’s broken or not). See

github.com

Qubes-Community/Contents/blob/master/docs/privacy/signal.md


Signal
======

What is [Signal]?

[According to Wikipedia:][signal-wikipedia]

> Signal is an encrypted instant messaging and voice calling application
> for Android and iOS. It uses end-to-end encryption to secure all
> communications to other Signal users. Signal can be used to send and receive
> encrypted instant messages, group messages, attachments and media messages.
> Users can independently verify the identity of their messaging correspondents
> by comparing key fingerprints out-of-band. During calls, users can check the
> integrity of the data channel by checking if two words match on both ends of
> the call.
> 
> Signal is developed by Open Whisper Systems. The clients are published as free
> and open-source software under the GPLv3 license.

This file has been truncated. show original

stonethegerlad · November 21, 2021, 7:23am

hi @Sven I have successfully installed signal desktop on R4.0 but it first said failed to connect to server when trying to connect to the internet. is there a command to run a different port other than the :8082 or is this a firewall/proxy setting?

Sven · November 21, 2021, 9:21pm

@stonethegerlad:

have you set a netvm for this qube?
are any firewall rules set?
have you installed it based on debian-minimal?
have you installed qubes-core-agent-networking?

deeplow · April 21, 2022, 7:09am

Quoting an alternative full soution: (the following commands should be ran in dom0).

Curl-proxy / wget-proxy scripts in Templates so users can add GPG distro keys linked to added external repositories

Please allow me to leave this here for all the lost souls finding this thread in an attempt to install signal:
#!/bin/bash

min_template=debian-11-minimal
signal_template=deb-11-signal

# clone

qvm-clone $min_template $signal_template

# install networking, curl, notification daemon & nautilus

qvm-run --pass-io -u root $signal_template "apt install --no-install-recommends qubes-core-agent-passwordless-root qubes-core-agent-networking curl xfce4-notifyd nautilus qubes-core-agent-nautilus zenity -y"

# add signal key & repo

qvm-run --pass-io -u root $signal_template "curl --proxy http://127.0.0.1:8082/ -s https://updates.signal.org/desktop/apt/keys.asc | apt-key add -"
qvm-run --pass-io -u root $signal_template 'echo "deb [arch=amd64] https://updates.signal.org/desktop/apt xenial main" | tee -a /etc/apt/sources.list.d/signal-xenial.list'

# update & install signal

qvm-run --pass-io -u root $signal_template "apt update && apt full-upgrade -y && apt install --no-install-recommends signal-desktop -y && poweroff"
This will obviously also work with a debian-10, debian-10-minimal or a debian-11 template. The notification daemon is required, otherwise signal will hang the first time you get a message and the focus was away from the app. Nautilus is not required but obviously useful when handling files.

anon42456682 · April 26, 2022, 6:00pm

Thanks! This worked for me.