Qubes Builder
Python Makefile Shell
Latest commit 24cccf3 Jan 12, 2017 @dlitz dlitz rpc-services: Fail build if dom0 hasn't been updated.
Secret tokens are now generated & returned by qubesbuilder.ExportDisk.

The new dom0 RPC scripts remain compatible with previous versions of
qubes-builder.  However, the new `make template-in-dispvm` will fail if
the old (vulnerable) dom0 RPC scripts are detected on dom0.

Signed-off-by: Dwayne Litzenberger <dlitz@dlitz.net>
Failed to load latest commit information.
build-logs .gitignore: also ignore log.old files Nov 19, 2012
doc doc: add more iso release steps Oct 5, 2016
example-configs Add entries for xenial builds Nov 27, 2016
iso gitignore update Jun 19, 2016
libs setup: use system 'python-sh' library instead of local copy Apr 18, 2015
qubes-packages-mirror-repo Update qubes-packages-mirror-repo description Apr 18, 2015
release-configs Add configs for R3.0-rc3 Sep 16, 2015
rpc-services rpc-services: Fail build if dom0 hasn't been updated. Jan 12, 2017
.gitignore Generate color sequences into a file and include it Mar 13, 2016
.setup.data Add entries for xenial builds Nov 27, 2016
Makefile.generic Revert "generic-copy-in: Use sudo when removing previous source" Aug 13, 2016
README.md Theres nothing unusual about installing using dnf Mar 14, 2016
qubes-developers-keys.asc Add old Woju's keys revocation certificates Jan 8, 2016
qubes-release-1-signing-key.asc Update qubes-release-1-signing-key.asc Apr 15, 2012
qubes-release-2-signing-key.asc New Release 2 signing key: qubes-release-2-signing-key.asc Nov 15, 2012
qubes-release-3-signing-key.asc Introduce qubes-release-3-signing-key.asc Nov 19, 2014
qubes-release-3.0-signing-key.asc Add symlinks for release 3.x keys Apr 14, 2016
qubes-release-3.1-signing-key.asc Add symlinks for release 3.x keys Apr 14, 2016
win-mksrcimg.sh Update windows-image target scripts for new builder-windows plugin Jul 1, 2015
win-mountsrc.sh windows: mount source image read-only by default Dec 6, 2015


This repository contains an automated build system for Qubes, that downloads, builds and packages all the Qubes components, and finally should spit out a ready-to-use installation ISO.

In order to use it one should use an rpm-based distro, like Fedora, and should ensure the following packages are installed:

  • git
  • createrepo
  • rpm-build
  • rpm-sign (if signing of build packages is enabled)
  • rpmdevtools
  • make
  • python-sh
  • dialog

Usually one can install those packages by just issuing:

$ sudo dnf install git createrepo rpm-build rpm-sign make python-sh rpmdevtools rpm-sign dialog

for older Fedora or CentOS versions use:

$ sudo yum install git createrepo rpm-build rpm-sign make python-sh rpmdevtools rpm-sign dialog

Or just install them automatically by issuing:

$ make install-deps

The build system creates build environments in chroots and so no other packages are needed on the host. All files created by the build system are contained within the qubes-builder directory. The full build requires some 25GB of free space, so keep that in mind when deciding where to place this directory.

The build system is configured via builder.conf file -- one should copy selected file from example-configs/, and modify it as needed, e.g.:

cp example-configs/qubes-os-master.conf builder.conf 
# edit the builder.conf file and set the following variables: 
# GIT_PREFIX="marmarek/qubes-" 
# NO_SIGN="1"

Alternatively you can use setup script, which will help you to create the configuration interactively.

One additional useful requirement is that 'sudo root' work without any prompt, which is default on most distros (e.g. 'sudo bash' brings you the root shell without asking for any password). This is important as the builder needs to switch to root and then back to user several times during the build process (mainly to preform chroot). But do not call make directly as root.

Additionally, if building with signing enabled (so NO_SIGN is not set), one must set SIGN\_KEY in builder.conf.

It is also recommended to use an empty passphrase for the private key used for signing. Contrary to a popular belief, this doesn't affect your key or sources security -- if somebody compromised your system, then the game is over, whether you use additional passphrase for the key or not.

To build all Qubes packages one would do:

$ make qubes-os-iso

And this should produce a shiny new ISO.

One can also build selected component separately. E.g. to compile only gui virtualization agent/daemon:

$ make gui-daemon

You can also build the whole template in DispVM:

$ make template-in-dispvm

For details see doc/ directory.