Debian Template: rely on existing tool for base image creation

[adrelanos]

Creation of Debian base (raw) images is non-trivial. That's usually done by people dedicating maintenance to separate projects. Such as grml-debootstrap [bash] installable from official Debian repositories or image-bootstrap [python] [it's developer is more active and really cares about doing-things-right(tm)] [hopefully one day in Debian]. [image-bootstrap might even one day get Fedora base image creation support. (https://github.com/hartwork/image-bootstrap/issues/14)]

You are basically re-inventing the wheel here. Going through the learning process that for example grml-deboostrap went through.

I am wondering if we should use such a dedicated tool for the Debian base image creation. It would most likely solve issues such as #1033. And if not, we could dumb down issues to pure Debian issues and consult developers such as @mika, @hartwork @grml community, Debian community, etc. that are experienced with Debian base image creation.

What me made this argument:

• The locales issue (#1033). grml-debootstrap had such an issue, that was fixed by me. (grml/grml-debootstrap#25)
• The qubes-linux-template-builder Debian apt-get --force-yes --yes security issue, that was reported by @hardwork to and fixed by @mika in grml-debootstrap. (grml/grml-debootstrap#62)
• Fixed DISK_IDENTIFIER that we'll need for deterministic builds in future, that I wrote a patch for grml-debootstrap for (grml/grml-debootstrap#28), that I don't look forward reinventing for Qubes if this can be avoided.
• And other stuff that was fixed in grml-debootstrap, such as 'hard drive serial of build machine leaks into image in /boot/grub/device.map' (generally bad and bad for deterministic builds) (grml/grml-debootstrap#27) that I haven't checked yet if Qubes is affected by.
• List of other past grml-debootstrap issues that may or may not apply to Qubes.

If these tools don't work for us yet, we should reports bugs/feature requests and contribute patches upstream. I made good experiences with these upstreams. If all cords break, we'll still be better off using a temporary fork until patches are merged upstream.

[nrgaway]

Sounds awesome! I remember look at at that package long time ago when playing around with encrypting the Whonix partitions.

The basic Debian install is pretty much standard; install base, a few required packages, and some configurations like keyboard and locale. Then add on Qubes.

Will this be able to handle Ubuntu install as well?

[nrgaway]

Sounds awesome! I remember look at at that package long time ago when playing around with encrypting the Whonix partitions.

The basic Debian install is pretty much standard; install base, a few required packages, and some configurations like keyboard and locale. Then add on Qubes.

Will this be able to handle Ubuntu install as well?

[hartwork]

Hi! image-bootstrap does support Ubuntu, yes. This is what I run to install (a rather minimal Ubuntu) trusty to a (>=2GB) loop device:

sudo http_proxy=http://127.0.0.1:8123/ image-bootstrap \
  --hostname uv --password .... --verbose --debug \
  ubuntu --release trusty SOME_LOOP_DEVICE

[hartwork]

Hi! image-bootstrap does support Ubuntu, yes. This is what I run to install (a rather minimal Ubuntu) trusty to a (>=2GB) loop device:

sudo http_proxy=http://127.0.0.1:8123/ image-bootstrap \
  --hostname uv --password .... --verbose --debug \
  ubuntu --release trusty SOME_LOOP_DEVICE

[mika]

Hi, with my grml-debootstrap hat on: if there should be something specific missing in grml-debootstrap please let me/us know.

[mika]

Hi, with my grml-debootstrap hat on: if there should be something specific missing in grml-debootstrap please let me/us know.

[marmarek]

One possible issue with grml-debootstrap is that we currently use Fedora as distribution used to build Qubes templates. There is debootrap package available, but not grml-debootstrap. So builder-debian plugin needs to handle it somehow.
But generally reusing existing code is a good idea :)

[marmarek]

One possible issue with grml-debootstrap is that we currently use Fedora as distribution used to build Qubes templates. There is debootrap package available, but not grml-debootstrap. So builder-debian plugin needs to handle it somehow.
But generally reusing existing code is a good idea :)

[adrelanos]

Depends when this gets implemented and when Fedora gets thrown out. (The plan is to throw out Fedora anyhow. Source: #1054 (comment))
The earlier it's thrown out, the better. You also would not have to figure out how to upgrade dom0 from Fedora 20 to Fedora 21 then.
No idea how much work throwing out Fedora is, though. Just wanted to mention this.

[adrelanos]

Depends when this gets implemented and when Fedora gets thrown out. (The plan is to throw out Fedora anyhow. Source: #1054 (comment))
The earlier it's thrown out, the better. You also would not have to figure out how to upgrade dom0 from Fedora 20 to Fedora 21 then.
No idea how much work throwing out Fedora is, though. Just wanted to mention this.