security review qubes-template-whonix Makefile

[adrelanos]

Please have a look at:

• https://github.com/adrelanos/qubes-template-whonix/blob/master/Makefile
• (snapshot: https://github.com/adrelanos/qubes-template-whonix/blob/59e1e00ed4db50ad4e4cf9298dc84f04674f54f3/Makefile)

I don't understand Qubes Builder well enough to make head or tail of if the following is sane.

verify-sources:
    @true

Please have a lock at that file and close this ticket if it looks good overall.

[marmarek]

TL;DR: it's ok

While make get-sources Qubes builder does the following things:

• downloads sources from git repository - this includes git tag verification
• download and verify (detached signatures, checsums) additional sources if component requires it - done by calling get-sources and verify-sources targets in that repo (if exists)

The above is done by this script.
If get-sources target is implemented, verify-sources is also called. So if you don't need anything in verify-sources, you need just something like the above.
And indeed in this repo you don't need it, because get-sources target calls the get-sources script from qubes-builder, which takes care of signatures verification.

All that is coded to not require to calling make get-sources multiple times. When you execute initial make get-sources, the qubes-template-whonix component isn't downloaded yet so qubes-builder doesn't know about additional components. To solve this, those components are downloaded in get-sources stage here.

The alternative solution would be to add not just qubes-template-whonix to builder.conf, but the full list of components - not a big problem, but it makes dependency tracking somehow harder (you'd have Whonix template configuration partially in qubes-template-whonix and partially in qubes-builder).

[marmarek]

TL;DR: it's ok

While make get-sources Qubes builder does the following things:

• downloads sources from git repository - this includes git tag verification
• download and verify (detached signatures, checsums) additional sources if component requires it - done by calling get-sources and verify-sources targets in that repo (if exists)

The above is done by this script.
If get-sources target is implemented, verify-sources is also called. So if you don't need anything in verify-sources, you need just something like the above.
And indeed in this repo you don't need it, because get-sources target calls the get-sources script from qubes-builder, which takes care of signatures verification.

All that is coded to not require to calling make get-sources multiple times. When you execute initial make get-sources, the qubes-template-whonix component isn't downloaded yet so qubes-builder doesn't know about additional components. To solve this, those components are downloaded in get-sources stage here.

The alternative solution would be to add not just qubes-template-whonix to builder.conf, but the full list of components - not a big problem, but it makes dependency tracking somehow harder (you'd have Whonix template configuration partially in qubes-template-whonix and partially in qubes-builder).