Consider adding anti-evil-maid package to R3.2 iso

[rustybird]

If QubesOS/qubes-antievilmaid#14 is merged, AEM would be totally inactive (and hidden in the GRUB menu anyway) for users who haven't run anti-evil-maid-install.

[marmarek]

This is somehow related to #803. Maybe even a duplicate?
We're quite late in R3.2 release cycle, but if it indeed will be inactive by default, the regression risk is low and I'm for it.

[marmarek]

This is somehow related to #803. Maybe even a duplicate?
We're quite late in R3.2 release cycle, but if it indeed will be inactive by default, the regression risk is low and I'm for it.

[rustybird]

We're quite late in R3.2 release cycle, but if it indeed will be inactive by default, the regression risk is low and I'm for it.

I don't want to break the iso build (which is hard to test for me right now, my notebook is throttled down all the way due to overheating). Will these two commands be a problem in such a context?

https://github.com/rustybird/qubes-antievilmaid/blob/608b894ee2355eb7c75ec962c052c5262e5d66a0/anti-evil-maid/anti-evil-maid.spec#L61-L62

[rustybird]

We're quite late in R3.2 release cycle, but if it indeed will be inactive by default, the regression risk is low and I'm for it.

I don't want to break the iso build (which is hard to test for me right now, my notebook is throttled down all the way due to overheating). Will these two commands be a problem in such a context?

https://github.com/rustybird/qubes-antievilmaid/blob/608b894ee2355eb7c75ec962c052c5262e5d66a0/anti-evil-maid/anti-evil-maid.spec#L61-L62

[rustybird]

Sorry, let me rephrase that: The iso build shouldn't break, but maybe the %post scriptlet would not work inside of Anaconda?

[rustybird]

Sorry, let me rephrase that: The iso build shouldn't break, but maybe the %post scriptlet would not work inside of Anaconda?

[marmarek]

At the time package is installed there may be no dracut or grub2-mkconfig yet. For this, better add:

Requires(post): dracut
Requires(post): grub2-tools

initrd + grub configuration will be regenerated anyway at the end of installation.

But I see other problem: UEFI installation. Currently tboot doesn't have native UEFI support, so it can't be directly plugged in. In such installation we don't even install grub, since xen.efi is directly plugged into UEFI BIOS.

[marmarek]

At the time package is installed there may be no dracut or grub2-mkconfig yet. For this, better add:

Requires(post): dracut
Requires(post): grub2-tools

initrd + grub configuration will be regenerated anyway at the end of installation.

But I see other problem: UEFI installation. Currently tboot doesn't have native UEFI support, so it can't be directly plugged in. In such installation we don't even install grub, since xen.efi is directly plugged into UEFI BIOS.

[rustybird]

I've updated the dependencies. Not sure what to do about UEFI

[rustybird]

I've updated the dependencies. Not sure what to do about UEFI

[marmarek]

It may be an option to add the packages, but do not install them by default - available in software selection dialog.
But since the user still needs to download SINIT file, I'm not sure if all this worth an effort.

[marmarek]

It may be an option to add the packages, but do not install them by default - available in software selection dialog.
But since the user still needs to download SINIT file, I'm not sure if all this worth an effort.

[rustybird]

Yeah, if the user would have to choose manually anyway then it doesn't seem worth the trouble.

Is it possible to tell Anaconda to only add a package when not doing an UEFI installation?

[rustybird]

Yeah, if the user would have to choose manually anyway then it doesn't seem worth the trouble.

Is it possible to tell Anaconda to only add a package when not doing an UEFI installation?

[marmarek]

Is it possible to tell Anaconda to only add a package when not doing an UEFI installation?

Theoretically yes, but it's rather hacky (there is a list of packages required for bootloader, hardcoded into anaconda itself).

[marmarek]

Is it possible to tell Anaconda to only add a package when not doing an UEFI installation?

Theoretically yes, but it's rather hacky (there is a list of packages required for bootloader, hardcoded into anaconda itself).

[rustybird]

Oh well. Maybe another time

[rustybird]

Oh well. Maybe another time