Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Sync appmenus in package postinst #2078

Open
rocodes opened this issue Jun 28, 2024 · 1 comment
Open

Sync appmenus in package postinst #2078

rocodes opened this issue Jun 28, 2024 · 1 comment

Comments

@rocodes
Copy link
Contributor

rocodes commented Jun 28, 2024

Description

Rather than syncing appmenus from dom0 (via Salt or scripted), when packages change we can request an appmenu sync via the built-in appmenu sync RPC call provided in (istr?) qubes-core-agent-linux in our own package's postisnt:

qrexec-client-vm dom0 qubes.SyncAppMenus /etc/qubes-rpc/qubes.GetAppmenus

legoktm added a commit to freedomofpress/securedrop-workstation that referenced this issue Jun 28, 2024
These are the only two VMs that will be visible on production systems
and have specific tools we want users to be able to directly start.

* sd-devices: Files (Nautilus) and Disks
* sd-whonix: Anon Connection Wizard and Tor Control Panel

Ideally we would do all of this in salt, but since we need to run stuff
via dom0 after we do things in the VMs, it would require adjusting the
order of some salt states, which is a bit too intrusive for a fix during
the RC/QA period.

A TODO indicates that this is not an ideal situation, and
<freedomofpress/securedrop-client#2078> tracks
one potential fix.

Fixes #520.
Fixes #1109.
legoktm added a commit to freedomofpress/securedrop-workstation that referenced this issue Jun 28, 2024
These are the only two VMs that will be visible on production systems
and have specific tools we want users to be able to directly start.

* sd-devices: Files (Nautilus) and Disks
* sd-whonix: Anon Connection Wizard and Tor Control Panel

Ideally we would do all of this in salt, but since we need to run stuff
via dom0 after we do things in the VMs, it would require adjusting the
order of some salt states, which is a bit too intrusive for a fix during
the RC/QA period.

A TODO indicates that this is not an ideal situation, and
<freedomofpress/securedrop-client#2078> tracks
one potential fix.

Fixes #520.
Fixes #1109.
legoktm added a commit to freedomofpress/securedrop-workstation that referenced this issue Jun 28, 2024
These are the only two VMs that will be visible on production systems
and have specific tools we want users to be able to directly start.

* sd-devices: Files (Nautilus) and Disks
* sd-whonix: Anon Connection Wizard and Tor Control Panel

Ideally we would do all of this in salt, but since we need to run stuff
via dom0 after we do things in the VMs, it would require adjusting the
order of some salt states, which is a bit too intrusive for a fix during
the RC/QA period.

A TODO indicates that this is not an ideal situation, and
<freedomofpress/securedrop-client#2078> tracks
one potential fix.

Fixes #520.
Fixes #1109.
@rocodes
Copy link
Contributor Author

rocodes commented Jul 1, 2024

Took another look cause based on the slightly complicated script stuff evolving in freedomofpress/securedrop-workstation#1112 it would be nice to keep it simple and out of dom0/into rpc.

In the qubes-core-agent-linux package there's a post-install RPC (/etc/qubes-rpc/qubes.PostInstall) that runs all the scripts in /etc/qubes/post-install.d, one of which is the qubes-core-agent-appmenus script, which itself calls /usr/lib/qubes/qubes-trigger-sync-appmenus.sh, which does basically what I posted above. This package is in debian minimal as well as fedora, triggered by distro specific hooks (yum, debian, arch).

If we make sure we conform to behaviour that /etc/qubes-rpc/qubes.GetAppmenus understands, I don't think we have any need to trigger the appmenu sync from dom0. As for which applications to display in the qubes app menu (original issue), I'm going to look into if there's an easy way to do that in the new appmenu repo and comment in the original issue

rocodes pushed a commit to freedomofpress/securedrop-workstation that referenced this issue Jul 3, 2024
These are the only two VMs that will be visible on production systems
and have specific tools we want users to be able to directly start.

* sd-devices: Files (Nautilus) and Disks
* sd-whonix: Anon Connection Wizard and Tor Control Panel

Ideally we would do all of this in salt, but since we need to run stuff
via dom0 after we do things in the VMs, it would require adjusting the
order of some salt states, which is a bit too intrusive for a fix during
the RC/QA period.

A TODO indicates that this is not an ideal situation, and
<freedomofpress/securedrop-client#2078> tracks
one potential fix.

Fixes #520.
Fixes #1109.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant