Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Create qubes.AppendLog service #2023

Closed
rootkovska opened this issue May 24, 2016 · 2 comments
Closed

Create qubes.AppendLog service #2023

rootkovska opened this issue May 24, 2016 · 2 comments
Labels
C: other T: enhancement Type: enhancement. A new feature that does not yet exist or improvement of existing functionality.
Milestone
Release 4.0

Comments

@rootkovska
Copy link
Member

Very useful to e.g. gather build logs in a reliable way, i.e. even if the build VM gets compromised during the build process (e.g due to curl|bash in a Makefile), the log can still be meaningful. Also for many other uses. Related to #830.
@rootkovska rootkovska added T: enhancement Type: enhancement. A new feature that does not yet exist or improvement of existing functionality. C: other T: task Type: task. An action item that is neither a bug nor an enhancement. labels May 24, 2016
@rootkovska rootkovska added this to the Release 4.0 milestone May 24, 2016
marmarek added a commit to marmarek/qubes-builder that referenced this issue Dec 6, 2016
@marmarek
Don't enable external logging by default
45b96ec 
Require explicit call to scripts/make-with-log.
Later will be plugged in build automation.

QubesOS/qubes-issues#2023
marmarek added a commit to marmarek/qubes-builder that referenced this issue Dec 6, 2016
@marmarek
Log only status of selected git repositories
43b1221 
Take a look at COMPONENTS setting. This way single-component build log
is not trashed with a status of all the repositories.

QubesOS/qubes-issues#2023
marmarek added a commit to marmarek/qubes-builder that referenced this issue Dec 6, 2016
@marmarek
build-log: call post-log-hook for possible logs uploading
d7cc141 
QubesOS/qubes-issues#2023
marmarek added a commit to marmarek/qubes-builder that referenced this issue Dec 6, 2016
@marmarek
build-log: call post-log-hook for possible logs uploading
f7fa9db 
QubesOS/qubes-issues#2023
@marmarek marmarek mentioned this issue Dec 6, 2016
Closed
marmarek added a commit to marmarek/old-qubes-builder-debian that referenced this issue Dec 17, 2016
@marmarek
template: log hashes of all downloaded packages before installation
f1e2283 
This, connected with append-only build log (QubesOS/qubes-issues#2023)
will allow for meaningful inspection what really got installed during
template build, even if signature verification is buggy, or release
signing key is compromised.

Adding this for debootstrap - after downloading but before installing
packages is somehow complex. Split the operation into two phases - first
download all the packages, then install them. Point at local directory
for the second run to not download packages (or repository metadata)
the second time. That local directory needs to have proper repository
metadata.
marmarek added a commit to QubesOS/qubes-builder-debian that referenced this issue Dec 17, 2016
@marmarek
template: log hashes of all downloaded packages before installation
03a2fac 
This, connected with append-only build log (QubesOS/qubes-issues#2023)
will allow for meaningful inspection what really got installed during
template build, even if signature verification is buggy, or release
signing key is compromised.

Adding this for debootstrap - after downloading but before installing
packages is somehow complex. Split the operation into two phases - first
download all the packages, then install them. Point at local directory
for the second run to not download packages (or repository metadata)
the second time. That local directory needs to have proper repository
metadata.

(cherry picked from commit f1e2283)
@marmarek marmarek mentioned this issue Dec 17, 2016
Closed
@andrewdavidwong
Copy link
Member

HW42 has generously submitted a patch for this based on the proposal in the post Security challenges for the Qubes build process.

andrewdavidwong added a commit that referenced this issue Dec 17, 2016
@andrewdavidwong
Track #2023
f0b52fa
@marmarek marmarek mentioned this issue Dec 17, 2016
Closed
marmarek added a commit to marmarek/qubes-builder that referenced this issue Dec 18, 2016
@marmarek
Do not recurse indefinitely
910a7db 
GIT_REPOS variable may contains qubes-builder itself, as ".".

Fixes 43b1221 "Log only status of selected git repositories"

QubesOS/qubes-issues#2023
marmarek added a commit to marmarek/qubes-builder that referenced this issue Dec 19, 2016
@marmarek
build-log: fix timestamp loging
03e412e 
Default value for keyword argument is calculate at function definition
time, not a call time. So the previous version basically logged script
start time.

QubesOS/qubes-issues#2023
marmarek added a commit to marmarek/qubes-builder that referenced this issue Jan 24, 2017
@marmarek
build-log: make the code easier to read
bfe8112 
Don't replace sys.stdin, use os.path.join, make it clear that file_name
is always set to something.

QubesOS/qubes-issues#2023
@marmarek
Copy link
Member

marmarek commented Mar 7, 2017

@HW42 implementation is already integrated and enabled: #1818 , https://github.com/QubesOS/build-logs

@marmarek marmarek closed this as completed Mar 7, 2017
marmarek added a commit to marmarek/qubes-builder-rpm that referenced this issue May 15, 2017
@marmarek
Log hashes of download packages before installing them
4fc7afb 
Follow the change in builder-debian f1e2283 "template: log hashes of all
downloaded packages before installation". This will allow better
verification of template build process.
Simplify the process by dropping support for templates without yum/dnf
installed. It is always installed by prepare-chroot-base, if not -
that's an error.

Related: QubesOS/qubes-issues#2023
marmarek added a commit to marmarek/qubes-builder-rpm that referenced this issue May 15, 2017
@marmarek
Log hashes of download packages before installing them
ebbe5f1 
Follow the change in builder-debian f1e2283 "template: log hashes of all
downloaded packages before installation". This will allow better
verification of template build process.
Simplify the process by dropping support for templates without yum/dnf
installed. It is always installed by prepare-chroot-base, if not -
that's an error.

Related: QubesOS/qubes-issues#2023
marmarek added a commit to marmarek/qubes-builder-rpm that referenced this issue May 15, 2017
@marmarek
Log hashes of download packages before installing them
3825e63 
Follow the change in builder-debian f1e2283 "template: log hashes of all
downloaded packages before installation". This will allow better
verification of template build process.
Simplify the process by dropping support for templates without yum/dnf
installed. It is always installed by prepare-chroot-base, if not -
that's an error.

Related: QubesOS/qubes-issues#2023
marmarek added a commit to marmarek/qubes-builder-rpm that referenced this issue May 15, 2017
@marmarek
Log hashes of download packages before installing them
cde0526 
Follow the change in builder-debian f1e2283 "template: log hashes of all
downloaded packages before installation". This will allow better
verification of template build process.
Simplify the process by dropping support for templates without yum/dnf
installed. It is always installed by prepare-chroot-base, if not -
that's an error.

Related: QubesOS/qubes-issues#2023
marmarek added a commit to marmarek/qubes-builder-rpm that referenced this issue May 15, 2017
@marmarek
Log hashes of download packages before installing them
17db253 
Follow the change in builder-debian f1e2283 "template: log hashes of all
downloaded packages before installation". This will allow better
verification of template build process.
Simplify the process by dropping support for templates without yum/dnf
installed. It is always installed by prepare-chroot-base, if not -
that's an error.

Related: QubesOS/qubes-issues#2023
andrewdavidwong added a commit that referenced this issue Oct 19, 2017
@andrewdavidwong
Untrack #2023 (complete)
016037e
@redshiftzero redshiftzero mentioned this issue Oct 23, 2019
Closed
@andrewdavidwong andrewdavidwong removed the T: task Type: task. An action item that is neither a bug nor an enhancement. label Jan 17, 2023
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
C: other T: enhancement Type: enhancement. A new feature that does not yet exist or improvement of existing functionality.
Projects
None yet
Milestone
Release 4.0
Development

No branches or pull requests
3 participants
@marmarek @rootkovska @andrewdavidwong