qubes-policy-lint and qubes-policy-editor-terminal

28 views
Skip to first unread message

Ben Grande

unread,
May 18, 2023, 8:35:24 PM5/18/23
to qubes-devel
I created a standalone lint tool for the Qrexec policies, the name is
qubes-policy-lint. It is a wrapper around qrexec.policy.parser
TestPolicy|StringPolicy.

You can lint normal policies:
qubes-policy-lint /etc/qubes/policy.d/*.policy
Or policies included by !include-service:
qubes-policy-lint /etc/qubes/policy.d/include/*

There is also qubes-policy-edit-terminal, an alternative to
qubes-policy-editor by marmarta for terminal users. By default, it
opens the user policy, but you can specify any policy that is already
registered in /etc/qubes/policy.d/*.policy or
/etc/qubes/policy.d/include/. You can use it with any editor, as you are
editing a temorary copy of the policy, it doesn't matter.

I am doing vim-qrexec, will notice when ready for review, it requires
the qubes-policy-lint for linting the policies from within Vim. So I
will wait for a resolution of this topic.

Repository: https://codeberg.org/ben.grande.b/qubes-tools

Attached is my public keys for signing for code (0x00C64E14F51F9E56) and
mail (0x1B7314BF0CCC9687).

--
Benjamin Grande <ben.gr...@gmail.com>
ben.asc
signature.asc

Marek Marczykowski-Górecki

unread,
May 19, 2023, 8:53:03 AM5/19/23
to qubes-devel
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

Hi,

On Thu, May 18, 2023 at 06:20:06PM +0000, Ben Grande wrote:
> I created a standalone lint tool for the Qrexec policies, the name is
> qubes-policy-lint. It is a wrapper around qrexec.policy.parser
> TestPolicy|StringPolicy.
>
> You can lint normal policies:
> qubes-policy-lint /etc/qubes/policy.d/*.policy
> Or policies included by !include-service:
> qubes-policy-lint /etc/qubes/policy.d/include/*
>
> There is also qubes-policy-edit-terminal, an alternative to
> qubes-policy-editor by marmarta for terminal users. By default, it
> opens the user policy, but you can specify any policy that is already
> registered in /etc/qubes/policy.d/*.policy or
> /etc/qubes/policy.d/include/. You can use it with any editor, as you are
> editing a temorary copy of the policy, it doesn't matter.

Those look very useful!

I have one comment to qubes-policy-edit-terminal: when using
policy_get() (or policy_include_get()), you get a policy content and a
token. Use that token in policy_replace() call to detect race conditions
(when something else changes the same policy file in the meantime).

> I am doing vim-qrexec, will notice when ready for review, it requires
> the qubes-policy-lint for linting the policies from within Vim. So I
> will wait for a resolution of this topic.
>
> Repository: https://codeberg.org/ben.grande.b/qubes-tools

Would you like to submit those to the core-qrexec repository?

> Attached is my public keys for signing for code (0x00C64E14F51F9E56) and
> mail (0x1B7314BF0CCC9687).

- --
Best Regards,
Marek Marczykowski-Górecki
Invisible Things Lab
-----BEGIN PGP SIGNATURE-----

iQEzBAEBCAAdFiEEhrpukzGPukRmQqkK24/THMrX1ywFAmRncSgACgkQ24/THMrX
1yxfPQgAieh5yzXC/xsod05WzOaxx4f5XOaNy1MCytK3djJcPmE5AVgHIIPQzqtt
HqSPZFrZYKB7MlknUKhztu/auxQw1GR2u3BTQIhDmSpmFVYwjYWaZQPpHiMeQ05P
pM1u67+eEFsFHjPEt0mYaDvxA0HIPuIY3+D2ZLIAfUpqUwf3r88GsPJaXXL51OoH
04NJS4fAzL1UW80gk3TCt8aqkc0f5iDrG4ccVDjIn6mEhq01NGXLTPn6JMrvcQCb
THhhvWcB0TX+qF/FmKyuAEVUJNSDHCYOwvvuqHTIVuD/9pb1ctHWdCJxBy4Y1xgb
99fckFvJlILcm1UslEdatwPcd/UjPw==
=H9K+
-----END PGP SIGNATURE-----

Ben Grande

unread,
May 24, 2023, 6:29:24 AM5/24/23
to qubes...@googlegroups.com
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

On 23-05-19 14:52:57, Marek Marczykowski-Górecki wrote:
> Hi,
>
> Those look very useful!
>
> I have one comment to qubes-policy-edit-terminal: when using
> policy_get() (or policy_include_get()), you get a policy content and a
> token. Use that token in policy_replace() call to detect race conditions
> (when something else changes the same policy file in the meantime).

Will add the token argument and let the exceptions handle the rest.

Just one thing, the name "qubes-policy-editor-terminal" is non-ideal. I
just added "terminal" to the name because "qubes-policy-editor" was
taken by the GUI application implemented with:
https://github.com/QubesOS/qubes-desktop-linux-manager/pull/143

Can Qubes keep the standard of using "*-gui" for GUI applications?
Some use, some doesn't. In short, I am asking for the Qubes Team to
rename the current GUI app to qubes-policy-editor-gui, so the one
provided by this thread can be named qubes-policy-editor.

If the answer is no to the rename action, I will just add the token
argument.

> > I am doing vim-qrexec, will notice when ready for review, it requires
> > the qubes-policy-lint for linting the policies from within Vim. So I
> > will wait for a resolution of this topic.
> >
> > Repository: https://codeberg.org/ben.grande.b/qubes-tools
>
> Would you like to submit those to the core-qrexec repository?

Yes. Also take a look vim-qrexec to see if it is possible to be included
in qubes-core-qrexec: https://codeberg.org/ben.grande.b/vim-qrexec

It is not complicated, but it is extensive and written in VimScript.
It can be used in DomUs and Dom0, but the lint tool can only be run in
Dom0. If you prefer, I can start another thread to better explain it.

- --
Benjamin Grande
-----BEGIN PGP SIGNATURE-----

iNUEARYKAH0WIQRklnEdsUUe50UmvUUbcxS/DMyWhwUCZG3m8l8UgAAAAAAuAChp
c3N1ZXItZnByQG5vdGF0aW9ucy5vcGVucGdwLmZpZnRoaG9yc2VtYW4ubmV0NjQ5
NjcxMURCMTQ1MUVFNzQ1MjZCRDQ1MUI3MzE0QkYwQ0NDOTY4NwAKCRAbcxS/DMyW
h9HlAQCFIso4eOAQ9ynOf/RNYZEjOxcgfDU4Qa68kJxoR4GKDgD9FuUcOdpnFWux
CkcL740GdvTa0oNILS0hZxyFysx6cwQ=
=J7JP
-----END PGP SIGNATURE-----

Marek Marczykowski-Górecki

unread,
May 24, 2023, 6:35:50 AM5/24/23
to qubes...@googlegroups.com, Marta Marczykowska-Górecka
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

On Wed, May 24, 2023 at 10:29:07AM +0000, Ben Grande wrote:
> On 23-05-19 14:52:57, Marek Marczykowski-Górecki wrote:
> > Hi,
> >
> > Those look very useful!
> >
> > I have one comment to qubes-policy-edit-terminal: when using
> > policy_get() (or policy_include_get()), you get a policy content and a
> > token. Use that token in policy_replace() call to detect race conditions
> > (when something else changes the same policy file in the meantime).
>
> Will add the token argument and let the exceptions handle the rest.
>
> Just one thing, the name "qubes-policy-editor-terminal" is non-ideal. I
> just added "terminal" to the name because "qubes-policy-editor" was
> taken by the GUI application implemented with:
> https://github.com/QubesOS/qubes-desktop-linux-manager/pull/143
>
> Can Qubes keep the standard of using "*-gui" for GUI applications?
> Some use, some doesn't. In short, I am asking for the Qubes Team to
> rename the current GUI app to qubes-policy-editor-gui, so the one
> provided by this thread can be named qubes-policy-editor.

Marta, what do you think? I think we can do that.

> If the answer is no to the rename action, I will just add the token
> argument.
>
> > > I am doing vim-qrexec, will notice when ready for review, it requires
> > > the qubes-policy-lint for linting the policies from within Vim. So I
> > > will wait for a resolution of this topic.
> > >
> > > Repository: https://codeberg.org/ben.grande.b/qubes-tools
> >
> > Would you like to submit those to the core-qrexec repository?
>
> Yes. Also take a look vim-qrexec to see if it is possible to be included
> in qubes-core-qrexec: https://codeberg.org/ben.grande.b/vim-qrexec
>
> It is not complicated, but it is extensive and written in VimScript.
> It can be used in DomUs and Dom0, but the lint tool can only be run in
> Dom0. If you prefer, I can start another thread to better explain it.

That would IMO makes sense.

- --
Best Regards,
Marek Marczykowski-Górecki
Invisible Things Lab
-----BEGIN PGP SIGNATURE-----

iQEzBAEBCAAdFiEEhrpukzGPukRmQqkK24/THMrX1ywFAmRt6H0ACgkQ24/THMrX
1ywh9Qf+KkqZO75sI69MaVhfTif82bl0hcJy+S/sTYm5DXOmthDICQ3Af/KYmaQT
ATyZXzE3eJt6zvUmL/v7t+b24KRqh43/AWrHAxjZOvzCFlq08QavKrna2Yaz4w5I
X3tR1RO07R/aCH8XRi+erxDMslXz8jKUVWKF2LIvcPPzGnj/zJW5oQOF/sbra7Kf
WyDWOxxHkW3/2afVIWgU0nLssiT1cQfJd6NfofBc0Gx+5ZpPgc5BNyo9OtR2zRAp
3qhS8A/elFriuF8QzoPI+HAAvrO4fTPgPvGLSmNAjOOyo75BtFrhyW7dSV6R4OSn
GxVE9hnMZuvkSn1PEhuO88BHOd+LqQ==
=0Zd3
-----END PGP SIGNATURE-----

Ben Grande

unread,
May 26, 2023, 1:12:06 PM5/26/23
to qubes...@googlegroups.com
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

Some updates made to the lint branch.

https://codeberg.org/ben.grande.b/qubes-core-qrexec/src/branch/lint

One thing that the lint tool doesn't do yet is catch warnings and
display them in the same format as errors, would be better for
applications that parse the output of the lint, but I didn't understand
how to catch the logging.warning() yet, although there are some examples
on the net of catghing warnings.warn().
- --
Benjamin Grande
-----BEGIN PGP SIGNATURE-----

iNUEARYKAH0WIQRklnEdsUUe50UmvUUbcxS/DMyWhwUCZHDoX18UgAAAAAAuAChp
c3N1ZXItZnByQG5vdGF0aW9ucy5vcGVucGdwLmZpZnRoaG9yc2VtYW4ubmV0NjQ5
NjcxMURCMTQ1MUVFNzQ1MjZCRDQ1MUI3MzE0QkYwQ0NDOTY4NwAKCRAbcxS/DMyW
hywQAPwJ55SHicPbRpBaC55OwF0HITCalic/KA4h23fUo6b30wEApftVhm/5gpuR
3QEEe2ZeLI0SJDzWFl++tMc7cOuIfA0=
=9ZYM
-----END PGP SIGNATURE-----

Marta Marczykowska-Górecka

unread,
May 26, 2023, 4:21:52 PM5/26/23
to Marek Marczykowski-Górecki, qubes...@googlegroups.com

On 5/24/23 12:35, Marek Marczykowski-Górecki wrote:
> On Wed, May 24, 2023 at 10:29:07AM +0000, Ben Grande wrote:
> > On 23-05-19 14:52:57, Marek Marczykowski-Górecki wrote:
> >> Hi,
> >>
> >> Those look very useful!
> >>
> >> I have one comment to qubes-policy-edit-terminal: when using
> >> policy_get() (or policy_include_get()), you get a policy content and a
> >> token. Use that token in policy_replace() call to detect race
> conditions
> >> (when something else changes the same policy file in the meantime).
>
> > Will add the token argument and let the exceptions handle the rest.
>
> > Just one thing, the name "qubes-policy-editor-terminal" is non-ideal.  I
> > just added "terminal" to the name because "qubes-policy-editor" was
> > taken by the GUI application implemented with:
> > https://github.com/QubesOS/qubes-desktop-linux-manager/pull/143
>
> > Can Qubes keep the standard of using "*-gui" for GUI applications?
> > Some use, some doesn't. In short, I am asking for the Qubes Team to
> > rename the current GUI app to qubes-policy-editor-gui, so the one
> > provided by this thread can be named qubes-policy-editor.
>
> Marta, what do you think? I think we can do that.


Sure.


Ben Grande

unread,
Jun 1, 2023, 3:03:36 PM6/1/23
to qubes-devel
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

The editor does not require the policy(.include).List RPC as of the last
commit[0], only requiring policy(.include).Get and
policy(.include).Replace.

The downside is that when the file is not found, it guesses the file
path using POLICYPATH and INCLUDEPATH, when running from and AdminVM,
the qubes-core-qrexec package needs to be the same on Dom0 and AdminVM.

Can this cause problems? Should it be reverted? I matching the
'wanted_path' via regex a better alternative?

https://codeberg.org/ben.grande.b/qubes-core-qrexec/commit/445e7db143b5894a8c75394bd2a0bd5a7a8b759e

- --
Benjamin Grande
-----BEGIN PGP SIGNATURE-----

iNUEARYKAH0WIQRklnEdsUUe50UmvUUbcxS/DMyWhwUCZHjrfF8UgAAAAAAuAChp
c3N1ZXItZnByQG5vdGF0aW9ucy5vcGVucGdwLmZpZnRoaG9yc2VtYW4ubmV0NjQ5
NjcxMURCMTQ1MUVFNzQ1MjZCRDQ1MUI3MzE0QkYwQ0NDOTY4NwAKCRAbcxS/DMyW
h7YUAPwLJal1tDtoWelELLhCxTWOnTIl+ri1Y16CJxHBH6GuFgD/Xh68K5Ua/LyC
nJuJU8gvsVNKOR7cV2rXrpMP16anagM=
=/okg
-----END PGP SIGNATURE-----

Ben Grande

unread,
Aug 11, 2023, 10:17:06 AM8/11/23
to qubes-devel
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

On 23-06-01 19:03:31, Ben Grande wrote:
> The editor does not require the policy(.include).List RPC as of the last
> commit[0], only requiring policy(.include).Get and
> policy(.include).Replace.
>
> The downside is that when the file is not found, it guesses the file
> path using POLICYPATH and INCLUDEPATH, when running from and AdminVM,
> the qubes-core-qrexec package needs to be the same on Dom0 and AdminVM.
>
> Can this cause problems? Should it be reverted? I matching the
> 'wanted_path' via regex a better alternative?
>
> https://codeberg.org/ben.grande.b/qubes-core-qrexec/commit/445e7db143b5894a8c75394bd2a0bd5a7a8b759e
>
> --
> Benjamin Grande

Reminding of code contribution.
Status:
- - Missing change 'qubes-policy-editor' to 'qubes-policy-editor-gui';
- - Missing review of the last commit quoted above.

- --
Benjamin Grande
-----BEGIN PGP SIGNATURE-----

iNUEARYKAH0WIQRklnEdsUUe50UmvUUbcxS/DMyWhwUCZNZC3F8UgAAAAAAuAChp
c3N1ZXItZnByQG5vdGF0aW9ucy5vcGVucGdwLmZpZnRoaG9yc2VtYW4ubmV0NjQ5
NjcxMURCMTQ1MUVFNzQ1MjZCRDQ1MUI3MzE0QkYwQ0NDOTY4NwAKCRAbcxS/DMyW
h8M5AQD2vJxqoctMcqu0rXrstBdZxTBX6xQCp4jfebxDm13OUgEAsxoudER6PNpn
9PRZPePO96l5K8GyEdmklnLRChP3EAY=
=EY/Z
-----END PGP SIGNATURE-----

Marek Marczykowski-Górecki

unread,
Aug 20, 2023, 8:02:01 AM8/20/23
to qubes-devel
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

On Fri, Aug 11, 2023 at 02:17:00PM +0000, Ben Grande wrote:
> On 23-06-01 19:03:31, Ben Grande wrote:
> > The editor does not require the policy(.include).List RPC as of the last
> > commit[0], only requiring policy(.include).Get and
> > policy(.include).Replace.
> >
> > The downside is that when the file is not found, it guesses the file
> > path using POLICYPATH and INCLUDEPATH, when running from and AdminVM,
> > the qubes-core-qrexec package needs to be the same on Dom0 and AdminVM.
> >
> > Can this cause problems? Should it be reverted? I matching the
> > 'wanted_path' via regex a better alternative?
> >
> > https://codeberg.org/ben.grande.b/qubes-core-qrexec/commit/445e7db143b5894a8c75394bd2a0bd5a7a8b759e
> >
> > --
> > Benjamin Grande
>
> Reminding of code contribution.

Sorry for late review.

> Status:
> - Missing change 'qubes-policy-editor' to 'qubes-policy-editor-gui';

https://github.com/QubesOS/qubes-desktop-linux-manager/pull/172

You can rename to plain qubes-policy-editor now.

While at it, please add new files to packaging
(debian/qubes-core-qrexec.install, rpm_spec/qubes-qrexec.spec.in). Right
now packages fail to build.

> - Missing review of the last commit quoted above.

The last commit looks fine.

- --
Best Regards,
Marek Marczykowski-Górecki
Invisible Things Lab
-----BEGIN PGP SIGNATURE-----

iQEzBAEBCAAdFiEEhrpukzGPukRmQqkK24/THMrX1ywFAmTiALEACgkQ24/THMrX
1yyDEAgAiBOCrsIrQ3+AbSY86BDVRpUs+SI7flX+h/9oCcVR/p1bLhzlleBawIGW
nDhHwYs8kfShPUFoYB6ZNo8UCW+IOy5aWs+MJ8JMmC9CpekBhMMbR5Hambs4RX93
jUmahuK3AqQgj1NDOjRxxdx2/uurHLb/ij/ftiRNgtL9wwIQMLZlRa3xnfBmDISK
2CDfGu3xgYZ2AZYw8uCeHuUDXQfnCyHulvDmgLP3nAT+3vi2i+LxmDsip8YOgq6b
KE2qQ1BwYH8skH03r6iswqbv0A1DoH6KNi9YrzXywjtfmczqvsSP6tME7hksgxnd
Fad1DOxZwn8uhIRowIsTROtPx5EhTw==
=P2rL
-----END PGP SIGNATURE-----

Ben Grande

unread,
Aug 21, 2023, 4:49:30 PM8/21/23
to qubes...@googlegroups.com
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

On 23-08-20 14:01:53, Marek Marczykowski-Górecki wrote:
> On Fri, Aug 11, 2023 at 02:17:00PM +0000, Ben Grande wrote:
> > Status:
> > - Missing change 'qubes-policy-editor' to 'qubes-policy-editor-gui';
>
> https://github.com/QubesOS/qubes-desktop-linux-manager/pull/172
>
> You can rename to plain qubes-policy-editor now.
>
> While at it, please add new files to packaging
> (debian/qubes-core-qrexec.install, rpm_spec/qubes-qrexec.spec.in). Right
> now packages fail to build.
>
> > - Missing review of the last commit quoted above.
>
> The last commit looks fine.
>
> --
> Best Regards,
> Marek Marczykowski-Górecki
> Invisible Things Lab

Added files to packaging.
I believe in this case it is easier for you to pull from the 'lint'
branch instead of applying the patches manually as multiple commits were
done. If that is not the case, I will post the patches.

https://codeberg.org/ben.grande.b/qubes-core-qrexec/src/branch/lint

- --
Benjamin Grande
-----BEGIN PGP SIGNATURE-----

iNUEARYKAH0WIQRklnEdsUUe50UmvUUbcxS/DMyWhwUCZOPN0V8UgAAAAAAuAChp
c3N1ZXItZnByQG5vdGF0aW9ucy5vcGVucGdwLmZpZnRoaG9yc2VtYW4ubmV0NjQ5
NjcxMURCMTQ1MUVFNzQ1MjZCRDQ1MUI3MzE0QkYwQ0NDOTY4NwAKCRAbcxS/DMyW
h5fyAQCGBNwaORuosnKztDPEQCyMbwzB1bySQ8JVQtYvbywW9gEA0WLlgS6GAY1E
Q0GgjIeHaD9EH4fXGrBzGRibyW9LPAc=
=V3Jq
-----END PGP SIGNATURE-----

Marek Marczykowski-Górecki

unread,
Aug 25, 2023, 10:53:01 AM8/25/23
to qubes...@googlegroups.com, Ben Grande
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

On Mon, Aug 21, 2023 at 08:49:21PM +0000, Ben Grande wrote:
> On 23-08-20 14:01:53, Marek Marczykowski-Górecki wrote:
> > On Fri, Aug 11, 2023 at 02:17:00PM +0000, Ben Grande wrote:
> > > Status:
> > > - Missing change 'qubes-policy-editor' to 'qubes-policy-editor-gui';
> >
> > https://github.com/QubesOS/qubes-desktop-linux-manager/pull/172
> >
> > You can rename to plain qubes-policy-editor now.
> >
> > While at it, please add new files to packaging
> > (debian/qubes-core-qrexec.install, rpm_spec/qubes-qrexec.spec.in). Right
> > now packages fail to build.
> >
> > > - Missing review of the last commit quoted above.
> >
> > The last commit looks fine.
>
> Added files to packaging.

You missed files in python lib dir (qrexec/tools/qubes_policy_...) in
the spec file.

Generally, the preferred workflow is through github pull requests - we
have CI configured there to catch issues like this. If you really hate
github, sending patches like this is okay too, but since it requires a
bit more manual work on my side (including pushing them to CI
manually...), it also takes some more time to get them merged.

> I believe in this case it is easier for you to pull from the 'lint'
> branch instead of applying the patches manually as multiple commits were
> done. If that is not the case, I will post the patches.
>
> https://codeberg.org/ben.grande.b/qubes-core-qrexec/src/branch/lint

Yes, that's fine (but see above).

- --
Best Regards,
Marek Marczykowski-Górecki
Invisible Things Lab
-----BEGIN PGP SIGNATURE-----

iQEyBAEBCAAdFiEEhrpukzGPukRmQqkK24/THMrX1ywFAmTowEAACgkQ24/THMrX
1yyQowf47CY7VTxIizI1fk8v5c58RIltQ9YFF7eRbhB87TaiH3GEhbQQfoWmv41k
4rvbWWP9QuN7tVoTCAfadB10BH0cI5H5AmdvhFzF1iMwlaEv7726pnX6k+qbhAM0
Nlvh9KbfczjxPspjq80ETc38pHX2lO6x6G7jlYubNl7E96mPhJwCxK5QD0EETvMo
lfyIXIGX0uMHBry+SinhAY4WGGWoTKB+BA6/iJrfiooCJHKcJNVkI3HjpmnvpM3l
35ZRzBLCYYqQi4CqSkPwDhXGgWkTxdp/b0JzVyeyvcjkhAVXcD8ba9t0JRm68QAd
T+69fv45P9OHvu5ZtywYEhPssSFP
=5ea7
-----END PGP SIGNATURE-----

Marek Marczykowski-Górecki

unread,
Aug 26, 2023, 12:40:41 PM8/26/23
to qubes...@googlegroups.com, Ben Grande
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

On Fri, Aug 25, 2023 at 04:52:52PM +0200, Marek Marczykowski-Górecki wrote:
> On Mon, Aug 21, 2023 at 08:49:21PM +0000, Ben Grande wrote:
> > On 23-08-20 14:01:53, Marek Marczykowski-Górecki wrote:
> > > On Fri, Aug 11, 2023 at 02:17:00PM +0000, Ben Grande wrote:
> > > > Status:
> > > > - Missing change 'qubes-policy-editor' to 'qubes-policy-editor-gui';
> > >
> > > https://github.com/QubesOS/qubes-desktop-linux-manager/pull/172
> > >
> > > You can rename to plain qubes-policy-editor now.
> > >
> > > While at it, please add new files to packaging
> > > (debian/qubes-core-qrexec.install, rpm_spec/qubes-qrexec.spec.in). Right
> > > now packages fail to build.
> > >
> > > > - Missing review of the last commit quoted above.
> > >
> > > The last commit looks fine.
> >
> > Added files to packaging.
>
> You missed files in python lib dir (qrexec/tools/qubes_policy_...) in
> the spec file.

I see you added it, but as qrexec_policy_* instead of qubes_policy_*...

> Generally, the preferred workflow is through github pull requests - we
> have CI configured there to catch issues like this. If you really hate
> github, sending patches like this is okay too, but since it requires a
> bit more manual work on my side (including pushing them to CI
> manually...), it also takes some more time to get them merged.
>
> > I believe in this case it is easier for you to pull from the 'lint'
> > branch instead of applying the patches manually as multiple commits were
> > done. If that is not the case, I will post the patches.
> >
> > https://codeberg.org/ben.grande.b/qubes-core-qrexec/src/branch/lint
>
> Yes, that's fine (but see above).

- --
Best Regards,
Marek Marczykowski-Górecki
Invisible Things Lab
-----BEGIN PGP SIGNATURE-----

iQEzBAEBCAAdFiEEhrpukzGPukRmQqkK24/THMrX1ywFAmTqKwAACgkQ24/THMrX
1yxnoAf/RLmMwlq+Fr66zwiwfo35U5twb6v+IQ5f5rtNGj1AR4b+iRB96qTTOMRc
3gfUBCHp9m54aVXnO0xIHoTaLnVSgYR99WOTLOZYiGEBN66/gWdWvehpTbuTeXO7
aZ/9vnRJc0rX8vwcvUS76XZzUJezP1r49d2V/7dZW/uheVW38FWOGqkwekEwgz85
HT+I7JLPcytz76RU9Jxo8o8oWMv08f/BnJjPqP2kfq5NXZcdM8zsj8ZNdTNGwmNt
IWsY97NmWx3hH8mGEMtYWqBK/losDX2nEZE5lyGkU0cPdH4nr88QiyxVb7Z2Yqx+
hMB1G4GD337IItPPA4PLZIqK7HhmXQ==
=PvDd
-----END PGP SIGNATURE-----

Marek Marczykowski-Górecki

unread,
Aug 26, 2023, 12:42:46 PM8/26/23
to qubes...@googlegroups.com, Ben Grande
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

On Sat, Aug 26, 2023 at 06:40:32PM +0200, Marek Marczykowski-Górecki wrote:
> On Fri, Aug 25, 2023 at 04:52:52PM +0200, Marek Marczykowski-Górecki wrote:
> > On Mon, Aug 21, 2023 at 08:49:21PM +0000, Ben Grande wrote:
> > > On 23-08-20 14:01:53, Marek Marczykowski-Górecki wrote:
> > > > On Fri, Aug 11, 2023 at 02:17:00PM +0000, Ben Grande wrote:
> > > > > Status:
> > > > > - Missing change 'qubes-policy-editor' to 'qubes-policy-editor-gui';
> > > >
> > > > https://github.com/QubesOS/qubes-desktop-linux-manager/pull/172
> > > >
> > > > You can rename to plain qubes-policy-editor now.
> > > >
> > > > While at it, please add new files to packaging
> > > > (debian/qubes-core-qrexec.install, rpm_spec/qubes-qrexec.spec.in). Right
> > > > now packages fail to build.
> > > >
> > > > > - Missing review of the last commit quoted above.
> > > >
> > > > The last commit looks fine.
> > >
> > > Added files to packaging.
> >
> > You missed files in python lib dir (qrexec/tools/qubes_policy_...) in
> > the spec file.
>
> I see you added it, but as qrexec_policy_* instead of qubes_policy_*...

And also pylint complains...
See:
https://gitlab.com/QubesOS/qubes-core-qrexec/-/pipelines/982836773

> > Generally, the preferred workflow is through github pull requests - we
> > have CI configured there to catch issues like this. If you really hate
> > github, sending patches like this is okay too, but since it requires a
> > bit more manual work on my side (including pushing them to CI
> > manually...), it also takes some more time to get them merged.
> >
> > > I believe in this case it is easier for you to pull from the 'lint'
> > > branch instead of applying the patches manually as multiple commits were
> > > done. If that is not the case, I will post the patches.
> > >
> > > https://codeberg.org/ben.grande.b/qubes-core-qrexec/src/branch/lint
> >
> > Yes, that's fine (but see above).

- --
Best Regards,
Marek Marczykowski-Górecki
Invisible Things Lab
-----BEGIN PGP SIGNATURE-----

iQEzBAEBCAAdFiEEhrpukzGPukRmQqkK24/THMrX1ywFAmTqK34ACgkQ24/THMrX
1yxtPwf/Z52Kt409yhkedY7gkhdHR7xH11IHLMGPYlBTc/RWhcExNgP5PMDtSW/K
Ab2P1MMZq3z4KbdkyDNjwNvuG70fQtlMLuyGi/2ITUiTFimQUUtE/1FUJD07X1+8
CPUUr0J27YiqkDs/zNCWH+TXFzj+tMi3AMEAdt3uEH9UbbS9d133CW9ao6deKxU9
TvTJPXgPrxaDPMHzmNGLwZZEy6SeRJ3tFW96WKU7eySN+5Qz4vlfcvjReT8BYgmS
/ZzTkTTFZs+jRcQIemnUyCqTB9S2G0skrCXtPVmx/NLJ70r22d1Rwaxq+dN86lCI
BnlgW66GfBZBBvfWeQl6eMimKES/wg==
=YRF9
-----END PGP SIGNATURE-----

Ben Grande

unread,
Aug 27, 2023, 2:57:59 AM8/27/23
to qubes...@googlegroups.com
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
> --
> Best Regards,
> Marek Marczykowski-Górecki
> Invisible Things Lab

Due to the misshappens of not using CI and the extra time required to
review, sorry and the PR: https://github.com/QubesOS/qubes-core-qrexec/pull/122
Only a single commit to add the lint and editor.

- --
Benjamin Grande
-----BEGIN PGP SIGNATURE-----

iNUEARYKAH0WIQRklnEdsUUe50UmvUUbcxS/DMyWhwUCZOrz718UgAAAAAAuAChp
c3N1ZXItZnByQG5vdGF0aW9ucy5vcGVucGdwLmZpZnRoaG9yc2VtYW4ubmV0NjQ5
NjcxMURCMTQ1MUVFNzQ1MjZCRDQ1MUI3MzE0QkYwQ0NDOTY4NwAKCRAbcxS/DMyW
hzSWAQDSfVi+MsDsQ5+AJgjPNJS5HPtnwj0MvyR9dvAKvkrqnAD/WW4QP3+dzh5Y
ov2217OCgwgbfhL20ed1wUSqFTThqQo=
=pQv4
-----END PGP SIGNATURE-----
Reply all
Reply to author
Forward
0 new messages