qubes-core-agent package split

[Marek Marczykowski-Górecki]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

Hi,

Currently the package in title is "everything but the kitchen sink" type
of package. It contains at least:

- qrexec-agent
- all kind of qrexec services (file copy, etc)
- all kind of system configuration, including sudoers, sysctl (disable
tcp timestamps etc), NetworkManager etc
- various networking scripts
- handling of dom0 updates
- updates proxy stuff
- integration with GUI file managers (nautilus, dolphin etc)
- ...

Full list of files in Debian package:
https://gist.github.com/marmarek/30f089c595832a547af8ab034cc7b8e0
Full list of files in Fedora package:
https://gist.github.com/marmarek/532170f5e7ae995b33d33d6f85cde040

It would be good to split it into more sensible sub-packages. Mostly for
more specialized/minimal templates. For example currently fedora-minimal
template have awful hack[2] breaking some dependencies to make the template
minimal, which leads to various problems[3]. But also we don't want to
have too many of those packages, to keep maintenance and dependency
tracking at reasonable level.

Any suggestions into what packages it should be split?

IMO at least qrexec-agent should be in separate package (so it would be
possible to install just that, without all the integration/configuration
stuff). But while at at, better think a little more about optional (or
close to) packages layout.

PS I've created also issue on github[1] for this, to put the discussion
outcome there.

[1] https://github.com/QubesOS/qubes-issues/issues/2771
[2] https://github.com/QubesOS/qubes-builder-fedora/blob/master/template_scripts/qubes-template-minimal-stub.spec
[3] https://github.com/QubesOS/qubes-issues/issues/2071

- --
Best Regards,
Marek Marczykowski-Górecki
Invisible Things Lab
A: Because it messes up the order in which people normally read text.
Q: Why is top-posting such a bad thing?
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2

iQEcBAEBCAAGBQJY/UIIAAoJENuP0xzK19css1QH/3sfNjcaQwkWedLIddEp6cHC
Q2E5feQMTUZeWbNlbVkfAdvzmRtsw0e5F3nWVFzHsJHG21Shd21UOCLbIoyu9+3l
uveQnmGya5EhJJaq3VdrHnRkt5fz/o8X55oZPYt9y7ZCSZavh/BrsLk9IfktjiP7
8VTHTGJNOxQZtvjUu/oyVDDzCpjY0HSp0+14s/7ZaGhlhKsdh8vk2ia6QhzWAPmc
TLKUZDDgfpiXuGecd/Ri8DLOrDsjscLZz6Vw1JqXXQ2+WYleG+n9WJR1oDvQ4EXQ
IfHnKoGojxs0gTEZjcaPaZQlgjQ8t2+GbQvyo8OZrN9YvFyC/jW0F/f/06bxSBQ=
=enF+
-----END PGP SIGNATURE-----

[Holger Levsen]

Hi Marek,

sorry for the late reply…

so that would be "qubes-core-agent-qrexec", judging from your list above
there should also

- qubes-core-agent-filemanager-support
- qubes-core-agent-core
- qubes-core-agent-x
- qubes-core-agent-gnome and -xfce and -i3 maybe?
- qubes-core-agent-dom0-update-proxy

what else?

I think it helps to think in package names, as they should indicate the
purpose and thus the depends of the packages. And they should all come
from the same source package, to ease transition and maintenance.

> PS I've created also issue on github[1] for this, to put the discussion
> outcome there.
>
> [1] https://github.com/QubesOS/qubes-issues/issues/2771

--
cheers,
Holger

[Marek Marczykowski-Górecki]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

You mean putting both dolphin and nautilus support files there? Should
this package depend on both?
I've already created qubes-nautilus[2], but not qubes-dolphin, because
nautilus support pulls quite a lot of dependencies (through
nautilus-python), dolphin support does not. Dolphin is only about adding
few files and may not depend on anything dolphin specific - when you
install dolphin, you'll have it.
While at it - is it better to name it qubes-nautilus or
qubes-core-agent-nautilus?

> - qubes-core-agent-core

> - qubes-core-agent-x

What should be here? Note that we have qubes-gui-agent already.

> - qubes-core-agent-gnome and -xfce and -i3 maybe?

What do you have in mind here? Window manager runs in dom0, here we have
VM package...

> - qubes-core-agent-dom0-update-proxy

Makes sense.

> what else?
>
> I think it helps to think in package names, as they should indicate the
> purpose and thus the depends of the packages. And they should all come
> from the same source package, to ease transition and maintenance.
>
> > PS I've created also issue on github[1] for this, to put the discussion
> > outcome there.
> >
> > [1] https://github.com/QubesOS/qubes-issues/issues/2771
>
>

[2] https://github.com/marmarek/qubes-core-agent-linux/commit/5047fd92881408a93ec6e4477b91d3cd9db33e04

- --
Best Regards,
Marek Marczykowski-Górecki
Invisible Things Lab
A: Because it messes up the order in which people normally read text.
Q: Why is top-posting such a bad thing?
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2

iQEcBAEBCAAGBQJZI3l+AAoJENuP0xzK19csUjsH/0UyJXw/8o83RANYYdj8xxaI
bC/ba91Xamuw2Dkpe7K24bqjarCK0z52gNSOII0TshgdDMTEcEoRb55cL6cMQ7qc
R2Z+lY4b9LVrEhRcGKzhV4IF9XDbsvTtbHZt6fUTtkxk9TM8c75WvgPDdi1IHlwA
iJzOovgnQERTnLnNYVJAO3qYIsxE6gGb4BNnrB/bwjCSQaZz7Magkq2ChsgTpb23
fY8N0ef7SlC0D3+FdmAW2KwI5NUnfTCuEL3e199BdeDg6IDOEGmiJjZ0nKYYfYmj
c17NtwnSRVUCpCdKimEEgtr32zpw4ZY+rXkxQ9fNZIHIZYV6GhnyXV6KMdCu7Kw=
=5QT1
-----END PGP SIGNATURE-----

[Holger Levsen]

On Tue, May 23, 2017 at 01:51:24AM +0200, Marek Marczykowski-Górecki wrote:
> > - qubes-core-agent-filemanager-support
> You mean putting both dolphin and nautilus support files there? Should
> this package depend on both?

ah, no, absolutly not. I wasn't aware of dolphin…

> I've already created qubes-nautilus[2], but not qubes-dolphin, because
> nautilus support pulls quite a lot of dependencies (through
> nautilus-python), dolphin support does not. Dolphin is only about adding
> few files and may not depend on anything dolphin specific - when you
> install dolphin, you'll have it.

I definilty say those two should be splitted… but maybe not along those
lines, but rather -kde or -gnome…?

(Then it would also be more obvious to me that I want neither ;)

> While at it - is it better to name it qubes-nautilus or
> qubes-core-agent-nautilus?

I think the latter is definitly better than the former, but maybe
rather qubes-vm-filemanager-support-(kde|gnome) ?

> > - qubes-core-agent-core
> > - qubes-core-agent-x
> What should be here? Note that we have qubes-gui-agent already.

which also should be splitted further as there are gui VMs were I definitly
do not want pulseaudio support…

> > - qubes-core-agent-gnome and -xfce and -i3 maybe?
> What do you have in mind here? Window manager runs in dom0, here we have
> VM package...

notifications mostly, or maybe there should be

qubes-core-agent-gnome-support, recommending(!) qubes-…-nautius-support
and qubes-gnome-notifications and qubes-pulseaudio-support?

> > - qubes-core-agent-dom0-update-proxy
> Makes sense.

:)

maybe it's now time to update #2771 and put the above thoughts as a list there?

[Marek Marczykowski-Górecki]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

On Tue, May 23, 2017 at 12:00:00AM +0000, Holger Levsen wrote:
> On Tue, May 23, 2017 at 01:51:24AM +0200, Marek Marczykowski-Górecki wrote:
> > > - qubes-core-agent-filemanager-support
> > You mean putting both dolphin and nautilus support files there? Should
> > this package depend on both?
>
> ah, no, absolutly not. I wasn't aware of dolphin…
>
> > I've already created qubes-nautilus[2], but not qubes-dolphin, because
> > nautilus support pulls quite a lot of dependencies (through
> > nautilus-python), dolphin support does not. Dolphin is only about adding
> > few files and may not depend on anything dolphin specific - when you
> > install dolphin, you'll have it.
>
> I definilty say those two should be splitted… but maybe not along those
> lines, but rather -kde or -gnome…?

I was following a pattern in Fedora, where you have a bunch of
*-nautilus packages:

brasero-nautilus.x86_64
deja-dup-nautilus.x86_64
easytag-nautilus.x86_64
gnome-terminal-nautilus.x86_64
gtkhash-nautilus.x86_64
nextcloud-client-nautilus.x86_64
nitroshare-extension-nautilus.x86_64
owncloud-client-nautilus.x86_64
qdigidoc-nautilus.x86_64
rabbitvcs-nautilus.noarch
seahorse-nautilus.x86_64
tnef-nautilus.x86_64
tortoisehg-nautilus.noarch

But I have no strong option on either pattern.

> (Then it would also be more obvious to me that I want neither ;)
>
> > While at it - is it better to name it qubes-nautilus or
> > qubes-core-agent-nautilus?
>
> I think the latter is definitly better than the former, but maybe
> rather qubes-vm-filemanager-support-(kde|gnome) ?
>
> > > - qubes-core-agent-core
> > > - qubes-core-agent-x
> > What should be here? Note that we have qubes-gui-agent already.
>
> which also should be splitted further as there are gui VMs were I definitly
> do not want pulseaudio support…

Yes, that's the next step.

> > > - qubes-core-agent-gnome and -xfce and -i3 maybe?
> > What do you have in mind here? Window manager runs in dom0, here we have
> > VM package...
>
> notifications mostly, or maybe there should be

Hmm, I think the only thing about notifications there is dependency on
mate-notification-daemon and a configuration for it. Should this be in
separate package? Ideally we'd have it replaced with own notification
proxy[3], but apparently it require some more work...

> qubes-core-agent-gnome-support, recommending(!) qubes-…-nautius-support
> and qubes-gnome-notifications and qubes-pulseaudio-support?
>
> > > - qubes-core-agent-dom0-update-proxy
> > Makes sense.
>
> :)
>
> maybe it's now time to update #2771 and put the above thoughts as a list there?
>
> > > > [1] https://github.com/QubesOS/qubes-issues/issues/2771

[3] https://github.com/QubesOS/qubes-issues/issues/889

- --
Best Regards,
Marek Marczykowski-Górecki
Invisible Things Lab
A: Because it messes up the order in which people normally read text.
Q: Why is top-posting such a bad thing?
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2

iQEcBAEBCAAGBQJZI4BlAAoJENuP0xzK19cscDMH/1H3k89DlSXBLmv6e+WIlZAg
X8ttcqxsOBQLXSVgtHv8zudOtaKGGXaiuRfTz9u/Xm4bdTef5+1QxiWIZ/HCk/wc
xQDDPVp/U3XNUAcfBwoTWS9xdAPC/c+XJPTBDLuZujcZ2MOtIz2VEN0+jOefRd3V
bgJwAzmTpmFJCUTJ4VtduE+Bytv7qAFkg74rbOMHuDVf11pgJluq1XqlPT+d5Y00
jCIjWele4aMpc4nvGUWJuPogtw18en/ETdN+7xXIxd03mSlbTJPmswXmzYyosXYY
HAlA2TZ4oBdNv9Z6LMbtYanoNQB/OINL712ncsU5zvjoURwPbuWDo3ES6oJjgKo=
=3jy2
-----END PGP SIGNATURE-----

[Marek Marczykowski-Górecki]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

Renamed to qubes-core-agent-nautilus.

I've also renamed Fedora package to qubes-core-agent, so both Debian and
Fedora packages have the same name.

> > qubes-core-agent-gnome-support, recommending(!) qubes-…-nautius-support
> > and qubes-gnome-notifications and qubes-pulseaudio-support?
> >
> > > > - qubes-core-agent-dom0-update-proxy
> > > Makes sense.
> >
> > :)
> >
> > maybe it's now time to update #2771 and put the above thoughts as a list there?

Added some of them there.

Additional ideas:
- qubes-core-agent-network - all kind of network setup - not needed if
only offline VMs are used from such template
- include also updates proxy stuff (and dependency on tinyproxy for
this reason)
- qubes-core-agent-network-manager - mostly useful for NetVM (depends
on qubes-core-agent-network and NetworkManager)

I've done some of it already in separate branch[1]. Interesting part
(new content in debian/control):

Package: qubes-core-agent-nautilus
Architecture: any
Description: Qubes integration for Nautilus
Nautilus addons for inter-VM file copy/move/open.
Depends:
python-nautilus,

Package: qubes-core-agent-dom0-updates
Architecture: any
Depends:
fakeroot,
yum,
yum-utils
Description: Scripts required to handle dom0 updates.
Scripts required to handle dom0 updates. This will allow to use the VM as
"Updates VM".

Package: qubes-core-agent-network
Architecture: any
Depends:
qubes-core-agent,
tinyproxy,
iptables,
net-tools,
ethtool,
tinyproxy,
nmap-ncat,
${python:Depends},
${misc:Depends}
Recommends:
nftables,
Description: Networking support for Qubes VM
This package provides:
* basic network functionality (setting IP address, DNS, default gateway)
* proxy service used by TemplateVMs to download updates
* qubes-firewall service (FirewallVM)
.
Note: if you want to use NetworkManager (you do want it in NetVM), install
also qubes-core-agent-network-manager.

Package: qubes-core-agent-network-manager
Architecture: any
Depends:
qubes-core-agent-network,
dconf,
network-manager (>= 0.8.1-1),
network-manager-gnome,
Description: NetworkManager integration for Qubes VM
Integration of NetworkManager for Qubes VM:
* make connections config persistent
* adjust DNS redirections when needed
* show/hide NetworkManager applet icon

(similar changes also in .spec file for Fedora)

[1] https://github.com/marmarek/qubes-core-agent-linux/tree/rename

- --
Best Regards,
Marek Marczykowski-Górecki
Invisible Things Lab
A: Because it messes up the order in which people normally read text.
Q: Why is top-posting such a bad thing?
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2

iQEcBAEBCAAGBQJZK7HbAAoJENuP0xzK19csPTQH/19mYiWPKObiaJFCc0QgfTr1
H4xx3/1cUn4TT4bRvjNPRTJZTcs2r8JGYjIC6simDBM3qvhqztB9p6nxlT3GWGzR
67wdDFG4KqQ6/2Wt3FLmmocx36186jhbyFTuCBEFMaVb+uZoLGM+tRe0QTduImkg
8bv/CYxLxmEHXHkyfz7rphd3YD8hqUoNWZXZYP2qOGt5iMczwiE05Q3X/83p0Lwg
jySXOLWWkDdt6y6NIXvCygxoR4/gMG+nyONN29VexQ4ueVho0sTj0JaqskiLrDzL
Uxvoz63Wi87/uOi6LnOx7L18SILR/vWwx0j4iygLlYcJuzdMad3dJWVsiPOU9Mk=
=GQMF
-----END PGP SIGNATURE-----

[Holger Levsen]

On Mon, May 29, 2017 at 07:30:04AM +0200, Marek Marczykowski-Górecki wrote:
> > > > While at it - is it better to name it qubes-nautilus or
> > > > qubes-core-agent-nautilus?
> > >
> > > I think the latter is definitly better than the former, but maybe
> > > rather qubes-vm-filemanager-support-(kde|gnome) ?
>
> Renamed to qubes-core-agent-nautilus.
>
> I've also renamed Fedora package to qubes-core-agent, so both Debian and
> Fedora packages have the same name.

yay!

> > > maybe it's now time to update #2771 and put the above thoughts as a list there?
>
> Added some of them there.
>
> Additional ideas:
> - qubes-core-agent-network - all kind of network setup - not needed if
> only offline VMs are used from such template
> - include also updates proxy stuff (and dependency on tinyproxy for
> this reason)
> - qubes-core-agent-network-manager - mostly useful for NetVM (depends
> on qubes-core-agent-network and NetworkManager)

what's the diff between the two?

> I've done some of it already in separate branch[1]. Interesting part
> (new content in debian/control):
>
> Package: qubes-core-agent-nautilus

> Package: qubes-core-agent-dom0-updates
> Package: qubes-core-agent-network
> Package: qubes-core-agent-network-manager

ok, (looks good,) so the latter is only needed for sys-net(s), basically?

maybe qubes-core-agent-network_ing_(-support) and qubes-core-agent-network-manager?

or maybe I'm just overly pedantic here… :-)


--
cheers,
Holger

[Marek Marczykowski-Górecki]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

On Mon, May 29, 2017 at 11:44:37PM +0000, Holger Levsen wrote:
> On Mon, May 29, 2017 at 07:30:04AM +0200, Marek Marczykowski-Górecki wrote:
> > > > maybe it's now time to update #2771 and put the above thoughts as a list there?
> >
> > Added some of them there.
> >
> > Additional ideas:
> > - qubes-core-agent-network - all kind of network setup - not needed if
> > only offline VMs are used from such template
> > - include also updates proxy stuff (and dependency on tinyproxy for
> > this reason)
> > - qubes-core-agent-network-manager - mostly useful for NetVM (depends
> > on qubes-core-agent-network and NetworkManager)
>
> what's the diff between the two?

qubes-core-agent-network does not pull NetworkManager, not needed in
most of VMs.

> > I've done some of it already in separate branch[1]. Interesting part
> > (new content in debian/control):
> >
> > Package: qubes-core-agent-nautilus
> > Package: qubes-core-agent-dom0-updates
> > Package: qubes-core-agent-network
> > Package: qubes-core-agent-network-manager
>
> ok, (looks good,) so the latter is only needed for sys-net(s), basically?

Yes, exactly.

> maybe qubes-core-agent-network_ing_(-support) and qubes-core-agent-network-manager?
>
> or maybe I'm just overly pedantic here… :-)

Those names are long enough already, so no -support suffix. For example
`dpkg -l` likes to cut long names and it's hard to distinguish
long-named packages. But -networking IMO is ok.

- --
Best Regards,
Marek Marczykowski-Górecki
Invisible Things Lab
A: Because it messes up the order in which people normally read text.
Q: Why is top-posting such a bad thing?
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2

iQEcBAEBCAAGBQJZLLslAAoJENuP0xzK19csuUoH/2Y2GhNt2adbJdtgqbzjlW1g
bVZwDiW+p7ZKPDAZ/DtBUjV0MEYqSjhYR+CFBe4OYQflFo/WMQZswkEAxL5R3p7g
9P2hrHUduHbp9fAPyoHqELqnS++cYEECTbzBu/koojY7jfl6x1kgxIrA9EMoDzHX
EuBeZ4VU0GKKJnFkr834goNGarVLOceZMkolgpIyQzeI0DWKcGn0Peo0kR/x285G
1Pomal2XpLQf+hmyLvkdWUJpga4z45qDEmVzyanXjyTxJXziLAUdWF6M80TEDcF4
ABYUERNt/gS9SMazVh9FkpaX5ofwQaeYS5I9YJICvqrE5AUAV3Vpa+D5lkAEZgU=
=yz5f
-----END PGP SIGNATURE-----

[Holger Levsen]

On Tue, May 30, 2017 at 02:21:57AM +0200, Marek Marczykowski-Górecki wrote:
> > > Package: qubes-core-agent-network
> > > Package: qubes-core-agent-network-manager
> > maybe qubes-core-agent-network_ing_(-support) and qubes-core-agent-network-manager?

> Those names are long enough already, so no -support suffix.

agreed.

> But -networking IMO is ok.

that be very fine with me.

another option/idea: why "qubes-core-agent-$foo", there is not really an
agent involved always, so maybe better and shorter eg "qubes-vm-networking"?


--
cheers,
Holger

[Marek Marczykowski-Górecki]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

On Tue, May 30, 2017 at 08:38:59AM +0000, Holger Levsen wrote:
> another option/idea: why "qubes-core-agent-$foo", there is not really an
> agent involved always, so maybe better and shorter eg "qubes-vm-networking"?

That is to match repository name. And for repositories naming convention
see here:
https://blog.invisiblethings.org/2013/03/21/introducing-qubes-odyssey-framework.html

- --
Best Regards,
Marek Marczykowski-Górecki
Invisible Things Lab
A: Because it messes up the order in which people normally read text.
Q: Why is top-posting such a bad thing?
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2

iQEcBAEBCAAGBQJZLTEjAAoJENuP0xzK19cs9bUIAJQj7KjExoX8a1baOw0wS80V
k33iSIGjMxUuNcc6VFGEzt8/swIVinStD25zI3yC/CdH/ZZXz8xhca/6bZcRH8cU
TXGEH4sWwVDhAaWHpRxlYC7Dy/Uj6LLRsE4GLCfRlAhcQZGdDmmlPlIvOvPCL78b
FPzzsKjGCjtU0ZdHKI1fhRBidKR2cGG3MANKFZFU3T9tgA7jupF5hmhGdrQlqDUv
BTWhk7TRAWAhgLcqlGmQwafwL9aKujGzvvKxsCxT6Hc1usXVBoZ+X2LVdjKJfTLX
rtdE4p5iNghSmEx2EtTCD0sp/UApBJAbPBA7R20uelSSyutv2/25P3jEgF0u66A=
=Wf80
-----END PGP SIGNATURE-----