[QubesBuilder] Unable to "make template" for Ubuntu Trusty

[Gustavo Narea]

Hi everybody.

I'm new to Qubes OS and I need to run some software with Ubuntu, so I'm trying to build a Ubuntu template by following the instructions for Arch Linux, but I'm stuck at "make template" because of the following error:

    You must provide a proper filename containing debian package file

    Error opening '/tmp/qubes-deb/deb/_amd64.changes': No such file or directory

Here's the full output: http://pastebin.com/ECTqVAMM

Any pointers would be much appreciated.

 - Gustavo.

[Marek Marczykowski-Górecki]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

Try calling `make qubes-vm` first.

- --
Best Regards,
Marek Marczykowski-Górecki
Invisible Things Lab
A: Because it messes up the order in which people normally read text.
Q: Why is top-posting such a bad thing?
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2

iQEcBAEBCAAGBQJW7+/7AAoJENuP0xzK19csmW0IAItWPM+TOjY9UFNS0NLhz7ya
mTqRoMYe66FXsYbxPupCz28DWUm7JaR3kHnzRJDMZ9jl9Jza4fHNBxfKiHlFPCbb
lspuE6vAKFkK2ncFcTj4rlJ1xQJK2jQE9uyidx+yOvT46hyqnjqGZrbCrcXDXLq7
LqvKK0GXt9W9Zie8puLnsK3M9eZONKbjXgF0RmD+eYuKLH7D4UIn3+aqKwsGQkM+
ziVJNEMt7Z4nIDH0wKKvRt9Nhcfrva4AaEnVtez871ALWg6LFtwCo2aB+SAt4Y+1
Yli7fN6vCxeWQO8NxvRmCJHaCRN6D8Pk67FziRoy/gGYMpsDkYKepfkr9NDSuKY=
=5gKV
-----END PGP SIGNATURE-----

[Gustavo Narea]

Thanks, Marek!

That's what I had done originally, but doing it a second time fixed it indeed. Although it then failed because it failed to import "pyyaml", which I fixed by running "sudo pip install pyyaml".

Now I'm stuck at "make template": http://pastebin.com/aZMJmGkM

I checked the logs, and the problem is that one of the mirrors is broken:
    ./build-logs/template-trusty.log:173:W: Failed to fetch http://mirror.csclub.uwaterloo.ca/ubuntu/dists/utopic/main/binary-amd64/Packages  404  Not Found [IP: 129.97.134.71 80]

I tried to fix the above by removing the references to the repo above, followed by "make clean && make qubes-vm && make template", but the problems remained. I'm guessing there are references to the repo in binary files.

Any idea how I could fix this?

Thank you,

 - Gustavo.

[Reg Tiangha]

I figured this one out after a lot of trial and error. For some reason, there's a hack that requires access to the Utopic repositories in order to install systemd when making a Trusty template. I don't know why, but that's the case. The problem is that Utopic is EOL and thus all of its packages have been archived from the main mirrors, which is why it throws a 404 message when trying to access the UWaterloo mirror.

If you edit the /home/user/qubes-builder/qubes-src/builder-debian/template_qubuntu/02_install_groups_trusty.sh file and replace the uwaterloo.ca line to instead use:

deb http://old-releases.ubuntu.com/ubuntu/ utopic main

Then it should continue on.

However, much later, you'll hit another snag, which I haven't been able to figure out how to resolve. Eventually, one of the qubes packages (I can't remember which one, sorry) will fail to install because it's dependent on locales-all. The problem is that locales-all is a Debian package and doesn't exist in the Ubuntu repositories, and so trying to make the Trusty template will fail at that point. The closest thing that Ubuntu has is a package called locales, but it's already installed in the chroot so it doesn't seem to help.

So I have two questions to add to Gustavo's:

1)  Is the Utopic hack really needed? I tried to run make template again to try to remember which qubes package was failing to install, but this time it failed because it couldn't install the newer Utopic systemd due to a conflict.

2)  How do I fix the locales-all dependency issue?

Thanks!

[Marek Marczykowski-Górecki]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

I don't know. You can try by simply removing that part of
02_install_groups_trusty.sh and see what will happen ;)

> 2) How do I fix the locales-all dependency issue?

It is pulled in by core-agent-linux package. As a quick workaround you
can simply remove that line (from
qubes-src/core-agent-linux/debian/control). And rebuild core-agent-linux
+ template. As long as locales are installed at all it should work.

- --
Best Regards,
Marek Marczykowski-Górecki
Invisible Things Lab
A: Because it messes up the order in which people normally read text.
Q: Why is top-posting such a bad thing?
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2

iQEcBAEBCAAGBQJW/7MIAAoJENuP0xzK19cs9FAH/0IAVgQY45fFV7WBOUbCA9bc
47m9B5MLIuPpk+WlypOPE6ayoJa6HkUUY1QZyaVOY2N/muM/EyNaBE6Gq+fSiuDS
+OWRDWdQSQeldqpGUa0j4LSYRW662JhQnRNNHVWe92D0ga8ANKDR5gp34qpHMkrR
3Q0tjJi7DX/ZNY0AiwkwwX85QMgi0lRZz5dQhiXcA+VrSHXxIPlYYXCIhNleC2fK
u8mJiKeg1yuBwPYmPU9jxrQphLS/4busxA0qg8ljKTHiL6KHN++dFb5g4j0uDc+a
g8oO9gOc7mc331GCbehnfqLDRRzWUDrfFSdaI6Q5n0FvLh9XBk8lE4N4Lo5jULg=
=pz9a
-----END PGP SIGNATURE-----

[Reg Tiangha]

Cool. I'll give that a try and will see how it goes.

As stuff is compiling, I think I might know why that hack might have been needed.

When the script responsible for creating chroot-trusty is being run, it doesn't install libsystemd-daemon-dev and libsystemd-daemon0 automatically, so building one of the qubes components fails. Installing those manually in the chroot from the Trusty repositories works though, and make qubes-vm continues on to completion. (As an aside, assuming this is all being done in a Fedora VM, make install-deps fails to install PyYAML as part of the Fedora dependencies alongside rpm-build and such, so one also has to install that package manually in the build environment first as well).

However, my guess is that the same thing probably will happen during the make template stage since I commented out the hack (guess I'll find out soon when this thing is done).

After some research, I think this is all due to Ubuntu not providing /lib/systemd/systemd binaries for anything before Utopic, even though if you compile the base Debian package that Ubuntu uses yourself, it'll actually install the /lib/systemd/systemd binary. There is a systemd-services package, but it lacks a /lib/systemd/systemd binary.

As it stands right now, if you want the real systemd running in Trusty, you have to install it via a) a third-party ppa, b) compile it from Debian source or (what probably happened in this case) c) grab it from Utopic.

So I guess my question now is:  Does the qubes-specific stuff need systemd to be installed in the template for it to run properly later on? If not, how do I get around the libsystemd-daemon-dev requirement when make qubes-vm is being run? Is it safe to remove it like I did with locales-all?

And if the qubes-specific stuff does need systemd, then how do I make it so that the build scripts pull in libsystemd-daemon-dev and libsystemd-daemon0 from the Utopic sources when it's creating chroot-trusty during the make vm stage (it'll compile fine with the Trusty versions, but I'm willing to be that's why I got the systemd conflict error later on when building the template when I realized that make template was failing because the UWaterloo mirror was down and fixed the Utopic repository entry)?  I suppose I could download those packages from a Utopic repository myself and manually install them in the chroot, but it would be nice if all of this could be automated.

Thanks!