Methods of installing software in QubesOS with Saltstack

Intro

Here are some various methods of installing software that I’ve used in my personal salt configuration

pkg.installed

Here’s /srv/user_salt/pkgs/accounting.sls as an example. It uses the simplest way of installing programs, which is just listing them under pkg.installed which pulls them from your distros main repositories. This is the most preferable way to install software if it’s available.

# Install accounting tools
accounting--install-apps:
  pkg.installed:
    - pkgs:
      - hledger # Command-line plain text accounting
      - gnucash # Graphical GNU accounting suite

move a binary file into /usr/bin

Here’s /srv/user_salt/pkgs/st.sls as an example. It takes a binary file that’s part of this salt repository, and moves it into the ~/usr/bin/ directory in a qube.

# Installs my build of st terminal
/usr/bin/st:
  file.managed:
    - source: salt://pkgs/bin/st.bin
    - user: root
    - group: root
    - mode: 777

Install from third-party repo with a script

Here’s /srv/user_salt/pkgs/signal.sls as an example. It starts by installing some dependencies using the most common pkg.installed method, then moves an install script /srv/user_salt/pkgs/install-scripts/signal-repo.sh into a qube and executes it to install the Signal messenger.

...

signal--repo-script:
  file.managed: # file.managed lets you place files from your salt repo into qubes
    - name: /usr/bin/install-repo # this is where the installation script is placed
    - source: salt://pkgs/install-scripts/signal-repo.sh # This is where the installation script was sourced
    - user: root # sets the owner of the file, you can usually default to root
    - group: root # sets the group of the file, you can usually default to root
    - mode: 777 # sets the permissions of the file, you can usually default to 777 (any user on the qube has permissions)

# This simply executes the install-repo script in a qube
'install-repo':
  cmd.run

Here’s the installation script that’s ran:

`/srv/user_salt/pkgs/install-scripts/signal-repo.sh`

# Retrieves Signal's key for verifying the package
# The request is proxied through 127.0.0.1:8082 to allow the template qube to access the internet
sudo curl --proxy 127.0.0.1:8082 -s https://updates.signal.org/desktop/apt/keys.asc | gpg --dearmor | sudo tee -a /usr/share/keyrings/signal-desktop-keyring.gpg > /dev/null

# Defines Signal's repo in /etc/apt/sources.list.d/
echo 'deb [arch=amd64 signed-by=/usr/share/keyrings/signal-desktop-keyring.gpg] https://updates.signal.org/desktop/apt xenial main' | tee /etc/apt/sources.list.d/signal-xenial.list

# Updates packages and installs signal-desktop through the newly configured repository
sudo apt update
sudo apt install signal-desktop -y