Whonix

Recent Commits

• Patrick Schleizer(01 Aug 26)

  bumped changelog version

• Patrick Schleizer(01 Aug 26)

  .

• Patrick Schleizer(31 Jul 26)

  .

• Patrick Schleizer(31 Jul 26)

  .

• Patrick Schleizer(31 Jul 26)

  .

• Patrick Schleizer(31 Jul 26)

  .

• Patrick Schleizer(30 Jul 26)

  .

• Patrick Schleizer(29 Jul 26)

  .

• Patrick Schleizer(29 Jul 26)

  .

• Patrick Schleizer(29 Jul 26)

  Merge remote-tracking branch 'refs/remotes/org-ai-assisted/master'

• claude (dev113 6465e658-44ed-4e80-93cf-c9586d8683d6)(28 Jul 26)

  ci/reproducible-build-twice: diffoscope is best-effort, not localization The comment promised diffoscope would "localize a mismatch to the specific in-image file". The comparator itself does not claim that: it prints "diffoscope explanation follows (best-effort; may be truncated or skipped)" and documents that the run is capped and can be skipped on large images. The verdict is the whole-file sha256; diffoscope is a diagnosis aid. Generated with assistance from Claude Code.

• claude (dev113 6465e658-44ed-4e80-93cf-c9586d8683d6)(28 Jul 26)

  ci/build: correct the caller comment local-build.yml drives help-steps/dm-build-official, not this script. Name the real callers (ci/reproducible-build-twice and manual local builds) so the header stops pointing at a workflow that no longer uses it. Generated with assistance from Claude Code.

• Patrick Schleizer(28 Jul 26)

  bumped changelog version

• Patrick Schleizer(28 Jul 26)

  .

• Patrick Schleizer(28 Jul 26)

  .

• Patrick Schleizer(28 Jul 26)

  Merge remote-tracking branch 'org-ai-assisted/master'

• Patrick Schleizer(28 Jul 26)

  .

• claude (dev74 3cdbae8e-30ec-412d-8ce2-ba63d1c9b6af)(28 Jul 26)

  consumer-codex-review: drop OPENAI_API_KEY forward to the disabled reusable The reusable reusable-codex-review.yml is a deliberate no-op stub (job 'if: false'); its 'on.workflow_call' no longer declares an OPENAI_API_KEY secret. Forwarding that secret to a reusable that does not declare it is rejected by GitHub at startup, so every run showed 'startup_failure'. Dropping the forward lets the no-op job run green; Codex review stays cleanly disabled. The consumer-templates source in developer-meta-files carries the same fix so a future propagation pass keeps this content. Co-Authored-By: Claude Opus 4.8 <[email protected]>

• claude (dev74 3cdbae8e-30ec-412d-8ce2-ba63d1c9b6af)(28 Jul 26)

  umount_kill.sh: sweep submounts only, never the tree's own root mount The recursive-unmount block matched 'base' itself as well as mounts under it. unchroot-raw calls 'umount_kill.sh $CHROOT_FOLDER' between install-packages' chroot cycles solely to reap lingering chroot processes; the ext4 root that mount-raw placed at $CHROOT_FOLDER must stay mounted until unmount-raw removes it. Matching 'base' unmounted that root mid-build, so the next chroot landed in an empty directory: chroot: failed to run command 'mkdir': No such file or directory Match strict submounts only ('base/...'). Callers that want 'base' unmounted do it themselves (unmount-helper); the cowbuilder callers pass a plain directory that is not a mountpoint, so nothing changes for them. Co-Authored-By: Claude Opus 4.8 <[email protected]>

• claude (dev74 3cdbae8e-30ec-412d-8ce2-ba63d1c9b6af)(26 Jul 26)

  frozen: pass Check-Valid-Until to the grml chroot via env-forwarding grml uses $DPKG_OPTIONS throughout chroot-script but never forwarded it into the chroot (fixed on the grml fork: forward DPKG_OPTIONS via CHROOT_VARIABLES). To pick that up, make ci/checkout-fork-branch detach onto FETCH_HEAD instead of refs/remotes/origin/BRANCH -- a single-branch submodule clone (grml-debootstrap) leaves that tracking ref absent, which aborted the switch; FETCH_HEAD is always set by the fetch, so every submodule tracks its fork branch uniformly (no per-submodule exception, no pin). Revert the /etc/debootstrap apt.conf workaround now that the option reaches the chroot the proper way. Co-Authored-By: Claude Opus 4.8 <[email protected]>

• claude (dev74 3cdbae8e-30ec-412d-8ce2-ba63d1c9b6af)(26 Jul 26)

  frozen: drop Check-Valid-Until apt.conf into the grml raw-image chroot grml-debootstrap forwards only a whitelist of vars into its chroot (via CHROOT_VARIABLES), NOT $DPKG_OPTIONS, so DIST_APTGETOPT's Acquire::Check-Valid-Until=false never reaches the in-chroot 'apt-get update' and a --freshness frozen build aborts on the expired snapshot Release ("Release file ... is expired"). Write it as an apt.conf into the chroot overlay (/etc/debootstrap/etc/, which grml copies into the image alongside the sources), covering every chroot apt call. Frozen only; Signed-By verification unaffected. Co-Authored-By: Claude Opus 4.8 <[email protected]>

• claude (dev74 3cdbae8e-30ec-412d-8ce2-ba63d1c9b6af)(26 Jul 26)

  frozen: pass Check-Valid-Until via DIST_APTGETOPT, not per-source edits A frozen snapshot's Release 'Valid-Until' is intentionally in the past. Add 'Acquire::Check-Valid-Until=false' to DIST_APTGETOPT when '--freshness frozen' so it flows through the normal option path to every apt consumer -- cowbuilder/ pbuilder (the APTGETOPT array in the generated pbuilder config) and grml- debootstrap's in-chroot apt during raw-image creation (DPKG_OPTIONS, set from DIST_APTGETOPT in 3200) -- fixing the "Release file ... is expired" abort. Reverts the earlier per-source 'Check-Valid-Until: no' edits to build_sources/*_frozen_clearnet.sources (root option path, not source-list edits). Co-Authored-By: Claude Opus 4.8 <[email protected]>

• claude (dev74 3cdbae8e-30ec-412d-8ce2-ba63d1c9b6af)(26 Jul 26)

  build_sources: accept expired Release for frozen snapshots A frozen snapshot's Release Valid-Until is in the past by design. apt paths that never receive Acquire::Check-Valid-Until=false -- notably grml-debootstrap's in-chroot 'apt-get update' during raw-image creation -- abort with "Release file ... is expired". Set 'Check-Valid-Until: no' per source stanza so those paths accept the intentionally-old snapshot; archive-key signature verification (Signed-By) is unaffected. Clearnet frozen sources (stable trixie + testing forky). Co-Authored-By: Claude Opus 4.8 <[email protected]>

• claude (dev74 3cdbae8e-30ec-412d-8ce2-ba63d1c9b6af)(26 Jul 26)

  1300: also clear nosuid on the cowbuilder base filesystem The base fs must be 'suid'-capable too, not only 'dev'. Qubes mounts /home 'nosuid,nodev'; clearing only 'nodev' left 'nosuid', which strips setuid so in-chroot 'su'/'sudo' cannot escalate (the vbox guest-additions installer's get_su_cmd aborts the build). Remount 'dev,suid' so the chroot matches a normal (CI) build filesystem. Co-Authored-By: Claude Opus 4.8 <[email protected]>

• claude (dev74 3cdbae8e-30ec-412d-8ce2-ba63d1c9b6af)(26 Jul 26)

  1300: create cowbuilder base on a dev-capable fs; validate reuse - mmdebstrap skips device-node creation on a nodev target (Qubes mounts /home nodev, and under Docker the base lives on the build volume there), so the base lacks /dev/ptmx and cowbuilder's pbuilder mountproc aborts ("mount: .../dev/ptmx: mount point does not exist"). Bind-remount the base filesystem 'dev' when nodev is detected; no-op on a dev-capable fs (CI). - --reuse-cowbuilder-base: require /dev/ptmx to be a character device before trusting an existing base, else rebuild -- a broken base no longer silently propagates across every build that reuses it. Co-Authored-By: Claude Opus 4.8 <[email protected]>

• claude(26 Jul 26)

  umount_kill.sh: recursively unmount the tree after killing its users umount_kill.sh killed the processes holding a tree busy but never unmounted the tree -- so a chroot's still-mounted /sys, /dev/pts and /proc persisted. That breaks cowbuilder base setup: 'cowbuilder --execute' copies base.cow -> cow.1 via 'cp -al', which fails "Invalid cross-device link" hard-linking a mounted sysfs/ devpts/proc file. With --reuse-cowbuilder-base (base kept, not rm+recreated) the stale mounts survive across builds, so local cowbuilder builds broke. Unmount every mount under the tree (deepest first, --lazy --force) after the kill phase. Verified: a dir with /sys,/dev/pts,/proc mounted goes 3 mounts -> 0 and 'cp -al' then succeeds. Fixes all callers (cowbuilder base + chroot teardown). Co-Authored-By: Claude Opus 4.8 <[email protected]>

• claude(26 Jul 26)

  ci: move build-scratch cleanup to its sources, drop ci/free-build-scratch Each scratch artifact is freed where it becomes unneeded -- no standalone scratch-cleanup script, no inline scripting in the workflow yml: - per-flavor working raw -> build-steps.d/5300_free-build-scratch (terminal step, runs after every raw consumer; CI-guarded so a local build keeps it). - shared cross-flavor base-image.raw -> help-steps/dm-build-official-one at the Phase-3 loop boundary (the only point that knows all flavors are done; user-owned so 'find -delete', no rm). The per-flavor chroot is already removed by unmount-raw. - relocated cowbuilder base (pbuilder, 0700 root-owned) -> a 'free' verb on ci/cowbuilder-base-cache, called by the workflow right after the pack step. ci/free-build-scratch deleted; workflow 'Free build scratch' step replaced by 'cowbuilder-base-cache free'. Co-Authored-By: Claude Opus 4.8 <[email protected]>

• claude(26 Jul 26)

  3600: escape the LB_BOOTAPPEND_LIVE sed replacement against special chars The grub-mkconfig-derived cmdline was interpolated raw into a sed s/// replacement, so a param carrying '/', '&', or '\' would break sed or corrupt LB_BOOTAPPEND_LIVE. Escape it (backslash first, then '&' and the '/' delimiter) via bash param-expansion -- no fragile sed-in-sed. Verified the escape produces the exact expected output for a value containing all three. Co-Authored-By: Claude Opus 4.8 <[email protected]>

• claude(26 Jul 26)

  ci/build: fix ai-review findings (silent switch failure; literal-glob abort) checkout-fork-branch: a git-switch failure after a successful fetch was swallowed by an if/no-else (exit 0) and read as "branch absent", silently keeping the gitlink; surface it as an error instead. 2100_create-debian-packages: the reprepro includedeb/includedsc add loops run before create_derivative sets nullglob, so an unmatched *.deb/*.dsc glob stays literal and (unlike the remove loops) has no '|| true' -- a set with only one of the two would abort the build. Skip non-existent (literal-glob) entries. Co-Authored-By: Claude Opus 4.8 <[email protected]>

• claude(26 Jul 26)

  build: replace raw-base-image booleans with --base-image-role option Drop the ad-hoc dist_build_raw_base_image_create / dist_build_use_cached_raw_base_image env-var toggles (export/unset dance in dm-build-official-one; two path-rename branches in 3200) for one validated parse-cmd option '--base-image-role create|consume'. The shared base-image.raw path is now derived once in help-steps/variables, where 'create' redirects the raw output there and 'consume' points the cached input at it. dm-build-official-one passes --base-image-role create on the shared-base create-raw-image call and --base-image-role consume via skip_shared_args on every Phase-3 build. Behavior identical; fail-loud enum instead of stringly-typed booleans. Co-Authored-By: Claude Opus 4.8 <[email protected]>