@golinux - Absolutely. I'm primarily checking my thoughts for errors before going too far out on that limb, haha. I half expected someone to tell me, "You're wrong. Go away."

One of my lingering concerns was that the Tails remaster was going to become an incremental PITA as the systemd scope creep kept on. But now I'm thinking that if there's a common denominator here (package upgrades / distro remastering) that we can leverage each other's efforts and that issues will get detected/fixed more rapidly.

Is there a specific place where the huddle is happening for this? Or should I retreat to my remaster thread and play with the incendiary devices over there?

Some passing thoughts:

- An automated converter could help keep the scope narrow (more focus on one thing)

- Even if it can't automate the conversion for everything it may be possible to automatically detect which ones need special attention to insert some kind of stub for specific packages with convoluted systemd-scope. (i.e. automation of the bulk would still be a payoff)

What I don't like about this whole thing is we're forced to keep up with "the ways of systemd". Interpreting archaic symbols depending on which way the crow flies and all that. I'm not seeing a way around it for as long as people are stupid though.

Thanks for the tips!

I'll give it a play. Come to think I haven't stress tested on all but one machine...

It flares up really bad when I use a screen recorder. Everything that was stable goes suddenly unstable. The graphics driver didn't even occur to me. I'll have a play on different hardwares before I go kicking Xfce too hard.

As I started contemplating writing letters by hand... it occurred to me that I don't fully recall which way the loops are suppose to go with certain cursive letters. We should put this thought experiment out of our minds before I draw a crowd of people that might point and laugh at my horrible penmanship.

I call it "hack, saw, and polish".

My methodology hasn't caught on yet.

Maybe the more clever name would be "The Reverse Poettering".

And... it's alive!

Weird Corner

Sometimes the security slider doesn't come up on the browser (onion on the left). Clearing the ~/.tor-browser folder and turning the browser back on fixed it.

The Scripts

I've omitted the surrounding remastering tools and am including the code bits to modify the rootfs.

These scripts presume your terminal is already cd'd to the base of the rootfs file system.

Excuse some of the naming conventions as I'm only including the relevant bits.

Host / DNS / Apt

NOTE: Apt sources here pointing to Debian repos until porting is fully complete. Repos are exclusive.

#! /bin/bash

#update hosts to filter dns requests
echo '#!/bin/sh

# Note: must run after /lib/live/config/0020-hostname since it
# otherwise will overwrite any hosts file generated at build time with
# a bloated one that also include the IPv6 host `::1 localhost`, which
# can lead to IPv6 traffic, which we block, which may lead to stuff
# breaking (for instance APTs tor+http transport).

echo "- setting up hosts file"
. /etc/live/config.d/hostname.conf

cat > /etc/hosts << EOF
127.0.0.1 localhost localhost.localdomain ${LIVE_HOSTNAME}
EOF' > ./lib/live/config/9000-hosts-file

#update dns resolver
echo "127.0.0.1 localhost localhost.localdomain amnesia" 		> ./etc/hosts
echo "nameserver 127.0.0.1" 						> ./etc/resolv.conf

#set permissions if not already set
chmod 644 ./etc/resolv.conf

#move the tails package updating file out of the way
mv ./etc/apt/apt.conf.d/80tails-additional-software ./etc/apt/

g_preapt="# /etc/apt/sources.list
deb tor+http://vwakviie2ienjx6t.onion/debian/ stretch main contrib
deb tor+http://sgvtcaew4bxjd7ln.onion/debian-security stretch/updates main contrib
deb tor+http://vwakviie2ienjx6t.onion/debian/ sid main contrib"

echo "$g_preapt" > ./etc/apt/sources.list

Xfce Switch

Excuse some redundant logic. Cobbling out the other remastering work.

#! /bin/bash

#chroot mounts
for f in proc sys dev ; do mount --bind /$f ./$f ; done

mount -o nosuid,nodev -t tmpfs tmpfs ./dev/shm
mount -o nosuid,noexec,relatime,gid=5,mode=620,ptmxmode=000 -t devpts devpts ./dev/pts

#do chroot
cat << EOF | chroot ./

function installuser() {
	adduser \$1 --gecos ",,,," --disabled-password
}

#
# update - install xfce & lightdm
#		

export DEBIAN_FRONTEND=noninteractive

apt-get update
apt-get install xfce4 lightdm -y
dpkg-reconfigure xfce4
update-alternatives --set x-session-manager /usr/bin/startxfce4
echo "/usr/sbin/lightdm" > /etc/X11/default-display-manager
dpkg-reconfigure lightdm

#
# create some users and potentially set the root password (DEBUGGING ONLY)
#

installuser "amnesia"

#echo "root":"toor" | chpasswd
echo "amnesia":"toor" | chpasswd

passwd -d amnesia

#
# Session start hook
#

echo '#! /bin/bash

# * /etc/live/config.d/username.conf : $LIVE_USERNAME
# * /var/lib/gdm3/tails.locale : \$TAILS_LOCALE_NAME, \$TAILS_XKBMODEL,
#   \$TAILS_XKBLAYOUT, \$TAILS_XKBVARIANT, \$TAILS_XKBOPTIONS, \$CODESET
# * /var/lib/gdm3/tails.password : \$TAILS_USER_PASSWORD
# * /var/lib/gdm3/tails.physical_security : \$TAILS_MACSPOOF_ENABLED

backupdir="\$( cd "\$( dirname "\${BASH_SOURCE[0]}" )" && pwd )"

echo "TAILS_MACSPOOF_ENABLED=yes" >  /var/lib/gdm3/tails.physical_security
echo "TAILS_NETCONF=obstacle" >> /var/lib/gdm3/tails.physical_security

echo "TAILS_LOCALE_NAME=\"en_US\"" >  /var/lib/gdm3/tails.locale
echo "TAILS_FORMATS=\"en_US\"" >> /var/lib/gdm3/tails.locale
echo "TAILS_XKBMODEL=\"pc105\"" >> /var/lib/gdm3/tails.locale
echo "TAILS_XKBLAYOUT=\"us\"" >> /var/lib/gdm3/tails.locale
echo "TAILS_XKBVARIANT=\"\"" >> /var/lib/gdm3/tails.locale
echo "TAILS_XKBOPTIONS=\"\"" >> /var/lib/gdm3/tails.locale

echo "TAILS_USER_PASSWORD=toor" > /var/lib/gdm3/tails.password

backup=\$PWD
cd \$backupdir
./Default
cd \$backup

{ nohup /usr/local/sbin/tails-tor-launcher & } &
' > ./etc/gdm3/PostLogin/DefaultPorted

chmod 755 ./etc/gdm3/PostLogin/DefaultPorted

#
# auto-login at lightdm greeter
#

echo '
autologin-user=amnesia
#autologin-user-timeout=0
session-setup-script=/etc/gdm3/PostLogin/DefaultPorted
' >> ./usr/share/lightdm/lightdm.conf.d/01_debian.conf

#
# patch gnome settings
#

sed -i 's/export_gnome_env/export_gnome_env_backup/g' ./usr/local/lib/tails-shell-library/gnome.sh

echo 'export_gnome_env() {
    . /etc/live/config.d/username.conf
}' >> ./usr/local/lib/tails-shell-library/gnome.sh

#
# patch tor launcher to wait for tor process before activating panel
#

sed -i 's/until pgrep -u "\${LIVE_USERNAME}" '\''^ibus-daemon'\''/until pgrep -f "\/usr\/bin\/tor"/g' ./usr/local/sbin/tails-tor-launcher

#
# patch network manager to no longer wait for the ibus
#

sed -i 's/if pgrep -u "\${LIVE_USERNAME}" '\''^ibus-daemon'\''/if pgrep -u "\${LIVE_USERNAME}" "bus-daemon"/g' ./etc/NetworkManager/dispatcher.d/01-wait-for-notification-recipient.sh
EOF

umount ./dev/shm
umount ./dev/pts
for f in proc sys dev ; umount ./$f ; done

Personal

Wow!

The UI is so fast now things are loading before I have time to think.

The Gnome UI would always stick and sometimes freeze with certain apps hitting certain points. Killing the apps with a fullscreen tty was the only way to get Gnome back in some cases. The majority of the rest of the time required alt+tab to unstick the Gnome windows. And with the latest Firefox Quantum.. when launched the browser would sit, and sit, and sit under Gnome until becoming responsive after a minute or two. It's now responsively almost immediately under Xfce.

Something that's really been bugging me under Tails is that Gnome would just outright crash and the whole display would reset. This was happening loosely under Tails 2~ when being prompted by Thunderbird. They had a help ticket open for it and were "deferring to upstream" to fix the problem... hoping it would be fixed by the time Debian Stretch arrived. Guess what? It's worse under Stretch. Now Gnome crashes more often with more apps more frequently.

I've actually had people get annoyed with Tails and stop using it because of how "sticky" the UI was. I became accustomed to it because I liked the other rootfs hardening. Now with the system moving like lightning... I'm the slowest link in the chain! And yes... we're going to pretend that metaphor makes sense.

Have you ever wondered what Tails would look like in Xfce?

Me too!

Tails 3.9 complete with the latest Tor Browser based on Firefox Quantum.

Please hold your applause until the end.

I think I figured out how this song & dance is going to go.

At /etc/gdm3/PostLogin/Default is a script. It does most of the work when first logging on.

The script itself is almost straight Linux other than it expects a few script files to potentially be created by Gnome.

It handles setting up the default user, hardening the settings, if root login should be allowed, etc...

There's a "gotcha" one level beneath that though. It calls some Tails scripts elsewhere that handle the network setup. And you guessed it! They're using systemctl & NetworkManager. It doesn't look like they're invoking anything heavily and/or sprawling though. Most of it is MAC testing with panic fallback that'll disable the network entirely.

And the other minor "gotcha" below that is it sends desktop notifications with gnome envionment settings. They use the standard notification mechanism and were pretty clean about containing the gnome environment settings to a single file. So if the gnome environment settings end up being a problem I could probably just trample that file.

So right now the first phase idea is as follows:

- Install lightdm
- Setup a lightdm greeter script that takes a few inputs
- Have that script prepare some files for the script at /etc/gdm3/PostLogin/Default and invoke
- Possibly work out kinks in desktop notificiation

The above should hypothetically get Tails ported away from Gnome and closer to lightdm.

Once the above is done then some additional steps would need to happen to knock systemd out:

- A /sbin/systemctl script may be needed to intercept systemd requests and translate them to sysvinit service requests
- Most systemd unit files will need to be ported to sysvinit scripts (automatically?)
- The rest of the Devuan migration steps would then apply here.

The final baker would probably do the above in reverse due to potential package orphaning problems. But for development & working out the kinks I'm thinking this has to be done in forward order. e.g. start by trying to get lightdm to forward to their existing scripts with systemd in place and work out desktop notifications that expect a gnome environment. Once tails is working in lightdm then the jump won't be so drastic.

I've never heard of refractainstaller before. I will have to check that out.

Would you believe me if I said I already have an early migration test up and running?

Tails uses an overlay filesystem and prompts for some configuration options immediately at the login session. So you can either disable or enable root access at that prompt, etc... The problem with taking a live snapshot after passing that screen is you can't get back to it, lol! Although I've never tried sneaking around it by attempting to switch full-screen ttys there.

So, I have it booting in QEMU.

- Outer layer (normally formatted as an ISO type) as an ext4
- The internal file system (normally formatted as a squashfs type) as an ext4.

It's way easier to work on and do boot tests with now.

Just have to remember to umount the internal one before running QEMU or it'll drop into busybox.

Screenshot (hosted by a free image service):

The greeter got trampled. This is the switch to xcfe with the ASCII migration method.

I will need to check into how they've hooked the greeter to see if I can restore it.

In regards to their systemd unit files I have a script that hypothetically should allow them to be converted to sysvinit recursively. Not every bit of systemd functionality can be automatically ported with it but it doesn't look like Tails is using anything advanced in that regard. Just basic "restart this service if it dies" sort of thing.

I'm ALMOST starting to have fun.