(Unofficial) wireguard packages for Debian Stretch (testing)

(Unofficial) wireguard packages for Debian Stretch (testing)

[David Anderson]

[-- Attachment #1: Type: text/plain, Size: 953 bytes --]

Mellow greetings,

In case it's of use to anyone, I've built wireguard packages for Debian
testing. I wanted to play with wireguard on my Debian Stretch systems, but
wireguard is currently locked to Sid only until 1.0 brings API stability
guarantees.

So, I set up a cronjob that rebuilds the Sid source package on a Stretch
system, and the result is wireguard packages that track the latest release,
but don't pull in unstable versions of libc and whatnot when you try to
install them, as would happen if you tried to install via package pinning.

Naturally, you have only my word that the packages are unmodified rebuilds
of Debian's original package, and you're trusting packagecloud to not
tamper with the packages (it's their signing keys, not mine) so caveat
emptor. It works for me, it might work for you as well.

With the warnings and disclaimers out of the way, here's the repo:
https://packagecloud.io/danderson/wireguard?filter=debs

- Dave

[-- Attachment #2: Type: text/html, Size: 1205 bytes --]

Re: (Unofficial) wireguard packages for Debian Stretch (testing)

[Jason A. Donenfeld]

Mellow yellow,

That's a great idea. Do you intend to track dkg's sid package more or
less faithfully? If so, I'd be happy to advertise this on the
wireguard.io/install/ page, since I'm sure a lot of people (including
myself!) would benefit immensely from that.

Could you send some bulletproof instructions -- 3 or 4 lines of
commands like what's there currently -- and I'll put it on the site?

Thanks,
Jason

Re: (Unofficial) wireguard packages for Debian Stretch (testing)

[David Anderson]

[-- Attachment #1: Type: text/plain, Size: 1383 bytes --]

On Sat, Feb 11, 2017 at 1:03 AM, Jason A. Donenfeld <Jason@zx2c4.com> wrote:

> Mellow yellow,
>
> That's a great idea. Do you intend to track dkg's sid package more or
> less faithfully?


In that package repository, I intend to track the sid package exactly. If I
ever take up hacking on wireguard, I'll use a separate repository for any
modified versions.

If so, I'd be happy to advertise this on the
> wireguard.io/install/ page, since I'm sure a lot of people (including
> myself!) would benefit immensely from that.
>

Cool! I'll see about setting up debian stable as well.


> Could you send some bulletproof instructions -- 3 or 4 lines of
> commands like what's there currently -- and I'll put it on the site?
>

The instructions you have on there now are fine if you're okay with
packagecloud's shell script. Manual instructions that work are:

sudo apt-get install -y apt-transport-https linux-headers-amd64 curl
curl -L https://packagecloud.io/danderson/wireguard/gpgkey | sudo apt-key
add -
echo "deb https://packagecloud.io/danderson/wireguard/debian/ stretch main"
| sudo tee /etc/apt/sources.list.d/wireguard.list
sudo apt-get update
sudo apt-get install -y wireguard-dkms wireguard-tools

Note that right now, only amd64 packages are available. If you think
there's demand for Debian on 32-bit x86, I can set up i386 builders as well.

- Dave


> Thanks,
> Jason
>

[-- Attachment #2: Type: text/html, Size: 2602 bytes --]

Re: (Unofficial) wireguard packages for Debian Stretch (testing)

[Jason A. Donenfeld]

Hi Dave,

Good idea. I don't like the scary pipe to bash one liners. I'll go
with what you suggested. However, is `linux-headers-amd64` really
required?

Thanks,
Jason

Re: (Unofficial) wireguard packages for Debian Stretch (testing)

[David Anderson]

[-- Attachment #1: Type: text/plain, Size: 569 bytes --]

Hi,

Yes, linux-headers-amd64 is required, otherwise the wireguard-dkms package
won't build the kernel module, and leave a very confused user. I *think* I
saw a conversation in this list's archives about whether the headers should
be made a dependency of wireguard-dkms, but I can't find it now...

- Dave

On Sat, Feb 11, 2017 at 2:04 AM, Jason A. Donenfeld <Jason@zx2c4.com> wrote:

> Hi Dave,
>
> Good idea. I don't like the scary pipe to bash one liners. I'll go
> with what you suggested. However, is `linux-headers-amd64` really
> required?
>
> Thanks,
> Jason
>

[-- Attachment #2: Type: text/html, Size: 951 bytes --]

Re: (Unofficial) wireguard packages for Debian Stretch (testing)

[Jason A. Donenfeld]

Hi Dave,

Ahh right, that old debate.

Jason

Re: (Unofficial) wireguard packages for Debian Stretch (testing)

[David Anderson]

[-- Attachment #1: Type: text/plain, Size: 490 bytes --]

Okay, I've set up a Debian stable builder as well... However, Debian stable
has a 3.16 kernel, and wireguard-dkms requires >=3.18, so installation
fails. Assuming 3.18 is a hard lower-bound on kernel versions, it looks
like jessie will never run in-kernel wireguard. Fortunately it'll be moot
in a few months when stretch becomes the new stable.

- Dave



On Sat, Feb 11, 2017 at 2:17 AM, Jason A. Donenfeld <Jason@zx2c4.com> wrote:

> Hi Dave,
>
> Ahh right, that old debate.
>
> Jason
>

[-- Attachment #2: Type: text/html, Size: 919 bytes --]

Re: (Unofficial) wireguard packages for Debian Stretch (testing)

[Jason A. Donenfeld]

Hey David,

On Sat, Feb 11, 2017 at 12:48 PM, David Anderson <dave@natulte.net> wrote:
> Okay, I've set up a Debian stable builder as well... However, Debian stable
> has a 3.16 kernel, and wireguard-dkms requires >=3.18, so installation
> fails. Assuming 3.18 is a hard lower-bound on kernel versions, it looks like
> jessie will never run in-kernel wireguard. Fortunately it'll be moot in a
> few months when stretch becomes the new stable.

I probably could backport to 3.16... It's a bit of a PITA but still
possible if there's sufficient demand. I'll wait to see if people pipe
up.

Jason

Re: (Unofficial) wireguard packages for Debian Stretch (testing)

[Baptiste Jonglez]

[-- Attachment #1: Type: text/plain, Size: 849 bytes --]

On Sat, Feb 11, 2017 at 03:48:59AM -0800, David Anderson wrote:
> Okay, I've set up a Debian stable builder as well... However, Debian stable
> has a 3.16 kernel, and wireguard-dkms requires >=3.18, so installation
> fails. Assuming 3.18 is a hard lower-bound on kernel versions, it looks
> like jessie will never run in-kernel wireguard. Fortunately it'll be moot
> in a few months when stretch becomes the new stable.

Jessie-backports has linux 4.9, so it's probably much simpler to require
users to install this.

> On Sat, Feb 11, 2017 at 2:17 AM, Jason A. Donenfeld <Jason@zx2c4.com> wrote:
> 
> > Hi Dave,
> >
> > Ahh right, that old debate.
> >
> > Jason
> >

> _______________________________________________
> WireGuard mailing list
> WireGuard@lists.zx2c4.com
> https://lists.zx2c4.com/mailman/listinfo/wireguard


[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 833 bytes --]

Re: (Unofficial) wireguard packages for Debian Stretch (testing)

[David Anderson]

[-- Attachment #1: Type: text/plain, Size: 1349 bytes --]

On Sat, Feb 11, 2017 at 8:27 AM, Baptiste Jonglez <
baptiste@bitsofnetworks.org> wrote:

> On Sat, Feb 11, 2017 at 03:48:59AM -0800, David Anderson wrote:
> > Okay, I've set up a Debian stable builder as well... However, Debian
> stable
> > has a 3.16 kernel, and wireguard-dkms requires >=3.18, so installation
> > fails. Assuming 3.18 is a hard lower-bound on kernel versions, it looks
> > like jessie will never run in-kernel wireguard. Fortunately it'll be moot
> > in a few months when stretch becomes the new stable.
>
> Jessie-backports has linux 4.9, so it's probably much simpler to require
> users to install this.
>

Oh, excellent! I'll leave the jessie builder running then.

Jason: I'll get back to you once I've looked into setting up builds for
arm, to see how to revise the instructions. Given that each distro version
is likely to be slightly different, perhaps it'd be better to just link to
a readme on packagecloud.io, to avoid cluttering the install instructions
on wireguard.io?

- Dave


>
> > On Sat, Feb 11, 2017 at 2:17 AM, Jason A. Donenfeld <Jason@zx2c4.com>
> wrote:
> >
> > > Hi Dave,
> > >
> > > Ahh right, that old debate.
> > >
> > > Jason
> > >
>
> > _______________________________________________
> > WireGuard mailing list
> > WireGuard@lists.zx2c4.com
> > https://lists.zx2c4.com/mailman/listinfo/wireguard
>
>

[-- Attachment #2: Type: text/html, Size: 2327 bytes --]

Re: (Unofficial) wireguard packages for Debian Stretch (testing)

[Jason A. Donenfeld]

Hey Dave,

On Sat, Feb 11, 2017 at 10:49 AM, David Anderson <dave@natulte.net> wrote:
> Note that right now, only amd64 packages are available. If you think there's
> demand for Debian on 32-bit x86, I can set up i386 builders as well.

I doubt anybody cares about i386, but likely armv{6,7} and arm64 are
in demand somewhat, at the very least due to Rasberrian users.

Jason

Re: (Unofficial) wireguard packages for Debian Stretch (testing)

[David Anderson]

[-- Attachment #1: Type: text/plain, Size: 661 bytes --]

On Sat, Feb 11, 2017 at 4:32 AM, Jason A. Donenfeld <Jason@zx2c4.com> wrote:

> Hey Dave,
>
> On Sat, Feb 11, 2017 at 10:49 AM, David Anderson <dave@natulte.net> wrote:
> > Note that right now, only amd64 packages are available. If you think
> there's
> > demand for Debian on 32-bit x86, I can set up i386 builders as well.
>
> I doubt anybody cares about i386, but likely armv{6,7} and arm64 are
> in demand somewhat, at the very least due to Rasberrian users.
>

Hmm, I don't have functional arm-ish things on hand, but I'll see what I
can do with emulated setups. I'll skip i386 for now, if it turns out to be
in demand it's one VM spinup away.


> Jason
>

[-- Attachment #2: Type: text/html, Size: 1279 bytes --]

Re: (Unofficial) wireguard packages for Debian Stretch (testing)

[David Anderson]

[-- Attachment #1: Type: text/plain, Size: 1191 bytes --]

I'm failing at setting up arm builds, raspbian/rpi emulation is not in a
great shape these days. In the meantime, debian stable for amd64 is up.
Updated instructions for both debian versions are at
https://packagecloud.io/danderson/wireguard#readme-scrollto . In
particular, the jessie install requires first installing a backported
kernel. I'll keep poking at arm builds for a bit, but I don't promise
anything.

- Dave

On Sat, Feb 11, 2017 at 1:36 PM, David Anderson <dave@natulte.net> wrote:

> On Sat, Feb 11, 2017 at 4:32 AM, Jason A. Donenfeld <Jason@zx2c4.com>
> wrote:
>
>> Hey Dave,
>>
>> On Sat, Feb 11, 2017 at 10:49 AM, David Anderson <dave@natulte.net>
>> wrote:
>> > Note that right now, only amd64 packages are available. If you think
>> there's
>> > demand for Debian on 32-bit x86, I can set up i386 builders as well.
>>
>> I doubt anybody cares about i386, but likely armv{6,7} and arm64 are
>> in demand somewhat, at the very least due to Rasberrian users.
>>
>
> Hmm, I don't have functional arm-ish things on hand, but I'll see what I
> can do with emulated setups. I'll skip i386 for now, if it turns out to be
> in demand it's one VM spinup away.
>
>
>> Jason
>>
>
>

[-- Attachment #2: Type: text/html, Size: 2227 bytes --]

Re: (Unofficial) wireguard packages for Debian Stretch (testing)

[Jason A. Donenfeld]

On Sun, Feb 12, 2017 at 3:40 AM, David Anderson <dave@natulte.net> wrote:
>
> I'm failing at setting up arm builds, raspbian/rpi emulation is not in a =
great shape these days. In the meantime, debian stable for amd64 is up. Upd=
ated instructions for both debian versions are at https://packagecloud.io/d=
anderson/wireguard#readme-scrollto . In particular, the jessie install requ=
ires first installing a backported kernel. I'll keep poking at arm builds f=
or a bit, but I don't promise anything.


Good idea. I'll link to that instead.

Re: (Unofficial) wireguard packages for Debian Stretch (testing)

[Daniel Kahn Gillmor]

[-- Attachment #1: Type: text/plain, Size: 2229 bytes --]

On Fri 2017-02-10 19:23:50 -0500, David Anderson wrote:
> In case it's of use to anyone, I've built wireguard packages for Debian
> testing. I wanted to play with wireguard on my Debian Stretch systems, but
> wireguard is currently locked to Sid only until 1.0 brings API stability
> guarantees.
>
> So, I set up a cronjob that rebuilds the Sid source package on a Stretch
> system, and the result is wireguard packages that track the latest release,
> but don't pull in unstable versions of libc and whatnot when you try to
> install them, as would happen if you tried to install via package pinning.
>
> Naturally, you have only my word that the packages are unmodified rebuilds
> of Debian's original package, and you're trusting packagecloud to not
> tamper with the packages (it's their signing keys, not mine) so caveat
> emptor. It works for me, it might work for you as well.
>
> With the warnings and disclaimers out of the way, here's the repo:
> https://packagecloud.io/danderson/wireguard?filter=debs

I appreciate your interest in getting wider distribution for wireguard,
David, but i'm not convinced this approach makes much sense.

It seems like a lot of extra work compared to just putting wireguard
into stretch-backports once stretch is released.

Until stretch releases, people running testing should be able to just
add the unstable repository and pin it to be lower priority than testing
(see apt_preferences(5)).

Using this standard approach, users won't need to:

 a) add a new key to their apt configuration, which increases the attack
    surface for all installed packages (btw, the proposed shell pipe
    into "apt-key add -" is deprecated, see for example commentary at
    https://bugs.debian.org/853858)
 
 b) be dependent on some alternate suite of build daemons -- if debian
    supports your build environment, the buildds will have the wireguard
    packages.

So I don't see much to recommend the proposed approach by comparison,
and i don't think that it should be documented as a recommended approach
upstream, unless there are clearer benefits that i'm missing here.  In
that case, i'd like to know what those benefits are :)

         --dkg

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 832 bytes --]

Re: (Unofficial) wireguard packages for Debian Stretch (testing)

[Jason A. Donenfeld]

Hey Daniel,

That makes sense to me. I don't know much about Debian best practices,
so I'll defer to your judgement and revert the /install/ page
instruction. If David manages to convince you otherwise, I'll re-add
it then.

Jason

Re: (Unofficial) wireguard packages for Debian Stretch (testing)

[David Anderson]

[-- Attachment #1: Type: text/plain, Size: 3430 bytes --]

On Sun, Feb 12, 2017 at 3:01 PM, Daniel Kahn Gillmor <dkg@fifthhorseman.net>
wrote:

> On Fri 2017-02-10 19:23:50 -0500, David Anderson wrote:
> > In case it's of use to anyone, I've built wireguard packages for Debian
> > testing. I wanted to play with wireguard on my Debian Stretch systems,
> but
> > wireguard is currently locked to Sid only until 1.0 brings API stability
> > guarantees.
> >
> > So, I set up a cronjob that rebuilds the Sid source package on a Stretch
> > system, and the result is wireguard packages that track the latest
> release,
> > but don't pull in unstable versions of libc and whatnot when you try to
> > install them, as would happen if you tried to install via package
> pinning.
> >
> > Naturally, you have only my word that the packages are unmodified
> rebuilds
> > of Debian's original package, and you're trusting packagecloud to not
> > tamper with the packages (it's their signing keys, not mine) so caveat
> > emptor. It works for me, it might work for you as well.
> >
> > With the warnings and disclaimers out of the way, here's the repo:
> > https://packagecloud.io/danderson/wireguard?filter=debs
>
> I appreciate your interest in getting wider distribution for wireguard,
> David, but i'm not convinced this approach makes much sense.
>
> It seems like a lot of extra work compared to just putting wireguard
> into stretch-backports once stretch is released.
>

"Once stretch is released" could be a few months still, right? It's only
just gone into final freeze. I agree that once it's released, backports is
definitely the right way to distribute.


> Until stretch releases, people running testing should be able to just
> add the unstable repository and pin it to be lower priority than testing
> (see apt_preferences(5)).
>

So, I'd initially tried doing this, by adding the unstable repository at a
negative priority. What turned me off is that even with that low
preference, attempting to install the wireguard packages seemed to pull in
some core system libraries (libc and such) from unstable as well. And while
I'm excited about wireguard, I'm not "install unstable base libraries"
excited :).

That said, it's quite possible I was just not using the preference system
correctly. If it's possible to express "Install *only* wireguard-* from
unstable, never anything else", then I agree, that's definitely the way to
go.


>
> Using this standard approach, users won't need to:
>
>  a) add a new key to their apt configuration, which increases the attack
>     surface for all installed packages (btw, the proposed shell pipe
>     into "apt-key add -" is deprecated, see for example commentary at
>     https://bugs.debian.org/853858)
>
>  b) be dependent on some alternate suite of build daemons -- if debian
>     supports your build environment, the buildds will have the wireguard
>     packages.
>
> So I don't see much to recommend the proposed approach by comparison,
> and i don't think that it should be documented as a recommended approach
> upstream, unless there are clearer benefits that i'm missing here.  In
> that case, i'd like to know what those benefits are :)
>

Fair enough, I defer to your greater experience with Debian packaging.
Fortunately, packagecloud's stats say that there were no installs from my
repository, so assuming I can get pinning to work properly, the only
systems that need cleanup are my own.

Cheers,
- Dave


>
>          --dkg
>

[-- Attachment #2: Type: text/html, Size: 4828 bytes --]

Re: (Unofficial) wireguard packages for Debian Stretch (testing)

[Daniel Kahn Gillmor]

On Mon 2017-02-13 23:55:45 -0500, David Anderson wrote:
> "Once stretch is released" could be a few months still, right? It's only
> just gone into final freeze. I agree that once it's released, backports is
> definitely the right way to distribute.

Yep, it could still be a few months, depending on how rapidly we're able
to fix the remaining outstanding release-critical bugs.  

> So, I'd initially tried doing this, by adding the unstable repository at a
> negative priority. What turned me off is that even with that low
> preference, attempting to install the wireguard packages seemed to pull in
> some core system libraries (libc and such) from unstable as well. And while
> I'm excited about wireguard, I'm not "install unstable base libraries"
> excited :).

absolutely!  However, i'm a little surprised that this happened.  If you
could show a transcript of what you did specifically, and what the
resultant proposed apt changes were, i'd be interested in understanding
what went on there.

on a similar system i'm using (stretch, with unstable available but
pinned low), i see only packages from stretch being installed (aside
from wireguard itself, clearly)

0 root@test:~# cat /etc/apt/sources.list.d/unstable.list 
deb http://ftp.us.debian.org/debian/ unstable main
0 root@test:~# cat /etc/apt/preferences.d/limit-unstable 
Package: *
Pin: release a=unstable
Pin-Priority: 200
1 root@test:~# apt install wireguard-dkms wireguard-tools -d
Reading package lists... Done
Building dependency tree       
Reading state information... Done
The following additional packages will be installed:
  binutils cpp cpp-6 dkms gcc gcc-6 libasan3 libatomic1 libcc1-0 libcilkrts5
  libgcc-6-dev libgomp1 libisl15 libitm1 liblsan0 libmpc3 libmpfr4 libmpx2
  libquadmath0 libtsan0 libubsan0 make patch
Suggested packages:
  binutils-doc cpp-doc gcc-6-locales python3-apport menu gcc-multilib
  manpages-dev autoconf automake libtool flex bison gdb gcc-doc gcc-6-multilib
  gcc-6-doc libgcc1-dbg libgomp1-dbg libitm1-dbg libatomic1-dbg libasan3-dbg
  liblsan0-dbg libtsan0-dbg libubsan0-dbg libcilkrts5-dbg libmpx2-dbg
  libquadmath0-dbg make-doc ed diffutils-doc
Recommended packages:
  fakeroot sudo linux-headers-686-pae | linux-headers-amd64
  | linux-headers-generic | linux-headers lsb-release libc6-dev | libc-dev
  libc6-dev
The following NEW packages will be installed:
  binutils cpp cpp-6 dkms gcc gcc-6 libasan3 libatomic1 libcc1-0 libcilkrts5
  libgcc-6-dev libgomp1 libisl15 libitm1 liblsan0 libmpc3 libmpfr4 libmpx2
  libquadmath0 libtsan0 libubsan0 make patch wireguard-dkms wireguard-tools
0 upgraded, 25 newly installed, 0 to remove and 0 not upgraded.
Need to get 22.4 MB of archives.
After this operation, 94.5 MB of additional disk space will be used.
Do you want to continue? [Y/n] 
Get:1 http://ftp.us.debian.org/debian stretch/main amd64 libmpfr4 amd64 3.1.5-1 [556 kB]
Get:2 http://ftp.us.debian.org/debian stretch/main amd64 libmpc3 amd64 1.0.3-1 [40.2 kB]
Get:3 http://ftp.us.debian.org/debian stretch/main amd64 binutils amd64 2.27.90.20170124-2 [3,761 kB]
Get:4 http://ftp.us.debian.org/debian stretch/main amd64 libisl15 amd64 0.18-1 [564 kB]
Get:5 http://ftp.us.debian.org/debian stretch/main amd64 cpp-6 amd64 6.3.0-6 [6,574 kB]
Get:6 http://ftp.us.debian.org/debian stretch/main amd64 cpp amd64 4:6.3.0-1 [18.6 kB]
Get:7 http://ftp.us.debian.org/debian stretch/main amd64 libcc1-0 amd64 6.3.0-6 [30.7 kB]
Get:8 http://ftp.us.debian.org/debian stretch/main amd64 libgomp1 amd64 6.3.0-6 [73.2 kB]
Get:9 http://ftp.us.debian.org/debian stretch/main amd64 libitm1 amd64 6.3.0-6 [27.3 kB]
Get:10 http://ftp.us.debian.org/debian stretch/main amd64 libatomic1 amd64 6.3.0-6 [8,904 B]
Get:11 http://ftp.us.debian.org/debian stretch/main amd64 libasan3 amd64 6.3.0-6 [311 kB]
Get:12 http://ftp.us.debian.org/debian stretch/main amd64 liblsan0 amd64 6.3.0-6 [115 kB]
Get:13 http://ftp.us.debian.org/debian stretch/main amd64 libtsan0 amd64 6.3.0-6 [256 kB]
Get:14 http://ftp.us.debian.org/debian stretch/main amd64 libubsan0 amd64 6.3.0-6 [107 kB]
Get:15 http://ftp.us.debian.org/debian stretch/main amd64 libcilkrts5 amd64 6.3.0-6 [40.6 kB]
Get:16 http://ftp.us.debian.org/debian stretch/main amd64 libmpx2 amd64 6.3.0-6 [11.2 kB]
Get:17 http://ftp.us.debian.org/debian stretch/main amd64 libquadmath0 amd64 6.3.0-6 [131 kB]
Get:18 http://ftp.us.debian.org/debian stretch/main amd64 libgcc-6-dev amd64 6.3.0-6 [2,296 kB]
Get:19 http://ftp.us.debian.org/debian stretch/main amd64 gcc-6 amd64 6.3.0-6 [6,852 kB]
Get:20 http://ftp.us.debian.org/debian stretch/main amd64 gcc amd64 4:6.3.0-1 [5,184 B]
Get:21 http://ftp.us.debian.org/debian stretch/main amd64 make amd64 4.1-9 [299 kB]
Get:22 http://ftp.us.debian.org/debian stretch/main amd64 patch amd64 2.7.5-1 [109 kB]
Get:23 http://ftp.us.debian.org/debian stretch/main amd64 dkms all 2.3-2 [74.8 kB]
Get:24 http://ftp.us.debian.org/debian unstable/main amd64 wireguard-dkms all 0.0.20170213-1 [90.2 kB]
Get:25 http://ftp.us.debian.org/debian unstable/main amd64 wireguard-tools amd64 0.0.20170213-1 [44.9 kB]
Fetched 22.4 MB in 2s (9,247 kB/s)     
Download complete and in download only mode
0 root@test:~# 

Please let me know what you're seeing that's different.

Regards,

       --dkg

Re: (Unofficial) wireguard packages for Debian Stretch (testing)

[Baptiste Jonglez]

[-- Attachment #1: Type: text/plain, Size: 1676 bytes --]

On Tue, Feb 14, 2017 at 10:50:14AM -0500, Daniel Kahn Gillmor wrote:
> on a similar system i'm using (stretch, with unstable available but
> pinned low), i see only packages from stretch being installed (aside
> from wireguard itself, clearly)
> 
> 0 root@test:~# cat /etc/apt/sources.list.d/unstable.list 
> deb http://ftp.us.debian.org/debian/ unstable main
> 0 root@test:~# cat /etc/apt/preferences.d/limit-unstable 
> Package: *
> Pin: release a=unstable
> Pin-Priority: 200

Thanks for the hint, it worked fine on my stretch system!  Here are the
packages that got pulled:

The following NEW packages will be installed:
  dkms linux-compiler-gcc-6-x86 linux-headers-4.9.0-1-amd64
  linux-headers-4.9.0-1-common linux-headers-amd64 linux-kbuild-4.9
  wireguard-dkms wireguard-tools


On jessie, it worked exactly the same with the 4.9 kernel from
jessie-backports:

# cat /etc/apt/sources.list
deb http://httpredir.debian.org/debian jessie main
deb http://httpredir.debian.org/debian jessie-backports main
deb http://httpredir.debian.org/debian unstable main
# cat /etc/apt/preferences.d/limit-unstable
Package: *
Pin: release a=unstable
Pin-Priority: 200
# apt update
# apt install -t jessie-backports linux-image-amd64 linux-base
# reboot
# apt install wireguard-dkms wireguard-tools
# ./client.sh
# ping 192.168.4.1
PING 192.168.4.1 (192.168.4.1) 56(84) bytes of data.
64 bytes from 192.168.4.1: icmp_seq=1 ttl=64 time=15.1 ms

For the record, it also works fine with the 4.1.34.mptcp kernel from
multipath-tcp.org on jessie :)

Jason, can you write something up on the Wireguard website, since it's so
simple?

Baptiste

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 833 bytes --]

Re: (Unofficial) wireguard packages for Debian Stretch (testing)

[Daniel Kahn Gillmor]

[-- Attachment #1: Type: text/plain, Size: 1061 bytes --]

Hi Baptiste--

On Wed 2017-02-15 16:31:54 -0500, Baptiste Jonglez wrote:
> On jessie, it worked exactly the same with the 4.9 kernel from
> jessie-backports:
>
> # cat /etc/apt/sources.list
> deb http://httpredir.debian.org/debian jessie main
> deb http://httpredir.debian.org/debian jessie-backports main
> deb http://httpredir.debian.org/debian unstable main
> # cat /etc/apt/preferences.d/limit-unstable
> Package: *
> Pin: release a=unstable
> Pin-Priority: 200
> # apt update
> # apt install -t jessie-backports linux-image-amd64 linux-base
> # reboot
> # apt install wireguard-dkms wireguard-tools
> # ./client.sh
> # ping 192.168.4.1
> PING 192.168.4.1 (192.168.4.1) 56(84) bytes of data.
> 64 bytes from 192.168.4.1: icmp_seq=1 ttl=64 time=15.1 ms

interesting, thanks for testing and reporting back!

are you sure that with this installation on jessie, the wireguard
packages are the only things that got pulled in from unstable?

If you have apt-show-versions installed, you might try grepping through
its output to make sure.

Regards,

       --dkg

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 832 bytes --]

Re: (Unofficial) wireguard packages for Debian Stretch (testing)

[Baptiste Jonglez]

[-- Attachment #1: Type: text/plain, Size: 1221 bytes --]

On Thu, Feb 16, 2017 at 09:46:15PM -0500, Daniel Kahn Gillmor wrote:
> On Wed 2017-02-15 16:31:54 -0500, Baptiste Jonglez wrote:
> > On jessie, it worked exactly the same with the 4.9 kernel from
> > jessie-backports:
> >
> > # cat /etc/apt/sources.list
> > deb http://httpredir.debian.org/debian jessie main
> > deb http://httpredir.debian.org/debian jessie-backports main
> > deb http://httpredir.debian.org/debian unstable main
> > # cat /etc/apt/preferences.d/limit-unstable
> > Package: *
> > Pin: release a=unstable
> > Pin-Priority: 200
> > # apt update
> > # apt install -t jessie-backports linux-image-amd64 linux-base
> > # reboot
> > # apt install wireguard-dkms wireguard-tools
> > # ./client.sh
> > # ping 192.168.4.1
> > PING 192.168.4.1 (192.168.4.1) 56(84) bytes of data.
> > 64 bytes from 192.168.4.1: icmp_seq=1 ttl=64 time=15.1 ms
> 
> interesting, thanks for testing and reporting back!
> 
> are you sure that with this installation on jessie, the wireguard
> packages are the only things that got pulled in from unstable?

Yes, it pulled only dkms and menu (from jessie).  Though I probably had
the other dependencies already installed (from jessie or jessie-backports).

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 833 bytes --]

Re: (Unofficial) wireguard packages for Debian Stretch (testing)

[Jason A. Donenfeld]

Hey guys,

Very nice investigation. I think adding some simple instructions on
this to the WireGuard website makes sense. If you've got a one or two
or three or four line command to magically add these files and sync
the repos, could you send it along? Then I'll include it on the page.

Jason

Re: (Unofficial) wireguard packages for Debian Stretch (testing)

[David Anderson]

[-- Attachment #1: Type: text/plain, Size: 8992 bytes --]

On Tue, Feb 14, 2017 at 7:50 AM, Daniel Kahn Gillmor <dkg@fifthhorseman.net>
wrote:

> On Mon 2017-02-13 23:55:45 -0500, David Anderson wrote:
> > "Once stretch is released" could be a few months still, right? It's only
> > just gone into final freeze. I agree that once it's released, backports
> is
> > definitely the right way to distribute.
>
> Yep, it could still be a few months, depending on how rapidly we're able
> to fix the remaining outstanding release-critical bugs.
>
> > So, I'd initially tried doing this, by adding the unstable repository at
> a
> > negative priority. What turned me off is that even with that low
> > preference, attempting to install the wireguard packages seemed to pull
> in
> > some core system libraries (libc and such) from unstable as well. And
> while
> > I'm excited about wireguard, I'm not "install unstable base libraries"
> > excited :).
>
> absolutely!  However, i'm a little surprised that this happened.  If you
> could show a transcript of what you did specifically, and what the
> resultant proposed apt changes were, i'd be interested in understanding
> what went on there.
>

Apologies for the delay. I tried pinning again on a fresh Stretch VM. It
looks like I confused myself by assuming that all the extra packages to be
installed were from sid as well, whereas -d shows that the vast majority
are coming from stretch/main. Sorry about the confusion, given this
behavior I completely agree that this should be the documented way to get
wireguard before stretch gets released as stable.

The transcript below still shows one additional package being pulled from
sid/main, the dkms package. I find this strange: wireguard-dkms depends on
dkms >=2.1.0.0, stretch has dkms 2.3-2, and sid has dkms 2.3-3. Despite the
negative priority for unstable, apt picks 2.3-3 from sid, even though the
dependency could be satisfied out of stretch. What am I missing?

root@atik # echo "deb http://ftp.us.debian.org/debian sid main"
>/etc/apt/sources.list.d/sid.list
root@atik # cat >/etc/apt/preferences.d/avoid_sid <<EOF
Package: *
Pin: release a=unstable
Pin-Priority: -10
EOF
root@atik # apt update
Hit:1 http://security.debian.org stretch/updates InRelease
Hit:2 http://ftp.us.debian.org/debian stretch InRelease

Hit:3 http://ftp.us.debian.org/debian stretch-updates InRelease

Get:4 http://ftp.us.debian.org/debian sid InRelease [231 kB]

Hit:5 http://deb.robustperception.io precise InRelease

Get:6 http://ftp.us.debian.org/debian sid/main amd64 Packages [7,446 kB]
Get:7 http://ftp.us.debian.org/debian sid/main Translation-en [5,645 kB]
Fetched 13.3 MB in 7s (1,739 kB/s)

Reading package lists... Done
Building dependency tree
Reading state information... Done
All packages are up to date.
root@atik # apt upgrade
Reading package lists... Done
Building dependency tree
Reading state information... Done
Calculating upgrade... Done
0 upgraded, 0 newly installed, 0 to remove and 0 not upgraded.
root@atik # apt install -d wireguard-dkms/unstable wireguard-tools/unstable
Reading package lists... Done
Building dependency tree
Reading state information... Done
Selected version '0.0.20170214-1' (Debian:unstable [all]) for
'wireguard-dkms'
Selected version '0.0.20170214-1' (Debian:unstable [amd64]) for
'wireguard-tools'
The following additional packages will be installed:
  dkms fakeroot gcc libfakeroot linux-headers-amd64
Suggested packages:
  python3-apport menu gcc-multilib autoconf automake libtool flex bison gdb
gcc-doc
The following NEW packages will be installed:
  dkms fakeroot gcc libfakeroot linux-headers-amd64 wireguard-dkms
wireguard-tools
0 upgraded, 7 newly installed, 0 to remove and 59 not upgraded.
Need to get 348 kB of archives.
After this operation, 1,360 kB of additional disk space will be used.
Do you want to continue? [Y/n]
Get:1 http://ftp.us.debian.org/debian stretch/main amd64 gcc amd64
4:6.3.0-1 [5,184 B]
Get:2 http://ftp.us.debian.org/debian sid/main amd64 dkms all 2.3-3 [74.9
kB]
Get:3 http://ftp.us.debian.org/debian stretch/main amd64 libfakeroot amd64
1.21-3.1 [45.7 kB]
Get:4 http://ftp.us.debian.org/debian stretch/main amd64 fakeroot amd64
1.21-3.1 [85.6 kB]
Get:5 http://ftp.us.debian.org/debian stretch/main amd64
linux-headers-amd64 amd64 4.9+78 [5,744 B]
Get:6 http://ftp.us.debian.org/debian sid/main amd64 wireguard-dkms all
0.0.20170214-1 [85.5 kB]
Get:7 http://ftp.us.debian.org/debian sid/main amd64 wireguard-tools amd64
0.0.20170214-1 [44.9 kB]
Fetched 348 kB in 0s (531 kB/s)
Download complete and in download only mode


Cheers,
- Dave


>
> on a similar system i'm using (stretch, with unstable available but
> pinned low), i see only packages from stretch being installed (aside
> from wireguard itself, clearly)
>
> 0 root@test:~# cat /etc/apt/sources.list.d/unstable.list
> deb http://ftp.us.debian.org/debian/ unstable main
> 0 root@test:~# cat /etc/apt/preferences.d/limit-unstable
> Package: *
> Pin: release a=unstable
> Pin-Priority: 200
> 1 root@test:~# apt install wireguard-dkms wireguard-tools -d
> Reading package lists... Done
> Building dependency tree
> Reading state information... Done
> The following additional packages will be installed:
>   binutils cpp cpp-6 dkms gcc gcc-6 libasan3 libatomic1 libcc1-0
> libcilkrts5
>   libgcc-6-dev libgomp1 libisl15 libitm1 liblsan0 libmpc3 libmpfr4 libmpx2
>   libquadmath0 libtsan0 libubsan0 make patch
> Suggested packages:
>   binutils-doc cpp-doc gcc-6-locales python3-apport menu gcc-multilib
>   manpages-dev autoconf automake libtool flex bison gdb gcc-doc
> gcc-6-multilib
>   gcc-6-doc libgcc1-dbg libgomp1-dbg libitm1-dbg libatomic1-dbg
> libasan3-dbg
>   liblsan0-dbg libtsan0-dbg libubsan0-dbg libcilkrts5-dbg libmpx2-dbg
>   libquadmath0-dbg make-doc ed diffutils-doc
> Recommended packages:
>   fakeroot sudo linux-headers-686-pae | linux-headers-amd64
>   | linux-headers-generic | linux-headers lsb-release libc6-dev | libc-dev
>   libc6-dev
> The following NEW packages will be installed:
>   binutils cpp cpp-6 dkms gcc gcc-6 libasan3 libatomic1 libcc1-0
> libcilkrts5
>   libgcc-6-dev libgomp1 libisl15 libitm1 liblsan0 libmpc3 libmpfr4 libmpx2
>   libquadmath0 libtsan0 libubsan0 make patch wireguard-dkms wireguard-tools
> 0 upgraded, 25 newly installed, 0 to remove and 0 not upgraded.
> Need to get 22.4 MB of archives.
> After this operation, 94.5 MB of additional disk space will be used.
> Do you want to continue? [Y/n]
> Get:1 http://ftp.us.debian.org/debian stretch/main amd64 libmpfr4 amd64
> 3.1.5-1 [556 kB]
> Get:2 http://ftp.us.debian.org/debian stretch/main amd64 libmpc3 amd64
> 1.0.3-1 [40.2 kB]
> Get:3 http://ftp.us.debian.org/debian stretch/main amd64 binutils amd64
> 2.27.90.20170124-2 [3,761 kB]
> Get:4 http://ftp.us.debian.org/debian stretch/main amd64 libisl15 amd64
> 0.18-1 [564 kB]
> Get:5 http://ftp.us.debian.org/debian stretch/main amd64 cpp-6 amd64
> 6.3.0-6 [6,574 kB]
> Get:6 http://ftp.us.debian.org/debian stretch/main amd64 cpp amd64
> 4:6.3.0-1 [18.6 kB]
> Get:7 http://ftp.us.debian.org/debian stretch/main amd64 libcc1-0 amd64
> 6.3.0-6 [30.7 kB]
> Get:8 http://ftp.us.debian.org/debian stretch/main amd64 libgomp1 amd64
> 6.3.0-6 [73.2 kB]
> Get:9 http://ftp.us.debian.org/debian stretch/main amd64 libitm1 amd64
> 6.3.0-6 [27.3 kB]
> Get:10 http://ftp.us.debian.org/debian stretch/main amd64 libatomic1
> amd64 6.3.0-6 [8,904 B]
> Get:11 http://ftp.us.debian.org/debian stretch/main amd64 libasan3 amd64
> 6.3.0-6 [311 kB]
> Get:12 http://ftp.us.debian.org/debian stretch/main amd64 liblsan0 amd64
> 6.3.0-6 [115 kB]
> Get:13 http://ftp.us.debian.org/debian stretch/main amd64 libtsan0 amd64
> 6.3.0-6 [256 kB]
> Get:14 http://ftp.us.debian.org/debian stretch/main amd64 libubsan0 amd64
> 6.3.0-6 [107 kB]
> Get:15 http://ftp.us.debian.org/debian stretch/main amd64 libcilkrts5
> amd64 6.3.0-6 [40.6 kB]
> Get:16 http://ftp.us.debian.org/debian stretch/main amd64 libmpx2 amd64
> 6.3.0-6 [11.2 kB]
> Get:17 http://ftp.us.debian.org/debian stretch/main amd64 libquadmath0
> amd64 6.3.0-6 [131 kB]
> Get:18 http://ftp.us.debian.org/debian stretch/main amd64 libgcc-6-dev
> amd64 6.3.0-6 [2,296 kB]
> Get:19 http://ftp.us.debian.org/debian stretch/main amd64 gcc-6 amd64
> 6.3.0-6 [6,852 kB]
> Get:20 http://ftp.us.debian.org/debian stretch/main amd64 gcc amd64
> 4:6.3.0-1 [5,184 B]
> Get:21 http://ftp.us.debian.org/debian stretch/main amd64 make amd64
> 4.1-9 [299 kB]
> Get:22 http://ftp.us.debian.org/debian stretch/main amd64 patch amd64
> 2.7.5-1 [109 kB]
> Get:23 http://ftp.us.debian.org/debian stretch/main amd64 dkms all 2.3-2
> [74.8 kB]
> Get:24 http://ftp.us.debian.org/debian unstable/main amd64 wireguard-dkms
> all 0.0.20170213-1 [90.2 kB]
> Get:25 http://ftp.us.debian.org/debian unstable/main amd64
> wireguard-tools amd64 0.0.20170213-1 [44.9 kB]
> Fetched 22.4 MB in 2s (9,247 kB/s)
> Download complete and in download only mode
> 0 root@test:~#
>
> Please let me know what you're seeing that's different.
>
> Regards,
>
>        --dkg
>

[-- Attachment #2: Type: text/html, Size: 13918 bytes --]

Re: (Unofficial) wireguard packages for Debian Stretch (testing)

[Daniel Kahn Gillmor]

[-- Attachment #1: Type: text/plain, Size: 589 bytes --]

On Thu 2017-02-16 22:14:11 -0500, David Anderson wrote:
> The transcript below still shows one additional package being pulled from
> sid/main, the dkms package. I find this strange: wireguard-dkms depends on
> dkms >=2.1.0.0, stretch has dkms 2.3-2, and sid has dkms 2.3-3. Despite the
> negative priority for unstable, apt picks 2.3-3 from sid, even though the
> dependency could be satisfied out of stretch. What am I missing?

That is indeed weird.  what does "apt-cache policy dkms" show you?

what if you "apt install dkms" on its own first, which version do you
get?

        --dkg

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 832 bytes --]

Re: (Unofficial) wireguard packages for Debian Stretch (testing)

[David Anderson]

[-- Attachment #1: Type: text/plain, Size: 2289 bytes --]

On Fri, Feb 17, 2017 at 11:49 AM, Daniel Kahn Gillmor <dkg@fifthhorseman.net
> wrote:

> On Thu 2017-02-16 22:14:11 -0500, David Anderson wrote:
> > The transcript below still shows one additional package being pulled from
> > sid/main, the dkms package. I find this strange: wireguard-dkms depends
> on
> > dkms >=2.1.0.0, stretch has dkms 2.3-2, and sid has dkms 2.3-3. Despite
> the
> > negative priority for unstable, apt picks 2.3-3 from sid, even though the
> > dependency could be satisfied out of stretch. What am I missing?
>
> That is indeed weird.  what does "apt-cache policy dkms" show you?
>

# apt-cache policy dkms
dkms:
  Installed: (none)
  Candidate: 2.3-2
  Version table:
     2.3-3 -1
        -10 http://ftp.us.debian.org/debian sid/main amd64 Packages
        100 /var/lib/dpkg/status
     2.3-2 500
        500 http://ftp.us.debian.org/debian stretch/main amd64 Packages


what if you "apt install dkms" on its own first, which version do you
> get?
>

# apt install -d dkms
Reading package lists... Done
Building dependency tree
Reading state information... Done
The following additional packages will be installed:
  fakeroot gcc libfakeroot linux-headers-amd64
Suggested packages:
  python3-apport menu gcc-multilib autoconf automake libtool flex bison gdb
gcc-doc
The following NEW packages will be installed:
  dkms fakeroot gcc libfakeroot linux-headers-amd64
0 upgraded, 5 newly installed, 0 to remove and 0 not upgraded.
Need to get 217 kB of archives.
After this operation, 717 kB of additional disk space will be used.
Do you want to continue? [Y/n]
Get:1 http://ftp.us.debian.org/debian stretch/main amd64 gcc amd64
4:6.3.0-1 [5,184 B]
Get:2 http://ftp.us.debian.org/debian stretch/main amd64 dkms all 2.3-2
[74.8 kB]
Get:3 http://ftp.us.debian.org/debian stretch/main amd64 libfakeroot amd64
1.21-3.1 [45.7 kB]
Get:4 http://ftp.us.debian.org/debian stretch/main amd64 fakeroot amd64
1.21-3.1 [85.6 kB]
Get:5 http://ftp.us.debian.org/debian stretch/main amd64
linux-headers-amd64 amd64 4.9+78 [5,744 B]
Fetched 217 kB in 0s (328 kB/s)
Download complete and in download only mode

Looks like installing just dkms correctly selects from Stretch, whereas
installing as a dependency of wireguard-dkms pulls in the sid version.

- Dave



>
>         --dkg
>

[-- Attachment #2: Type: text/html, Size: 3869 bytes --]

Re: (Unofficial) wireguard packages for Debian Stretch (testing)

[Ibrahim Tachijian]

[-- Attachment #1: Type: text/plain, Size: 2783 bytes --]

I for one would love to be able to try WireGuard on Debian Jessie on 3.16
kernel.

The reason being is I do not see myself upgrading and/or running a
backported linux kernel for the foreseeable future.

Are there any limitations in 3.16 kernel when it comes to Wireguard
capabilities ?

Thanks,


On Tue, Feb 21, 2017 at 12:53 AM David Anderson <dave@natulte.net> wrote:

On Fri, Feb 17, 2017 at 11:49 AM, Daniel Kahn Gillmor <dkg@fifthhorseman.net
> wrote:

On Thu 2017-02-16 22:14:11 -0500, David Anderson wrote:
> The transcript below still shows one additional package being pulled from
> sid/main, the dkms package. I find this strange: wireguard-dkms depends on
> dkms >=2.1.0.0, stretch has dkms 2.3-2, and sid has dkms 2.3-3. Despite
the
> negative priority for unstable, apt picks 2.3-3 from sid, even though the
> dependency could be satisfied out of stretch. What am I missing?

That is indeed weird.  what does "apt-cache policy dkms" show you?


# apt-cache policy dkms
dkms:
  Installed: (none)
  Candidate: 2.3-2
  Version table:
     2.3-3 -1
        -10 http://ftp.us.debian.org/debian sid/main amd64 Packages
        100 /var/lib/dpkg/status
     2.3-2 500
        500 http://ftp.us.debian.org/debian stretch/main amd64 Packages


what if you "apt install dkms" on its own first, which version do you
get?


# apt install -d dkms
Reading package lists... Done
Building dependency tree
Reading state information... Done
The following additional packages will be installed:
  fakeroot gcc libfakeroot linux-headers-amd64
Suggested packages:
  python3-apport menu gcc-multilib autoconf automake libtool flex bison gdb
gcc-doc
The following NEW packages will be installed:
  dkms fakeroot gcc libfakeroot linux-headers-amd64
0 upgraded, 5 newly installed, 0 to remove and 0 not upgraded.
Need to get 217 kB of archives.
After this operation, 717 kB of additional disk space will be used.
Do you want to continue? [Y/n]
Get:1 http://ftp.us.debian.org/debian stretch/main amd64 gcc amd64
4:6.3.0-1 [5,184 B]
Get:2 http://ftp.us.debian.org/debian stretch/main amd64 dkms all 2.3-2
[74.8 kB]
Get:3 http://ftp.us.debian.org/debian stretch/main amd64 libfakeroot amd64
1.21-3.1 [45.7 kB]
Get:4 http://ftp.us.debian.org/debian stretch/main amd64 fakeroot amd64
1.21-3.1 [85.6 kB]
Get:5 http://ftp.us.debian.org/debian stretch/main amd64
linux-headers-amd64 amd64 4.9+78 [5,744 B]
Fetched 217 kB in 0s (328 kB/s)
Download complete and in download only mode

Looks like installing just dkms correctly selects from Stretch, whereas
installing as a dependency of wireguard-dkms pulls in the sid version.

- Dave




        --dkg


_______________________________________________
WireGuard mailing list
WireGuard@lists.zx2c4.com
https://lists.zx2c4.com/mailman/listinfo/wireguard

[-- Attachment #2: Type: text/html, Size: 8478 bytes --]