Installing a needed package that isn't in Debian repos

[Enigma83]

The program's name is VeraCrypt, the successor to TrueCrypt. I use it alot with my encrypted external drives. However, I've noticed that it isn't in Debian repos, it's also not in backports. And I couldn't find a Flatpak/Snap for it either.

They do have a website, and they do produce Debian-specific packages.

https://veracrypt.fr/en/Downloads.html

I also found this:

https://wiki.debian.org/DontBreakDebian

Of course, it advises to not install packages that aren't in the official repos. Which kind of leaves me between a rock and a hard place, since a package I use often is only available by installing a deb file from the VeraCrypt website.

Which gives me an idea, that maybe I can install it into my home directory only, without root access, instead of manually installing the deb file with apt. This wouldn't pose the risk of breaking Debian, since the program wouldn't exist outside my home directory. I know how to edit ~/.profile, add a custom path within my home, so that a binary can be ran via CLI without referrencing the absolute path.

The issue is that I don't know of a viable method that would allow to me to install the deb file without root and into my home only. VeraCrypt will of course ask for root access when mounting volumes, since mounting requires root. But that shouldn't be an issue as long as it doesn't install into system directories.

I'm also aware that installing outside apt will make it difficult to remove packages, since apt can't keep track of what went where.

So...ideas?

[sunrat]

Have you considered ZuluCrypt instead?
http://mhogomchungu.github.io/zuluCrypt/
https://packages.debian.org/search?keywords=ZuluCrypt

It's in Debian repo. Assuming you want the GUI version:

Code: Select all

apt install zulucrypt-gui

[Enigma83]

Have you considered ZuluCrypt instead?
http://mhogomchungu.github.io/zuluCrypt/
https://packages.debian.org/search?keywords=ZuluCrypt

It's in Debian repo. Assuming you want the GUI version:

Code: Select all

apt install zulucrypt-gui

I've never heard of it. All of the encrypted volumes use the NTFS filesystem, and were encrypted by Veracrypt in Windows. I only need something that can access them as read/write. Although installing Veracrypt into my home partition is an option i'd like to explore.

[peer]

I would install the veracrypt package.

[Enigma83]

I would install the veracrypt package.

I would have too, until reading the Don't Break Debian article. But since I only need to access encrypted partitions that were created outside of Linux, then it's not worth the risk to install their deb file. Especially not if Zulucrypt can do what I need. I'll find out later today when I have time to try it.

[bbbhltz]

It looks like zuluCrypt might be a good solution here, but installing a .deb from the web isn't the same as adding a source to the repos. You can download it as check the dependencies with

Code: Select all

dpkg -I file.deb

beforehand.

[pbear]

VeraCrypt is a well-known and respected project. Quite the opposite of, "On Debian installing software from random websites is a bad habit." Meanwhile, zuluCrypt seems to be one guy whose last update was two years ago.
I've not used VC for a couple years - I moved my sensitive data to a LUKS partition mounted only when needed (and accessible to my Win10 VM) - but never had the slightest trouble with VC's deb file.

[lindi]

VeraCrypt is a well-known and respected project. Quite the opposite of, "On Debian installing software from random websites is a bad habit." Meanwhile, zuluCrypt seems to be one guy whose last update was two years ago.
I've not used VC for a couple years - I moved my sensitive data to a LUKS partition mounted only when needed (and accessible to my Win10 VM) - but never had the slightest trouble with VC's deb file.

Last time I checked users could get root privileges if they were allowed to mount veracrypt containers. That happens since they can e.g. contain ext4 filesystem with suid binaries. So I guess veracrypt is not suitable for university computers that have more than one user?

[Bulkley]

Most, if not all, of us have installed a non-Debian package. The important thing to remember is to block the repo after installing. If you leave a source open every time you do an upgrade you can have little surprises sneaking in.

[pbear]

Last time I checked users could get root privileges if they were allowed to mount veracrypt containers.

From memory, root authorization was required for the mount, with default settings anyway. Not something I'd have worried about, as I'm the only user on my computers. Also, my memory might be rusty and/or things may have changed. Been doing a little reading about zuluCrypt. It's an interesting app and the developer seems pretty sharp. For general use, might even be better than VC. To open VC containers, though, I'd use VC.

Edit: Out of curiosity, did a quick test in a Bookworm VM, installing the latest deb file from VeraCrypt. Created an encrypted volume on flash drive. Added a non-admin user to the VM. Said user can't mount the encrypted volume. Can't even access the folder if mounted by the admin user and left mounted while switching users. Don't doubt there's some scenario where privilege escalation is possible, but the default behavior is what one would expect.

Edit 2: Based on a little research, best way to enable non-admin user to mount a VC-encrypted volume seems to be a sudoers file - I used /etc/sudoers.d/20-veracrypt - with one line: %veracrypt ALL=(ALL) NOPASSWD:/usr/bin/veracrypt. Created the group and added both users to it. Indeed works, except non-admin user is required to enter its (non-sudo) password. Can't think of any significant risk from this solution, but perhaps I'm overlooking something.

Doing this as an edit because the OP hasn't indicated an interest in the issue, but thought it worthwhile to report the test.

[CynicalDebian]

Which gives me an idea, that maybe I can install it into my home directory only, without root access, instead of manually installing the deb file with apt. This wouldn't pose the risk of breaking Debian, since the program wouldn't exist outside my home directory. I know how to edit ~/.profile, add a custom path within my home, so that a binary can be ran via CLI without referrencing the absolute path.

The issue is that I don't know of a viable method that would allow to me to install the deb file without root and into my home only. VeraCrypt will of course ask for root access when mounting volumes, since mounting requires root. But that shouldn't be an issue as long as it doesn't install into system directories.

.deb packages are just tar archives. You can extract it with

Code: Select all

$ dpkg -x /path/to/file.deb

Then you can locate the binary and arrange files yourself how you want.

There are security issues related to using an unprivileged install, but a bit hard to explain and not the worst thing in the world.

It looks like zuluCrypt might be a good solution here, but installing a .deb from the web isn't the same as adding a source to the repos. You can download it as check the dependencies with

Many a proprietary/upstream .deb happy to import custom gpg keys, and add a file to /etc/apt/sources.list.d without you knowing. Then to poison your libs with upstreams and break later. As Bulkley said you can simply delete the sources.list.d entry.

Installing local .deb = arbitrary code execution on your computer as root. Many things can be written in the post-install script of the .deb.

Anyways, long-standing/popular software that isn't packaged in Debian should always raise suspicions on WHY it isn't. A good thing to look for is a RFP (Request For Package) bug for such software.

https://bugs.debian.org/cgi-bin/bugrepo ... ug=1029456
Finds you:
https://bugs.debian.org/cgi-bin/bugrepo ... bug=814352

As discussed in https://bugs.debian.org/cgi-bin/bugrepo ... bug=814352, it has
a shady licensing model making it DFSG incompatible. IDK why wnpp-check wouldn't
show that one, so I'll leave this message here.

The current upstream maintainers offer binary blobs of VeraCrypt for
installation on Linux, also Debian.

With the binary builds, I see the issue that no exact sources of the
builds are available. The builds probably have been derived from the
upstream Git or source release tarballs, but who knows.

Ouch! I would stay far, far away from such software.

[stevepusser]

It looks like zuluCrypt might be a good solution here, but installing a .deb from the web isn't the same as adding a source to the repos. You can download it as check the dependencies with

Code: Select all

dpkg -I file.deb

beforehand.

Jeesh, this is 2024. Use apt.

[Enigma83]

It looks like zuluCrypt might be a good solution here, but installing a .deb from the web isn't the same as adding a source to the repos. You can download it as check the dependencies with

Code: Select all

dpkg -I file.deb

beforehand.

Jeesh, this is 2024. Use apt.

I don't see any harm in using dpkg, not if I'm just checking dependencies. That command wouldnt install it, anyway.

[sunrat]

It looks like zuluCrypt might be a good solution here, but installing a .deb from the web isn't the same as adding a source to the repos. You can download it as check the dependencies with

Code: Select all

dpkg -I file.deb

beforehand.

Jeesh, this is 2024. Use apt.

100%. apt will resolve dependencies, dpkg won't.

Open terminal in directory of downloaded .deb then

Code: Select all

apt install ./file.deb

Remember the "./" it points apt to the local file rather than try to install from repo.

[bbbhltz]

It looks like zuluCrypt might be a good solution here, but installing a .deb from the web isn't the same as adding a source to the repos. You can download it as check the dependencies with

Code: Select all

dpkg -I file.deb

beforehand.

Jeesh, this is 2024. Use apt.

What's the apt command to check dependencies without installing?

[peer]

apt show file.deb

[sunrat]

What's the apt command to check dependencies without installing?

Code: Select all

apt depends <packagename>