Sift workstation in the new macbook architecture

[H1nt3r]

Hi team,

The sift workstation is not anymore working in the new macbook pro Arm architecture, the following error appears and shows that it is not compatible. (using latest version of vmware)

"This virtual machine cannot be powered on because it requires the X86 machine architecture, which is incompatible with this Arm machine architecture host." See KB-84273."

any new version to be released for the sift workstation ?

thank you for your help.

[salty4n6]

I saw in another update that you can install the state files manually with about 60% success rate so would it be possible to tweak the install script to work on ARM and just fail on those that don't support ARM?

60% on ARM is better than 0% on ARM.

~Salty

[ekristen]

That's how saltstack works by default, those that fail fail, those that succeed succeed, things do not roll back.

[salty4n6]

Last time I tried the install on ARM the install didn't even start which is why I asked. I'll try again and make note of the error if it comes up.

~Salty

[salty4n6]

This is what I received last time:

sift@workstation:~/Downloads$ sudo cast install teamdfir/sift-saltstack
WARN[0000] using unauthenticated github client, could result in API rate limiting
INFO[0001] checking operating system support component=distro owner=teamdfir repo=sift-saltstack
INFO[0001] operating system is supported component=distro owner=teamdfir repo=sift-saltstack
INFO[0001] rendering manifest component=distro owner=teamdfir repo=sift-saltstack
INFO[0001] distro validated successfully command=install
INFO[0001] downloading archive file component=distro owner=teamdfir repo=sift-saltstack version=v2024.11.14
INFO[0006] downloading release file component=distro filename=checksums.txt owner=teamdfir repo=sift-saltstack
INFO[0006] downloading release file component=distro filename=checksums.txt.sig owner=teamdfir repo=sift-saltstack
INFO[0007] downloading release file component=distro filename=cosign.pub owner=teamdfir repo=sift-saltstack
INFO[0007] downloading release file component=distro filename=manifest.yml owner=teamdfir repo=sift-saltstack
INFO[0007] signatures verified component=cosign
INFO[0007] validating checksums component=distro handler=validateChecksums owner=teamdfir repo=sift-saltstack
INFO[0007] checksum validated component=distro filename=manifest.yml owner=teamdfir repo=sift-saltstack
INFO[0007] checksum validated component=distro filename=teamdfir-sift-saltstack-v2024.11.14-0-gfd3d781.tar.gz owner=teamdfir repo=sift-saltstack
INFO[0007] extracting archive file component=distro owner=teamdfir repo=sift-saltstack version=v2024.11.14
INFO[0007] distro downloaded successfully command=install
INFO[0007] installing using mode: default command=install
INFO[0007] checking if install can progress component=installer
INFO[0007] preparing pillar data component=installer
INFO[0007] running saltstack installer component=installer
INFO[0007] downloading saltstack package key component=saltstack-installer handler=install-package-key
INFO[0008] saltstack package key downloaded component=saltstack-installer handler=install-package-key
INFO[0008] updating apt component=saltstack-installer
ERRO[0008] process exited 100 command=apt-get component=saltstack-installer
ERRO[0008] unable to run apt-get update component=saltstack-installer error="process exited 100"
FATA[0008] process exited 100

Not sure what issue is yet, just started looking at the logs.

~Salty

[salty4n6]

Also, for some of the applications that haven't been compiled for ARM yet, if there is a x86_64 docker image, we could run the x86_64 docker image on ARM, using --platform linux/amd64. I've used this for a couple of applications that aren't compiled for ARM and they work with a minimal speed penalty.

~Salty

[digitalsleuth]

Hi @salty4n6 , I happen to have a SIFT Docker (updating it now) which you could try using in the meantime. Since it's currently updating, I won't be able to push it yet, but you'll be able to find it here. If you're interested, I also have a sift-remnux docker with both distro's installed. I should update that anyways and will do that tonight as well.

I'll let you know when they're done if you'd like to give them a shot in the meantime.

[digitalsleuth]

Hello again @salty4n6 , I just updated both the Focal and Jammy dockers for SIFT, and updated the repo with a current docker-compose file. Hope this helps!

[salty4n6]

@digitalsleuth - Sweet. Much appreciated! I'll give them a shot today.