ARM64 Support (i.e. Apple Silicon, and others)

[ekristen]

• SIFT CLI replaced with cast
• Figure out what packages do not support arm64

[knapjack]

Just tried on a fresh install (jammy on multipass on M1), currently at a 0% stage:

$ uname -a ; sudo cast install teamdfir/sift-saltstack
Linux pure-kingfisher 5.15.0-71-generic #78-Ubuntu SMP Tue Apr 18 09:00:08 UTC 2023 aarch64 aarch64 aarch64 GNU/Linux
WARN[0000] using unauthenticated github client, could result in API rate limiting 
INFO[0001] checking operating system support             component=distro owner=teamdfir repo=sift-saltstack
INFO[0001] operating system is supported                 component=distro owner=teamdfir repo=sift-saltstack
INFO[0001] rendering manifest                            component=distro owner=teamdfir repo=sift-saltstack
INFO[0001] distro validated successfully                 command=install
INFO[0001] downloading archive file                      component=distro owner=teamdfir repo=sift-saltstack version=v2023.02.06
INFO[0002] downloading release file                      component=distro filename=checksums.txt owner=teamdfir repo=sift-saltstack
INFO[0003] downloading release file                      component=distro filename=checksums.txt.sig owner=teamdfir repo=sift-saltstack
INFO[0003] downloading release file                      component=distro filename=cosign.pub owner=teamdfir repo=sift-saltstack
INFO[0004] downloading release file                      component=distro filename=manifest.yml owner=teamdfir repo=sift-saltstack
INFO[0004] downloading release file                      component=distro filename=pgp.pub owner=teamdfir repo=sift-saltstack
INFO[0005] downloading release file                      component=distro filename=sift-saltstack-2023.02.06.tar.gz.asc owner=teamdfir repo=sift-saltstack
INFO[0005] downloading release file                      component=distro filename=sift-saltstack-2023.02.06.tar.gz.sha256 owner=teamdfir repo=sift-saltstack
INFO[0006] downloading release file                      component=distro filename=sift-saltstack-2023.02.06.tar.gz.sha256.asc owner=teamdfir repo=sift-saltstack
INFO[0006] signatures verified                           component=cosign
INFO[0006] validating checksums                          component=distro handler=validateChecksums owner=teamdfir repo=sift-saltstack
INFO[0006] checksum validated                            component=distro filename=teamdfir-sift-saltstack-v2023.02.06-0-gfddbdc4.tar.gz owner=teamdfir repo=sift-saltstack
INFO[0006] checksum validated                            component=distro filename=manifest.yml owner=teamdfir repo=sift-saltstack
INFO[0006] extracting archive file                       component=distro owner=teamdfir repo=sift-saltstack version=v2023.02.06
INFO[0006] distro downloaded successfully                command=install
INFO[0006] installing using mode: default                command=install
INFO[0006] checking if install can progress              component=installer
INFO[0006] preparing pillar data                         component=installer
INFO[0006] running saltstack installer                   component=installer
INFO[0006] downloading tar.gz file                       component=saltstack-installer handler=install-binary
FATA[0007] received error code 404 attempting to download

[jatiki]

This above issue is still unresolved. Is there any way that I could help fixing it?

$ uname -a Linux ubuntu-linux-20-04-desktop 5.15.0-84-generic #93~20.04.1-Ubuntu SMP Thu Sep 7 03:20:32 UTC 2023 aarch64 aarch64 aarch64 GNU/Linux $ sudo cast install teamdfir/sift-saltstack WARN[0000] using unauthenticated github client, could result in API rate limiting INFO[0001] checking operating system support component=distro owner=teamdfir repo=sift-saltstack INFO[0001] operating system is supported component=distro owner=teamdfir repo=sift-saltstack INFO[0001] rendering manifest component=distro owner=teamdfir repo=sift-saltstack INFO[0001] distro validated successfully command=install INFO[0001] downloading archive file component=distro owner=teamdfir repo=sift-saltstack version=v2023.02.06 INFO[0003] downloading release file component=distro filename=checksums.txt owner=teamdfir repo=sift-saltstack INFO[0003] downloading release file component=distro filename=checksums.txt.sig owner=teamdfir repo=sift-saltstack INFO[0004] downloading release file component=distro filename=cosign.pub owner=teamdfir repo=sift-saltstack INFO[0004] downloading release file component=distro filename=manifest.yml owner=teamdfir repo=sift-saltstack INFO[0004] downloading release file component=distro filename=pgp.pub owner=teamdfir repo=sift-saltstack INFO[0005] downloading release file component=distro filename=sift-saltstack-2023.02.06.tar.gz.asc owner=teamdfir repo=sift-saltstack INFO[0005] downloading release file component=distro filename=sift-saltstack-2023.02.06.tar.gz.sha256 owner=teamdfir repo=sift-saltstack INFO[0005] downloading release file component=distro filename=sift-saltstack-2023.02.06.tar.gz.sha256.asc owner=teamdfir repo=sift-saltstack INFO[0006] signatures verified component=cosign INFO[0006] validating checksums component=distro handler=validateChecksums owner=teamdfir repo=sift-saltstack INFO[0006] checksum validated component=distro filename=teamdfir-sift-saltstack-v2023.02.06-0-gfddbdc4.tar.gz owner=teamdfir repo=sift-saltstack INFO[0006] checksum validated component=distro filename=manifest.yml owner=teamdfir repo=sift-saltstack INFO[0006] extracting archive file component=distro owner=teamdfir repo=sift-saltstack version=v2023.02.06 INFO[0006] distro downloaded successfully command=install INFO[0006] installing using mode: default command=install INFO[0006] checking if install can progress component=installer INFO[0006] preparing pillar data component=installer INFO[0006] running saltstack installer component=installer INFO[0006] downloading tar.gz file component=saltstack-installer handler=install-binary FATA[0007] received error code 404 attempting to download

[ekristen]

ARM support is tricky. We'd like to support it but there are a lot of tools that simply won't work. This set of aerrors is mainly around getting saltstack to install properly. I have an open issue to improve the saltstack install process but haven't had a chance to address it. Even with fixing this issue, ARM support is a long way off, last time I tested, it was about a 50% success rate of installs.

[cyberxson]

Hi @ekristen, any chances of installing SIFT using cast on a Silicone Mac?

I was trying to install SIFT using cast but encountering the error message: FATA[0016] received error code 404 attempting to download.

Looking forward to run SIFT on a Silicone Mac

[madsumm]

With recent removal of Intel based macs, I looking forward for SIFT to be implemented for use in Apple Silicon. Any updates on this please.

[any333]

Hi @ekristen, I was trying to install SIFT on Ubuntu 22.04 (running in a WMware Fusion VM) but I am still facing the same problem like everybody else in the thread.
Has someone made any progress on the issue and do you think that it is going to be fixed any soon?

[ekristen]

Hey everyone. Last time I attempted this, only about 50% of the packages worked. I'll give it another shot and see where things stand.

[ekristen]

Alright, so there's a few blockers. I need to adjust the tooling to support ARM better, the way I'm doing saltstack now needs to change. I'll try and get this tested over the weekend and provide a status update of where we stand in terms of what tools do or do not work.

Right off the rip, nothing based on GIFT will work, they've not compiled anything for ARM as far as I know, I could be wrong, so that means libfvde, libshadow, etc ...

Bulk-extractor isn't compiled for ARM, last time I tried it broke.

[any333]

Thank you very much for your efforts, @ekristen!