[SALTSTACK] - Install SIFT Workstation

[cobbst]

I'm trying to install SIFT Workstation. When running the following command sudo cast install teamdfir/sift - it throws and error of 404 Not found.

Any suggestion, on a work around to be able to install Sift Workstation on Ubuntu 20.4 would be great.

[digitalsleuth]

Hi @cobbst , we are actively working on a fix for this. The issue resolves around the installation of Saltstack, which has recently shifted it's infrastructure to a new platform. We will let you know once this is addressed.

[cobbst]

Hi @cobbst , we are actively working on a fix for this. The issue resolves around the installation of Saltstack, which has recently shifted it's infrastructure to a new platform. We will let you know once this is addressed.

Thanks for the update!

[ekristen]

@cobbst -- please try this version, should resolve the issue, but if not please let me know. I'm doing further testing as we speak - https://github.com/ekristen/cast/releases/tag/v0.14.52

[cobbst]

@cobbst -- please try this version, should resolve the issue, but if not please let me know. I'm doing further testing as we speak - https://github.com/ekristen/cast/releases/tag/v0.14.52

@ekristen -- I will give this a try later today when I get home. Fingers crossed as I can't wait to get Sift install to start learning :-)

[cobbst]

@cobbst -- please try this version, should resolve the issue, but if not please let me know. I'm doing further testing as we speak - https://github.com/ekristen/cast/releases/tag/v0.14.52

@ekristen -- Hi, So Ran the command again and got further, but now a new error open /etc/apt/keyrings/salt-archive-keyring-2023.pgp: no such file or directory

[cobbst]

@cobbst -- please try this version, should resolve the issue, but if not please let me know. I'm doing further testing as we speak - https://github.com/ekristen/cast/releases/tag/v0.14.52

@ekristen -- I will give this a try later today when I get home. Fingers crossed as I can't wait to get Sift install to start learning :-)

@ekristen - Hi, I'm good to go. I didn't know i had to create the directory first. Once i created the directory and reran the command Sift installed. Thanks for your assistance with this.

[ekristen]

You didn't run into any errors?

[magustin-telus]

@ekristen I had to create the dir that @cobbst had to create with v0.14.53 of cast. I am also getting this error with ubuntu 20.04

level=warning msg=\"first failed state\" comment=\"One or more requisite failed: sift.python-packages.volatility.sift-python-volatility-community-plugins\" component=installer run_num=286 sls=sift.python-packages.volatility", "time=\"2024-11-02T06:15:39Z\" level=info msg=statistics component=installer failed=44 success=531 total=575",.

is there a way to specify the tag for a specific version of sift when using cast?

[ekristen]

Try running again I just published an update.

Yes you can specify version with cast, if you run again it'll pick up the latest which should work, at least in testing is does, still running some larger tests.

[ekristen]

Also please not that nothing gets rolled back in failure so it's a partial install regardless and in this case 90% installed.

[magustin-telus]

@ekristen , I am now receiving this error:

Command errored out with exit status 1: python setup.py egg_info Check the logs for full command output. ERROR: Cannot install python-registry==1.3.0 and python-registry==1.3.1 because these package versions have conflicting dependencies.

[ekristen]

Interesting, looking into it

[magustin-telus]

thanks!
Just to add context, I am doing an install every time with a freshly provisioned compute image

[cobbst]

I didn't. SIFT installed successfully. Another question, will there be work for the same process for adding REMnux to SIFT Workstation.

…

On Fri, Nov 1, 2024 at 7:53 PM Erik Kristensen ***@***.***> wrote: You didn't run into any errors? — Reply to this email directly, view it on GitHub <#639 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/ADU6HQ43APDHDHJ3EZOX5ALZ6QH6LAVCNFSM6AAAAABRAF2KVCVHI2DSMVQWIX3LMV43OSLTON2WKQ3PNVWWK3TUHMZDINJSG4ZTCMJYGE> . You are receiving this because you were mentioned.Message ID: ***@***.***>

[digitalsleuth]

Hi @cobbst , adding REMnux to SIFT works with the same process as with installing SIFT. You can use cast to install REMnux alongside SIFT.

[ekristen]

closing this in favor of #641