Can somebody clarifies how qubes-update-check service works and how dom0 gets update notifications for TemplateVMs that are never powered on?

[enmus]

@adw

I am confused

I will explain again. That was in my draft, and you were too quick for me. The draft was created during your doc PR, which is obvious since in my last post I already referred to it

@enmus

For more details please see https ://www.qubes-os.org/doc/how-to-update/

@adw

If KeePassXC itself were compromised (e.g., package or source code), then it wouldn’t matter whether it’s up-to-date or not.

I strongly disagree. Theoretically, it could be compromised in a way to silently trigger setting netVM for vault and sending clipboard (at best, or whatever) to a specified IP address. That theoretical bug could be fixed in the new version, but update wouldn’t be possible. I’m sure there are better examples and more realistic than this one. But, whatever. I have my routine of regularly updating all qubes and it’s not about me, but of users unaware of the issue.

@adw

I don’t understand the suggestion, and this is too vague to be actionable for me. If something is unclear in the docs, please provide, at minimum:

1. An exact quotation of the unclear passage currently in the docs

Glossary

If a qube does not have a net qube (i.e., its netvm is set to None ), then that qube is offline. It is disconnected from all networking.

This is simply not true and dangerous. It should be:

If a qube does not have a net qube (i.e., its netvm is set to None ), or updating over qrexec is disabled (which is it’s default state for non-template qubes) then that qube is offline. It is disconnected from all networking. For this reason Templates should not be considered as offline qubes, Please check for more on How to update non-template qubes over qrexec while using apt-cahcer-ng as netVM & everything in policies talk about cacher - #11 by unman

That is one place that I spotted wrong statements. I’m not sure if there are other as well.

@adw

he best way is to either open a doc PR or open an issue.

Thanks. Will gladly do once move away from Github to some opensource non-profit platform, not owned by majors. I just don’t have an account there.

@deeplow

I tried finding related stuff. But the search mechanism of Github is not super helpful.

Absolutely agree. Please let me know how did you find multifile-policy.markdown term via Github search. I had hard times to find it.