Can somebody clarifies how qubes-update-check service works and how dom0 gets update notifications for TemplateVMs that are never powered on?

[adw]

@enmus

I strongly disagree. Theoretically, it could be compromised in a way to silently trigger setting netVM for vault and sending clipboard (at best, or whatever) to a specified IP address. That theoretical bug could be fixed in the new version, but update wouldn’t be possible.

If an update fixes whatever was compromised, then KeePassXC itself is no longer compromised, in which case my conditional statement is still true.

@enmus

If a qube does not have a net qube (i.e., its netvm is set to None ), then that qube is offline. It is disconnected from all networking.

This is simply not true and dangerous. It should be:

If a qube does not have a net qube (i.e., its netvm is set to None ), or updating over qrexec is disabled (which is it’s default state for non-template qubes) then that qube is offline. It is disconnected from all networking. For this reason Templates should not be considered as offline qubes, Please check for more on How to update non-template qubes over qrexec while using apt-cahcer-ng as netVM & everything in policies talk about cacher - #11 by unman

Thank you for the clear and specific example. I think we should actually just remove that sentence, as it’s now outdated and is not essential to the definition of the term “net qube” anyway:

Remove outdated statement

I think the important part here is for users to understand that templates still have network access even though their netvms are set to None (or n/a). Thankfully, this is already documented, specifically here and here. I have also just added pointers to these sections from the “How to update” and “Templates” doc pages in order to make it easier for users to find this information:

Add links to template network access and updates proxy sections

@enmus

Absolutely agree. Please let me know how did you find multifile-policy.markdown term via Github search. I had hard times to find it.

You can search for any term in quotation marks to find exact hits:

https://github.com/QubesOS/qubes-issues/issues?q="multifile-policy.markdown"