Can somebody clarifies how qubes-update-check service works and how dom0 gets update notifications for TemplateVMs that are never powered on?

[adw]

@enmus

• Templates that aren’t ran and don’t have qubes based on them
• Templates that aren’t ran, and have qubes based on them, but they’re not online*,

will never be updated, unless manually.

(this the point, it’s not about the workflow dom0 gets notification, update launcher shows up, etc, etc…)

And I’m not aware that this is documented anywhere, and I could bet most of the users are unaware of the fact, which could be considered as a security risk per se.

Why is it a security risk? If the template is never run and there are no qubes based on it, then the fact that it is never updated causes no harm. It doesn’t need to be updated, because it is never used.

“Ah,” you might say, “But what if I want to start using it someday? Then it’ll be terribly out-of-date!”

True, but the same can be said of a fresh template that you install in dom0 from the official repo. For example, if you install the Debian 10 template from the official repo in dom0 right now, you’ll have a template that hasn’t been updated in over two years! You will then simply update it yourself before you start using it, which the documentation already says to do. (From what I understand after asking the devs, this is not a problem so long as there have not been any bugs discovered in the template OS’s update mechanism since then.)