Warning: Updating with direct commands such as dnf update and apt update is not recommended, since these bypass built-in Qubes OS update security measures. Instead, we strongly recommend using the Qubes Update tool or its command-line equivalents, as described below. (By contrast, installing packages using direct package manager commands is fine.)
Do the updates in Qubes Update also update the installed packages from both default repos & external repos(3rd party software that you’ve installed) for each template?
If Qubes Update does update all the packages, were the keys checked beforehand? If they were, then is it only necessary to verify signatures/GPG keys during the initial package installation?
Can someone provide clarity to see if I’m misunderstanding what I as a user need to do to make sure that update files aren’t being tampered with?
If Qubes Update doesn’t update all the packages within each template, what’s the process for verifying signing keys when I go in to update every package in each template manually? My current understanding is that you need a master key from the developer themselves and then a signing key for each version release, but you only need to verify the master key by comparing with multiple sources(web of trust) so it can be used to verify the version release signing key. If this is the case, it seems kind of impractical to constantly check for updates and manually verify GPG keys, but that might be the price for peace of mind.
Can someone provide clarity to see if I’m misunderstanding the verification process to make sure that install & update files aren’t being tampered with?
I’m still confused if “[Dom0] Qubes OS Update” only applies to the distros & operating systems of the templates or if it also includes the packages within those templates.
If it does include the packages does it only update the ones from the default repos? Or does it also include updates for packages from external repos(software that you’ve gone out of your way to install)?
If you have well-formed .list or .sources files in /etc/apt/sources.list.d/, then Qubes update should update all of the packages in your Debian templates, including third party repos. I imagine Fedora is similar, but haven’t done that myself.
All you have to do is use the Qubes Update tool (or its command line equivalents). Qubes OS handles all the update authentication for you. The relevant PGP keys are already included in dom0 and each template.
You are confusing two different things:
Authenticating a Qubes ISO before doing a clean install of Qubes OS (strongly recommended)
Authenticating individual packages when installing/updating packages using a package manager like DNF, APT, etc. after installing Qubes OS (no manual action required; Qubes OS already handles this for you)
The above applies to the official templates and the default repos. If you add a custom repo, then of course you should first authenticate the PGP key properly and add it to the template so that package installations/updates using that repo will be properly authenticated. If you use an unofficial template, such as a community template, then you’re trusting the maintainer of that template and should ask them if you need to do anything special.
I assume that “[Dom0] Qubes OS Update” refers to the Qubes Update tool. If so, then this tool only updates packages that are already installed (in both dom0 and templates). It does not install new templates. There’s a separate tool for that (Qubes Template Manager).
It will update using all enabled repos in the template.
Just for confirmation, so you’re saying that the only thing a user has to do to ensure tamper-proof downloads is to verify the developer’s PGP signing key’s fingerprint with multiple sources(web of trust) because the package manager will automatically verify downloaded files with this key after an external or custom repository is added to it?
mullvad is available with extrepo, which is the preferred way to add third party repos in Debian. One reason I prefer Debian to Fedora for such applications…
yes, both browser and vpn are in Mullvad’s debian repo and available to apt after enabling mullvad with extrepo. If you search mullvad with extrepo it will display the options.
I don’t think anyone has nudged them to update their instructions. They didn’t even announce that they had implemented the extrepo option, I just stumbled upon it.
Note that this is no longer a Qubes-specific question; it’s just a question about using package managers like APT and DNF inside OSes like Debian and Fedora. Therefore, you can probably get a better or more authoritative answer by asking in the appropriate upstream venue.
Having said that, that sounds basically correct, except I would also make sure that the authenticated PGP key is specified in the repo definition file, along with any appropriate PGP check options.