I tried both methods listed in this guide. https://qubes.3isec.org/Templates_4.1_README.html Unfortunately, none of them worked. I copied the RPM files to dom0. When I try to verify the templates I always get a negative output. I used the unman key 4B1F … C2EF, and downloaded the files several times from the official repo.
rpm -K template_name.rpm
template_name.rpm: checksum SIGANTURE NOT OK
The second method is similar.
sudo nano /etc/qubes/repo-templates/3isec-templates.repo
qvm-template list
[Qrexec] ERROR: Failed to download metadata for repo ‘3isec-templates’: cannot download repomd.xml: cannot download repodata/repomd.XML: All mirrors were tried ERROR qrexec call ‘qubes.TemplateSearch’ failed.
You have added sudo to the qvm-run command.
This wont work because sudo will not operate through redirection(>)
My guess is that you are trying to copy the template to somewhere owned
by root. The sudo command runs the qvm-run but the output write is
performed by user.
There are ways around this: sudo su - to get a proper root shell
Or qvm-run -p QUBE 'cat path_to_template' | sudo tee template name > /dev/null
I would just copy the template to somewhere owned by user.
I cant replicate your error in setting up the repository.
What version of Qubes are you testing on?
I never presume to speak for the Qubes team.
When I comment in the Forum I speak for myself.
Hi there,
I don’t know if it’s related to the signature key of the package.
If I do rpm --checksig 3isec-qubes-task-manager
I get digest signatures OK from an internet connected Qube,
but if I do the same from dom0, with same key and package, I get a KO, because:
“The subkey is not live”
while in the other case it know the extended expire: 2026-06-30
What do You think?
Cheers.
Works for me in dom0.
I would check the validity of the key that you are using in dom0: what
is the output of: gpg -n --import --import-options import-show /etc/pki/rpm-gpg/RPM-GPG-KEY-unman
I never presume to speak for the Qubes team.
When I comment in the Forum I speak for myself.
Hi there.
It’s as expected, with the delayed expire date, but update of packages from 3isec doesn’t work…
so I tested rpm --checksig and found the previous message.
thanks a lot. rpm_fail.log (412 Bytes)
It looks as if you have an old key in the rpm keyring.
I would rpmkeys --list to identify the key, and then delete it with rpmkeys --delete KEY. Then, after checking again the key you have ,
install it in the rpm keyring: rpmkeys --import PATH_TO_NEW_KEY
Hi there.
It’s strange: I’ve yet did it twice before…
But now it’s working…
Thanks.
At least… I’ve another problem now, because it says previous rpm is missing from rpm db, but previous problem is solved!
