TL;DR
Why can’t I update using the CLI commands, but the GUI updater succeeds, when both are equivalent according to the documentation?
setup
$ cat /etc/qubes-release
Qubes release 4.2.2 (R4.2)
I have several VMs that make use of flatpaks and other non-default installation methods.
To keep up with updates I have written a simple bash script for dom0 that updates my system by issuing the CLI commands for updating templates and standalones as recommended here (update.qubes-dom0 / update.qubes-vm) as well as running qvm-run for updating flatpaks etc.
This script has worked very well for several months (if not years), I did not change it lately.
This is all to say that I cannot simply use the GUI updating method because I am doing some non-standard updating as well.
Here’s the output of the relevant commands from dom0:
$ qubes-prefs --get management_dispvm
default-mgmt-dvm
$ qvm-prefs --get default-mgmt-dvm template
debian-12-xfce
I have no custom management DVMs beside the default, eg. qvm-prefs --get ANY_VM management_dispvm always prints default-mgmt-dvm.
the issue
When updating a fedora template using update.qubes-vm I get this error:
[...]
import backports.ssl_match_hostname
ModuleNotFoundError: No module named 'backports'
For troubleshooting this I changed default-mgmt-dvm’s template to fedora-40-minimal, fedora-40-xfce and fedoa-40, respectively using this command:
qvm-prefs --set default-mgmt-dvm template TEMPLATE
Of course I had ensured that the correct packages ( qubes-core-agent-passwordless-root, qubes-mgmt-salt-vm-connector) were installed, according to this.
With each template change updates were possible using CLI initially, but when retrying (to make sure it actually worked) I got the following error on every VM:
MY_TEMPLATE:
- No matching sls found for 'update.qubes-vm' in env 'base'
/usr/lib/python3.12/site-packages/salt/utils/jid.py:19: DeprecationWarning: datetime.datetime.utcnow() is deprecated and scheduled for removal in a future version. Use timezone-aware objects to represent datetimes in UTC: datetime.datetime.now(datetime.UTC).
return datetime.datetime.utcnow()
While the warning about datetime.datetime.utcnow() is not a deal breaker I did not get any updates due to the second line (No matching sls found...).
Switching the template back and forth did not make updates possible again.
After looking around on the internet I was not able to find any QubesOS related error report of this which felt very strange.
even more confusion: GUI updater
In order to update my system at least partially I then tried to use the GUI updater tool.
To my surprise this worked, regardless of which template I chose for default-mgmt-dvm.
Also, in the Qubes Manager I did not see any disposable VMs based on default-mgmt-dvm being created when using the GUI whereas using the CLI did cause the creation of such VMs.
Baffled I re-read the documentation on how to update: “Applying these two Salt states is the same as updating via the Qubes Update tool.”
How can this be true when the GUI method creates no disposable VMs and succeeds and the CLI method does create disposable VMs and fails?
Did I miss some big changes in the update architecture?
Is the documentation on how to update outdated?
How can I update templates and standalones programmatically?