Title:
Fedora 43 TemplateVM cannot access the ProtonVPN repository through Qubes UpdatesProxy — Curl error 56
Post:
I am trying to install Proton VPN in a Fedora TemplateVM while following the Qubes OS security model and keeping the TemplateVM disconnected from a normal NetVM.
System information
-
Qubes OS version: Qubes OS 4.3.1 (R4.3)
-
TemplateVM:
fedora-43-xfce -
TemplateVM NetVM:
none -
UpdateVM: sys-firewall
-
Third-party repository: ProtonVPN Fedora Stable repository
What I did
Because the Fedora TemplateVM has no normal network connection, I first downloaded the Proton repository configuration package inside a networked App Qube:
protonvpn-stable-release-1.0.4-1.noarch.rpm
I then copied the RPM file into the fedora-43-xfce TemplateVM using qvm-copy.
Installing the repository configuration package inside the TemplateVM succeeded:
sudo dnf install -y /path/to/protonvpn-release.rpm
The result was:
Installing protonvpn-stable-release-0:1.0.4-1.noarch
Complete!
I then tried to install Proton VPN through Qubes UpdatesProxy:
sudo dnf install -y proton-vpn-gnome-desktop
However, access to the Proton repository failed:
Updating and loading repositories:
ProtonVPN Fedora Stable repository
Curl error (56): Failure when receiving data from the peer
Usable URL not found
Repositories loaded.
Failed to resolve the transaction:
No match for argument: proton-vpn-gnome-desktop
I also tried refreshing the repository metadata:
sudo dnf clean all
sudo dnf makecache --refresh
The Proton repository still failed with Curl error (56).
Additional information
A networked App Qube can access repo.protonvpn.com and can download the Proton repository RPM successfully.
Direct wget access from the TemplateVM fails because its NetVM is set to none. I understand that this is expected behavior under the Qubes security model, so I did not assign a normal NetVM to the TemplateVM.
I would like to keep the TemplateVM offline and continue installing software through Qubes UpdatesProxy.
The same general problem also appeared when I tried the Proton Debian repository from a Debian 13 TemplateVM. Debian and Qubes repositories worked through 127.0.0.1:8082, but the Proton repository remained stuck or failed.
Questions
-
Does Qubes UpdatesProxy support this type of third-party HTTPS repository?
-
Could
Curl error (56): Failure when receiving data from the peerbe caused by UpdatesProxy, the UpdateVM, or compatibility between the proxy and the Proton repository? -
Which commands or logs should I check to diagnose the connection between UpdatesProxy and the Proton repository?
-
What is the recommended Qubes-compatible method for installing software from this type of third-party repository while keeping the TemplateVM without a normal NetVM?
-
Should I instead download Proton VPN and all of its RPM or DEB dependencies inside a networked App Qube and then copy them into the TemplateVM for offline installation?
I did not give the TemplateVM direct network access because Qubes Manager warns that this is highly discouraged and conflicts with the intended TemplateVM isolation model.