Kali template for 4.0 updated

[unman]

My initial reply got lost in transition.

Hi,

I would have some questions on the template page: https://qubes.3isec.org/Templates .

As qubes-template-kali-4.0.6-202106091045.noarch.rpm is a Qubes template, I guess it should be installed with a command line in dom0? If so:

1. What is this command?

in dom0 sudo dnf install qubes-template-kali-4.0.6-202106091045.noarch.rpm

2. How can we install a package in dom0 from a file that has been download from a VM? (since dom0 has no internet access)

You can copy the file in to dom0: this is covered in the docs

Templates like Parrot or Kali are based on Debian testing. To avoid breakage when updating the core Qubes packages are on hold.

3. Why templates based on Debian Testing can lead to breakage when updating the core Qubes packages? (or what is the difference with templates not based on Debian Testing?)

Debian testing is, as the name suggests, a testing distribution.
Packages change, and are updated rapidly. If the Qubes packages have
certain dependencies, then the updated packages in Debian or Kali may
break the Qubes packages, and the Qubes packages may be removed. (This
is the source of much confusion and pain for people who don’t check to
see what the package manager will be doing.)

This doesn’t happen in standard versions of Debian, because the package
transitions there are much slower, and the Qubes packages tested against
them.
The same situation can arise in any rolling distribution like Arch.

‘apt-mark unhold’ will remove the hold and allow you to update the Qubes packages.

4. I’m confused. I don’t understand why there would be not breakage here. Why, in this case, updating the core Qubes package would not cause breakage?

Does this make it clearer?
To avoid breakage when updating, the core Qubes packages are on hold.

5. Does this mean there is a way to:

   • update all the packages that are not core Qubes packages when the hold is activated and
   • update only the core Qubes packages when the hold is disactivated?

   If so, what are those 2 commands? (to be typed in the Kali template, I assume)

The process is a little complicated.
When the hold is activated, you just run apt update and apt upgrade
as usual. The hold will prevent the Qubes packages from being removed,
so some of the Debian or Kali packages will be held back.

You can update a single package by using apt install <package>. Or you
can use a package manager like aptitude, which will allow you to
select the packages to be updated.

6. What is the exact command to activate the hold? apt-mark hold core-qubes-package or something of the kind? (also to be typed in the Kali template, I assume)

Exactly so.

Many thanks in advance for your answers!

That’s fine: I hope this is readable.

You could have found the answers to some of this on the Qubes
documentation.
For many commands, man <command> will provide useful information. In
this case man apt-mark will explain about the use of hold and unhold,
as well as other marks you can set.