KickSecure Minimal Templates update problem in AppVM

User Support General
1

Hello, I am facing the problem of updating appvm after installing in my minimal improvement template from kicksecure.
I need apt update and apt install command in appvm to solve the qubes-snapd-helper problem.

0% [Connecting to SOCKS5h proxy (socks5h://127.0.0.1:9050)] [Connecting to SOCKS5h proxy (socks5h://127.0.0.1:9050)] [Connecting to SOCKS5h proxy (socks5h://127.0.0.1:9050)

I get this message and then nothing happens, the package qubes-core-agent-network is installed in the minimum template.
Also updates in the template are fine. I don’t understand what could be the problem.

If it’s important, I’ve replaced standard repositories with onion, I’ve tried changing them to normal and doing updates in appvm but it still doesn’t work.
But, I noticed that using a normal minimal template without kicksecure the updates in appvm are fine.

Thanks for the help. :slight_smile:

Regards Gosto Colletti.

2

Maybe you’ve enabled apt tor transport for your repositories (tor+ before repo link).
Just a guess.

3

Yes, my repositories look something like this:
tor+http://deb.w5j6stm77zs6652pgsij4awcjeel3eco7kvipheu6mtr623eyyehj4yd.onion bullseye main contrib non-free
I have Apt-transport-tor installed.
But it worked fine for me on a normal debian-11 template
My updates go through sys-whonix and as a netvm for my appvm which doesn’t update, I use sys-whonix too

4

When you changed the repos from onion back to normal did you remove tor+ or not?

5

Yes, I deleted it.

6

Got it, then it shouldn’t be related to apt tor transport and likely to be Qubes-related.

7

Not sure what KickSecure do but maybe it can configure your system to torify all your updates regardless of apt sources.list config and fail to do it because of some missing packages.

8

Sorry to ask for confirmation, but are you running apt update in your AppVM based on the template or in the TemplateVM?

Also, did you install apt-transport-https ?

9

I run an apt update in my appvm based on a minimal debian 11 template with kicksecure enhancements installed in it
the apt update in my deb-11-min-kicksecure template works fine
I only have problems with appvm but I noticed it’s more of a problem related to apt update, upgrade, install because wget was able to connect to the internet
Yes, I have apt-transport-https installed

10

Yes, the problem is probably caused by Kicksecure, but only together with a minimal template
I noticed that the regular minimal template works fine and the updates in appvm also work
I also tried installing kicksecure in a regular non minimal debian template, and there the updates in appvm worked just as well
Only the minimal template with kicksecure installed has problems

apt update, install in appvm i need to fix the problem with qubes-snapd-helper since all my snaps are not saved after rebooting appvm, so i have to install snapd and qubes-snapd-helper in the template and then reinstall them in appvm to save my snaps after the reboot

11

You shouldn’t be updating packages in AppVMs, or at least there’s not much point in doing it, since the updates won’t persist once you shut down the qube.

You should update TemplateVMs and Standalones only.

Useful reads:
\ How to update | Qubes OS
\ Glossary | Qubes OS (template)
\ Glossary | Qubes OS (standalone)
\ Glossary | Qubes OS (app-qube)

12

For snap packages, check this out:

1 Like
13

I understand that there is no point in updating appvm, but it helped me to solve my snap problem.

Oh thank you, that really helped me.
Thank you very much :blush:

I’ll try to think about this problem some more, I might encounter difficulties in the future when I need to update appvm for something

Thank you very much