New QubesOS install pop up- [sys-whonix] systemcheck (lack of clarity)

Not my first go with qubes, but testing re-install on other device to consolidate knowledge.

Installed fine, no problems. Install preferences irrelevant unless otherwise informed by those in the know.

My first move was to launch the qubes update tool via GUI. I selected box to update qubes without known updates and ticked all the boxes.

QUESTION: was that a mistake? Should I have waited on other processes to engage with the updater? I think maybe? See below.

Results of update via GUI:

dom0- green tick
‘debian- 11’- green tick
‘fedora-34’- red cross
‘whonix-gw-16’- red cross
‘whonix-ws-16’- red cross

Whilst going through update process: I also went about allowing tor set-up over standard channels (that is- no proxy or bridges). Is it possible these two processes collided?

During the update described above via GUI updater, a pop-up window appeared. I’ve seen it before on installs but previously have committed the cardinal sin of clicking to accept without first reading.

This time I’m paying more notice. It said:

"[sys-whonix] systemcheck | Whonix-Gateway | Whonix-gw-16 TemplateBased ProxyVM (Note: this is the header in black)

INFO: Whonix APT repository: Enabled. When the Whonix team releases BULLSEYE updates, they will be AUTOMATICALLY installed (when you run apt-get-dist-upgrade) along with packages from the Debian team. Please read to understand the risk. If you want to change this, use:

dom) → Start Menu → whonix-gw-16 → Whonix Repository

WARNING: Debian Package Update Check Result: Could not check for someware updates! (apt-get-code: 100)
Please manually check inside your 'whonix-gw-16- TemplateVM

  1. Open a TemplateVM terminal. (dom0 → Start Menu → Template: whonix-gw-16 → Terminal)

  2. Update


  3. shutdown your TemplateVM. (dom0 → Qubes VM Manager → right click ‘whonix-gw-16’ → Shutdown VM)

  4. Shutdown and restart this TemplateBased ProxyVM. (dom0 → Qubes VM Manager → right click ‘sys-whonix’ → Shutdown VM)"

Process followed to the letter (assuming that I was actually supposed to update debian-11 via whonix ‘upgrade-nonroot’ method). But…


Was I supposed to enter that into the terminal or was I supposed to place some implicit trust in another process? Is this down to poor documentation? When I shut whonix down at the end as instructed, I received a notification to dom0- something like: failed to execute update. But I saw reams of reams of lines in the relevant terminal before shutting it down (info in terminal prompted by Step 2). Also, the shutdown described in step 3 surely includes the shutdown described in step 4. There is no other update going on? It’s only prompted for an update to Debian-11 via whonix. This all appeared to happen via whonix in the terminal, and the debian 11 template was never started.

SO WHAT WAS THAT? Is it old documentation? Is there a change present is 4.1 that doesn’t reflect the process written up in the pop-up window?

ALSO: Was it foolish of me to engage in the updater before allowing sys-whonix to start, especially if it seems to want me to send the update via whonix? Did I force the update over improper channels? If that is the case, shouldnt there be something to stop us doing that? Is it possibly to break the install from the first moment? Am I overthinking this? What don’t I understand?

I’m honestly okay with much of qubes (even the dreaded VPN proxy hurdle), but what exactly is this? What’s going on? It seems like all these contradictory things are colliding. Encouraged to collide even.

I can’t even tell from the pop up window in discussion if it is all referring to the same thing, or if it’s bringing two distinct updates/failures to me in one single pop-up window, causing me to misunderstand the contents/instructions of the window.

I can’t be the only person who doesn’t understand this bit. If you do, please bring me into the fold.

Right now I know less about qubes than (I thought I knew) before.

As an aside: why is this install of qubes not prompting fedora 34 updates, when my other, main install of qubes on another SSD is as of today? Are my qubes machines time traveling? Am I a time traveler?


Testing updates of qubes via qube manager

Selecting dom0 and update brings up a terminal window and tells me it is updating fedora 32. Why is that? Is dom0 locked to a lower tier of fedora than the rest of the fedora template? What gives?

Is this a quirk of old qubes forcing old updates over new qubes?

Surely the qubes team want dom0 to update to the most up-date fedoraOS by default?

But granted- it doesnt matter. it’s offline and functional so why fix what isn’t broken.

enlighten me please

Am now updating all templates individually via update button in the qubes manager window, and they’re all telling me they have shit to update and it’ll take a while, despite having had green ticks for several when updating via the orange shrerrifs badge widget thingy.

What the heck gives y’all?

See here: Dom0 Doesn't Always Show Updates Available and How do I actually update Qubes OS v4.1?.