Onion mirror for qubes-templates-itl not serving debian-13 even though present (was: `qvm-template` confusion)

User Support
, ,
1

tl;dr: why aren’t the Debian 13 templates showing up for me on 4.2?

Contents of `/etc/qubes/repo-templates/qubes-templates.repo` in dom0 
[qubes-templates-itl]
name = Qubes Templates repository
baseurl = http://yum.qubesosfasa4zl44o4tws22di6kepyzfeqv3tg4e3ztknltfxqrymdad.onion/r$releasever/templates-itl
enabled = 1
fastestmirror = 1
metadata_expire = 7d
gpgcheck = 1 
gpgkey = file:///etc/qubes/repo-templates/keys/RPM-GPG-KEY-qubes-$releasever-primary

[qubes-templates-itl-testing]
name = Qubes Templates repository
baseurl = http://yum.qubesosfasa4zl44o4tws22di6kepyzfeqv3tg4e3ztknltfxqrymdad.onion/r$releasever/templates-itl-testing
enabled = 0
fastestmirror = 1      
gpgcheck = 1
gpgkey = file:///etc/qubes/repo-templates/keys/RPM-GPG-KEY-qubes-$releasever-primary

[qubes-templates-community]
name = Qubes Community Templates repository  
baseurl = http://yum.qubesosfasa4zl44o4tws22di6kepyzfeqv3tg4e3ztknltfxqrymdad.onion/r$releasever/templates-community
enabled = 1
fastestmirror = 1      
metadata_expire = 7d
gpgcheck = 1
gpgkey = file:///etc/qubes/repo-templates/keys/RPM-GPG-KEY-qubes-$releasever-templates-community

[qubes-templates-community-testing]
name = Qubes Community Templates repository  
baseurl = http://yum.qubesosfasa4zl44o4tws22di6kepyzfeqv3tg4e3ztknltfxqrymdad.onion/r$releasever/templates-community-testing
enabled = 0
fastestmirror = 1
gpgcheck = 1
gpgkey = file:///etc/qubes/repo-templates/keys/RPM-GPG-KEY-qubes-$releasever-templates-community

Summary of the file:

  • qubes-templates-itl and qubes-templates-community are enabled, qubes-templates-itl-testing and qubes-templates-community-testing are disabled
  • All repos are using onionized baseurls
[user@dom0 ~]$ qvm-template repolist
qubes-templates-community  Qubes Community Templates repository  enabled
qubes-templates-itl        Qubes Templates repository            enabled

(Looks good)

In-browser listing of http://yum.qubesosfasa4zl44o4tws22di6kepyzfeqv3tg4e3ztknltfxqrymdad.onion/r4.2/templates-itl/rpm/:

../
qubes-template-debian-12-4.2.0-202308072102.noa..> 07-Aug-2023 22:12          1500791119
qubes-template-debian-12-4.2.0-202409070311.noa..> 07-Sep-2024 06:25          1516750033
qubes-template-debian-12-minimal-4.2.0-20230803..> 03-Aug-2023 18:00           236351178
qubes-template-debian-12-minimal-4.2.0-20240907..> 07-Sep-2024 08:26           227942179
qubes-template-debian-12-xfce-4.2.0-20230824004..> 24-Aug-2023 01:51          1277436166
qubes-template-debian-12-xfce-4.2.0-20231011032..> 11-Oct-2023 05:25          1293401101
qubes-template-debian-12-xfce-4.2.0-20231217110..> 17-Dec-2023 13:34          1292792425
qubes-template-debian-12-xfce-4.2.0-20240907031..> 07-Sep-2024 04:04          1309044276
qubes-template-debian-13-4.2.0-202508191510.noa..> 19-Aug-2025 17:06          1666030574
qubes-template-debian-13-minimal-4.2.0-20250819..> 19-Aug-2025 17:29           222901422
qubes-template-debian-13-xfce-4.2.0-20250819151..> 19-Aug-2025 16:07          1498109859
qubes-template-fedora-41-xfce-4.2.0-20250130025..> 30-Jan-2025 03:48          1897701442
qubes-template-fedora-42-4.2.0-202506082132.noa..> 08-Jun-2025 23:27          1893926737
qubes-template-fedora-42-minimal-4.2.0-20250609..> 09-Jun-2025 02:12           610562547
qubes-template-fedora-42-xfce-4.2.0-20250608213..> 08-Jun-2025 22:33          1895251330

(Looks good, debian-13 RPMs are present)

But:

[user@dom0 ~]$ qvm-template --refresh list --available
Available Templates
archlinux              0:4.2.0-202309141139  qubes-templates-community
debian-11-minimal      0:4.2.0-202307021203  qubes-templates-itl
debian-11              0:4.2.0-202306021016  qubes-templates-itl
debian-12-minimal      0:4.2.0-202409070311  qubes-templates-itl
debian-12-xfce         0:4.2.0-202409070311  qubes-templates-itl
debian-12              0:4.2.0-202409070311  qubes-templates-itl
fedora-37-minimal      0:4.2.0-202305141453  qubes-templates-itl
fedora-37-xfce         0:4.2.0-202305160402  qubes-templates-itl
fedora-37              0:4.2.0-202306020612  qubes-templates-itl
fedora-38-minimal      0:4.2.0-202308251538  qubes-templates-itl
fedora-38-xfce         0:4.2.0-202312171103  qubes-templates-itl
fedora-38              0:4.2.0-202308270125  qubes-templates-itl
fedora-39-minimal      0:4.2.0-202403250044  qubes-templates-itl
fedora-39-xfce         0:4.2.0-202403100103  qubes-templates-itl
fedora-39              0:4.2.0-202403091939  qubes-templates-itl
fedora-40-minimal      0:4.2.0-202409070311  qubes-templates-itl
fedora-40-xfce         0:4.2.0-202411080221  qubes-templates-itl
fedora-40              0:4.2.0-202409070311  qubes-templates-itl
fedora-41-minimal      0:4.2.0-202411262134  qubes-templates-itl
fedora-41-xfce         0:4.2.0-202501300253  qubes-templates-itl
fedora-41              0:4.2.0-202412200202  qubes-templates-itl
fedora-42-minimal      0:4.2.0-202506090022  qubes-templates-itl
fedora-42-xfce         0:4.2.0-202506082132  qubes-templates-itl
fedora-42              0:4.2.0-202506082132  qubes-templates-itl
kicksecure-17          0:4.2.0-202508121120  qubes-templates-community
whonix-gateway-17      0:4.2.0-202508121120  qubes-templates-community
whonix-workstation-17  0:4.2.0-202508121120  qubes-templates-community

No debian-13 templates, according to qvm-template? Also, debian-11 and fedora-{37,38,39,40} templates are present here even though they aren’t shown when browsing to http://yum.qubesosfasa4zl44o4tws22di6kepyzfeqv3tg4e3ztknltfxqrymdad.onion/r4.2/templates-itl/rpm/? Is there something obvious here I’m overlooking?

Thanks!

2

Aside: I’m purposely not using qvm-template-gui because I find it a little confusing sometimes, and for me its listing always shows templates from disabled repos. This is the case now too; it does actually show the debian-13 templates as available, but only in the qubes-templates-itl-testing repo, which I have long set as disabled in /etc/qubes/repo-templates/qubes-templates.repo.

3

Hmm. Switching out the onion URLs for the clearnet URLs:

...
baseurl = https://yum.qubes-os.org/r$releasever/templates-itl
...
baseurl = https://yum.qubes-os.org/r$releasever/templates-community

Then:

[user@dom0 ~]$ qvm-template --refresh list --available
Available Templates
archlinux              0:4.2.0-202309141139  qubes-templates-community
debian-11-minimal      0:4.2.0-202307021203  qubes-templates-itl
debian-11              0:4.2.0-202306021016  qubes-templates-itl
debian-12-minimal      0:4.2.0-202409070311  qubes-templates-itl
debian-12-xfce         0:4.2.0-202409070311  qubes-templates-itl
debian-12              0:4.2.0-202409070311  qubes-templates-itl
debian-13-minimal      0:4.2.0-202508191510  qubes-templates-itl
debian-13-xfce         0:4.2.0-202508191510  qubes-templates-itl
debian-13              0:4.2.0-202508191510  qubes-templates-itl
fedora-37-minimal      0:4.2.0-202305141453  qubes-templates-itl
fedora-37-xfce         0:4.2.0-202305160402  qubes-templates-itl
fedora-37              0:4.2.0-202306020612  qubes-templates-itl
fedora-38-minimal      0:4.2.0-202308251538  qubes-templates-itl
fedora-38-xfce         0:4.2.0-202312171103  qubes-templates-itl
fedora-38              0:4.2.0-202308270125  qubes-templates-itl
fedora-39-minimal      0:4.2.0-202403250044  qubes-templates-itl
fedora-39-xfce         0:4.2.0-202403100103  qubes-templates-itl
fedora-39              0:4.2.0-202403091939  qubes-templates-itl
fedora-40-minimal      0:4.2.0-202409070311  qubes-templates-itl
fedora-40-xfce         0:4.2.0-202411080221  qubes-templates-itl
fedora-40              0:4.2.0-202409070311  qubes-templates-itl
fedora-41-minimal      0:4.2.0-202411262134  qubes-templates-itl
fedora-41-xfce         0:4.2.0-202501300253  qubes-templates-itl
fedora-41              0:4.2.0-202412200202  qubes-templates-itl
fedora-42-minimal      0:4.2.0-202506090022  qubes-templates-itl
fedora-42-xfce         0:4.2.0-202506082132  qubes-templates-itl
fedora-42              0:4.2.0-202506082132  qubes-templates-itl
kicksecure-17          0:4.2.0-202508121120  qubes-templates-community
whonix-gateway-17      0:4.2.0-202508121120  qubes-templates-community
whonix-workstation-17  0:4.2.0-202508121120  qubes-templates-community

debian-13 templates now available in qubes-templates-itl. So it seems likely this is a misconfiguration in the onion template server.

4

Nice find. Compare the repodata sub-directory between .onion and clearnet.

1 Like
5

Working now :+1:

baseurl = http://yum.qubesosfasa4zl44o4tws22di6kepyzfeqv3tg4e3ztknltfxqrymdad.onion/r$releasever/templates-itl

[user@dom0 ~]$ qvm-template --refresh --repoid qubes-templates-itl list --available | grep debian-13
debian-13-minimal  0:4.2.0-202508191510  qubes-templates-itl
debian-13-xfce     0:4.2.0-202508191510  qubes-templates-itl
debian-13          0:4.2.0-202508191510  qubes-templates-itl

(Posterity: closed qubes-issue. Thanks @unman for taking a look.)

6

The onions dont really have a distinct configuration in the
repositories - they should mirror that on the source.

I dont know what happened here, and I dont administer the server (In any
case, I think that there are no logs.) It’s likely that files are
only updated in the event of a succesful rsync, so as not to leave
things in a broken state. I dont know.
I’ve checked other available onions and they all seem consistent.

While the repo metadata is mirrored, unsupported templates are not. This
is why some templates appear on the listings but cannot be downloaded,
as noted. I think this makes sense, but perhaps not.

I never presume to speak for the Qubes team.
When I comment in the Forum I speak for myself.

1 Like
7

Does it matter if installed and available now display a different repolist?

Installed Templates
debian-12-xfce         0:4.2.0-202312171103  @commandline
debian-13-minimal      0:4.2.0-202508191510  qubes-templates-itl-testing
debian-13-xfce         0:4.2.0-202508191510  qubes-templates-itl-testing
Available Templates
debian-12-minimal      0:4.2.0-202409070311  qubes-templates-itl
debian-12-xfce         0:4.2.0-202409070311  qubes-templates-itl
debian-12              0:4.2.0-202409070311  qubes-templates-itl
debian-13-minimal      0:4.2.0-202508191510  qubes-templates-itl
debian-13-xfce         0:4.2.0-202508191510  qubes-templates-itl
debian-13              0:4.2.0-202508191510  qubes-templates-itl
8

I think as long as the version stamp is the same, the template content is the same. :+1: