I'm back online to find that the server hosting the Onion site is down
for maintenance.
Apologies for the lack of notice - I had notification but did not see it
until today.
I'm back online to find that the server hosting the Onion site is down
for maintenance.
Apologies for the lack of notice - I had notification but did not see it
until today.
Right now, I can’t update any template. I use sys-whonix as update vm and onion repositories.
Issue is happening from at least 4-5 days.
Updating templates is not relevant to the onion service of qubes-os.org webpage.
It is as the onion repositories are in the same cluster as the onion web
site.
If you have enabled the onion repositories then updates over Tor will
fail, as stated.
I never presume to speak for the Qubes team.
When I comment in the Forum I speak for myself.
When it likely to be resolved?
I believe later today.
I never presume to speak for the Qubes team.
When I comment in the Forum I speak for myself.
I wasn’t aware of the QubesOS update repository URL’s that use .onion hidden services. How do I enable those?
You need to edit the repository config files, uncomment onion repos and comment out the clearnet repos.
For dom0 in /etc/yum.repos.d/qubes-*
files.
For Fedora template in /etc/yum.repos.d/qubes-r4.repo
file.
For Debian template in /etc/apt/sources.list.d/qubes-r4.list
file.
There is no value of doing that right now, as I am only offline with my qubes laptop right now to avoid any attack surface due to no updates.
It’s still down. Looking forward to having it back online.
Issue resolved.
/etc/yum.repos.d/qubes-dom0.repo
file AND, /etc/qubes/repo-templates/qubes-templates.repo
file. DO I comment/uncomment the clearnet/onion ones in BOTH these files in dom0?/etc/apt/sources.list.d/qubes-r4.list
file?@ephile , regarding 3, I am confused. It seems like on dom0 there is /etc/qubes/repo-templates/qubes-templates.repo file. Is this also controlling the onion/clearnet update connection preference for the debian/fedora templates? If so, why am I also having to make changes on debian/fedora templates themselves?
No, this file has repo information for community templates and the invisible things lab templates relevant to dom0. For individual debian and fedora templates you’ll have to edit the relevant files in each of those templates.
Alright, I am reading the whonix wiki link you shared. It is quite helpful.
Onion mirrors are down for almost a week I think. Please give some updates @unman. When you are expecting them functional?
Just a note that there are other Qubes OS .onion update mirrors available (in additional to the official Qubes OS mirror). The address for them could be found here:
Most of the .onion mirrors in the above list could be also used for updating. Not just downloading installation ISOs.
Updating via any of them should be technically safe as the packages are cryptographically signed and verified by the Distro package manager.
How to use these mirrors to update, can you elaborate?
For yum/dnf based templates and dom0, you can edit /etc/yum.repos.d/qubes-r4.repo
, then copy the lines with baseurl = http://yum.qubesosfasa4....onion ...
in it and comment the old lines to have them (so you can revert back to them if you want). Then in the new lines, change the yum.....onion
address to one of the .onion addresses in the official mirror list.
For apt/dpkg based templates (all but Whonix), the repo file is /etc/apt/sources.list.d/qubes-r4.list
and the line are like:
deb [arch=amd64 signed-by=....gpg] tor+http://deb.qubesosfasa4...onion ....
And again, deb.qubesos...onion
part should be replaced with one of the mirrors.
Similarly for Archlinux template, there is another one.
Disclaimer: Before doing that, wait a little for @unman to advise on security benefits/threats of updating over other .onion mirrors compared to waiting for a long time for official .onion mirror to be fixed (if it ever happens now or in future).