Qubes OS 4.2.0-rc2 is available for testing

Szewcu · August 29, 2023, 3:37pm

this is strange, it should be changed to fc37

solene · August 29, 2023, 5:27pm

I think I found the issue, maybe related that 4.2 is currently in RC2.

I changed the global settings to use regular updates instead of testing/unstable dom0 updates, I’m doing the process again and now it’s downloading a lot of fedora 37 packages, so it seems to be going well now.

edit: I’m now on 4.2-RC2 after upgrading from 4.1 I had to disable the extra unstable/testing repos and it worked following the official guide.

pjmbraet · August 29, 2023, 7:48pm

Upgrade doesn’t work:
—Errors during downloading metadata for repository ‘qubes-dom0-cached’:

Curl error (37): Couldn’t read a file:// file for file:///var/lib/qubes/updates/repodata/repomd.xml [Couldn’t open file /var/lib/qubes/updates/repodata/repomd.xml]
Error: Failed to download metadata for repo ‘qubes-dom0-cached’: Cannot download repomd.xml: Cannot download repodata/repomd.xml: All mirrors were tried

Screenshot_2023-08-29_19-28-451920×1080 218 KB

___Error canonicalizing /var/tmp/qubes-updates-tmpg2wc01kd.UNTRUSTED/qubes-release-4.2-0.3.fc32.noarch.rpm

___CalledProcessError: Command ‘[‘qrexec-client-vm’, ‘dom0’, ‘qubes.FeaturesRequest’]’ returned non-zero exit status 1.

After trying to fix these, Whonix:

solene · August 29, 2023, 7:51pm

How do you set clipboard expiration? In the global settings manager, in the clipboard tab, I find nothing related to this new feature.

solene · August 29, 2023, 7:51pm

This looks exactly the same issue I had when using dom0 testing security fixes and dom0 unstable updates.

resulin · August 30, 2023, 4:01pm

This statement should be expanded, as it’s not clear where PipeWire support is: Just the fedora template? Debian one as well? Pipewire in dom0?

pjmbraet · August 30, 2023, 6:12pm

Before in place upgrade Qubes 4.1 to 4.2 Whonix users should make sure they upgraded Whonix-16 to Whonix-17

github.com

Qubes-Community/Contents/blob/master/docs/privacy/whonix.md


Whonix for Privacy & Anonymity
==============================

To improve your privacy and anonymity on the internet, you can install the
Whonix Template on your Qubes machine.

[Whonix](https://www.whonix.org) is based on [Debian](https://www.debian.org)
and [Tor](https://www.torproject.org) and utilizes two VMs, a **"gateway"** and
a **"workstation"**. Qubes security architecture makes use of Whonix's isolation
by using the gateway as a ProxyVM to route all network traffic through Tor,
while the workstation is used for making AppVMs.

Whonix in Qubes replaces the deprecated [TorVM](https://www.qubes-os.org/doc/torvm) service used in earlier
versions of Qubes.

*The following pages are written by the Whonix developers and are located on their website.*

## Getting Started with Whonix

This file has been truncated. show original

When still running Whonix-16 the upgrade to Qubes 4.2 will fail.

adw · August 30, 2023, 8:58pm

@marmarek?

But Whonix 17 isn’t available on Qubes 4.1, so how can a user on Qubes 4.1 upgrade to Whonix 17 before upgrading to Qubes 4.2? @adrelanos?

qinix · August 31, 2023, 9:43am

If I`m not mistaken - after looking at the issues on github - 4.2 rc2 will not boot with Seabios (without CSM/Legacy boot). Not sure if installing 4.1.2 and upgrading would work as a workaround.

adrelanos · August 31, 2023, 12:31pm

I am not aware of this. That might be a Qubes bug if Qubes-Whonix has this amount of undue power which it shouldn’t have in the threat model. If so, a bug would need to reported to Qubes upstream on Issues · QubesOS/qubes-issues · GitHub.

I tend to think this is most likely user error and not a Qubes bug.

Are templates build for Qubes R4.1 compatible with Qubes R4.2? @marmarek

If yes, and I presume so, I don’t see how that could cause any issues.
If no, then after upgrading Qubes R4.1 to Qubes R4.2, users who wish to upgrade dom0 or Templates over Whonix would have a problem.

Probably not needed as per above.

Otherwise:

Release Upgrade Whonix 16 to Whonix 17
apply the same procedure that one would use to upgrade a Debian 12 (bookworm) Template from Qubes 4.1 to 4.2 to the Qubes-Whonix Templates

Might have a pretty good chance.

szz9pza · September 2, 2023, 6:39pm

When attempting the in-place-update, I was blocked on Stage 2.
I got a qubes.ReceiveUpdates error with returned non-zero exit status 1
which result to the canonicalizing error.

No security or unstable repo enabled.

journalctl report:

dom0 qubes.ReceiveUpdates+-sys-firewall-dvm[34312]: Error canonicalizing file: No key available!
dom0 qubes.ReceiveUpdates+-sys-firewall-dvm[34312]: Error canonicalizing /var/tmp/qubes-updates-tmp2ejy9fkh.UNTRUSTED/qubes-release-4.2-0.3.fc32.noarch.rpm

I had to manually add the 4.2 key (in dom0):

sudo rpm --import /etc/pki/rpm-gpg/RPM-GPG-KEY-qubes-4.2-primary

and then, I was able to perform Stage 2 update.
No (blocking) errors from all other stages.

solene · September 3, 2023, 10:14am

I’m trying to update in-place my desktop to 4.2 but I got this problem…

Before dom0 install new packages, it asks to shutdown all VMs, if you say No it aborts, if you say yes it continues but stop sys-usb, and you are left with a system on which you can’t do anything except using the power button…

Would it be ok to keep sys-usb running during the update using --keep? Could it be the default? (or at least add a warning), a step before it was asking to shutdown VMs but not the system VMs. The last message wasn’t clear enough IMO

kommuni · September 3, 2023, 11:14am

Perhaps your sys-usb qube name is not ‘sys-usb’ ? If so, it should be run with -u or --usb.

See help for details: qubes-dist-upgrade.sh --help

solene · September 3, 2023, 12:22pm

It’s named sys-usb.

solene · September 3, 2023, 12:34pm

Ok, after the pre-boot upgrade, after I restarted, I got a prompt fur the LUKS passphrase, and then I’m stuck indefinitely on the plymouth screen.

Not sure how to debug that, I removed the plymouth from the command line, I see a lot of stuff displayed on the tty but nothing significant. I saw a message about lightdm starting correctly, but that’s all.

I bricked my Qubes OS and I have no idea how to fix it now I did the dom0 snapshot, but I can’t access a Qubes OS root console to recover.

edit: I opened an issue Qubes OS stopped booting after pre-reboot in-place 4.1 to 4.2-RC2 upgrade · Issue #8480 · QubesOS/qubes-issues · GitHub

Plum · September 3, 2023, 3:25pm

qubes-tunnel is not available yet for r4.2.0-rc2 - not a huge surprise I guess. Look forward to its inclusion later.

SteveC · September 3, 2023, 3:28pm

I guess this is a good reminder to turn autostart on sys-usb OFF before doing anything like this. That way your system may freeze up but at least on reboot sys-usb won’t start.

Bearillo · September 3, 2023, 8:01pm

Just a quick question for those who are testing Q4.2:
Since dom0 got upgraded to Fedora 37 and uses Xfce, can you confirm that it’s Xfce 4.16 and that in the PowerManager there is some kind of option for night mode (blue light filter) based on color profiles?

If not, then I guess I’ll have to use redshift…

ymy · September 3, 2023, 8:54pm

xfce is 4.16, so far i have not discovered a dedicated night mode, still using good old Blue Light Filter in XFCE (Redshift)

Qube Manager Dark Mode (built-in method) and so on.

Bearillo · September 3, 2023, 9:25pm

Thank you. According to Xfce release manager Simon Steinbeiss on his blog this was part of the development goals:
https://simon.shimmerproject.org/2019/10/19/xfce-4-15-development-phase-starting/

It should be either in Power Manager or “settings daemon”, unless they ended up dropping that feature after all.