Qubes OS updates Weekly Review - Y2025-W16

General Discussion
,
1

Qubes OS updates Weekly Review - Y2025-W16

Introduction

Weekly review of new packages uploaded to Qubes OS repositories. Link to previous version here.

Alphabetically sorted list of new packages uploaded to Qubes OS repositories 
libqrexec-utils4_4.3.6-1+deb12u1_amd64.deb
libqrexec-utils4_4.3.6-1+deb13u1_amd64.deb
libqrexec-utils4_4.3.6-1+jammy1_amd64.deb
libqrexec-utils4_4.3.6-1+noble1_amd64.deb
libqrexec-utils4-dbgsym_4.3.6-1+deb12u1_amd64.deb
libqrexec-utils4-dbgsym_4.3.6-1+deb13u1_amd64.deb
libqrexec-utils-dev_4.3.6-1+deb12u1_amd64.deb
libqrexec-utils-dev_4.3.6-1+deb13u1_amd64.deb
libqrexec-utils-dev_4.3.6-1+jammy1_amd64.deb
libqrexec-utils-dev_4.3.6-1+noble1_amd64.deb
python3-dnf-plugins-qubes-hooks-4.3.23-1.fc40.noarch.rpm
python3-qrexec_4.3.6-1+deb12u1_amd64.deb
python3-qrexec_4.3.6-1+deb13u1_amd64.deb
python3-qrexec_4.3.6-1+jammy1_amd64.deb
python3-qrexec_4.3.6-1+noble1_amd64.deb
python3-xen-4.19.2-1.fc41.x86_64.rpm
qubes-core-agent_4.3.23-1+deb12u1_amd64.deb
qubes-core-agent_4.3.23-1+deb13u1_amd64.deb
qubes-core-agent-4.3.23-1.fc40.x86_64.rpm
qubes-core-agent-4.3.23-1.fc41.x86_64.rpm
qubes-core-agent-4.3.23-1.fc42.x86_64.rpm
qubes-core-agent_4.3.23-1+jammy1_amd64.deb
qubes-core-agent_4.3.23-1+noble1_amd64.deb
qubes-core-agent-caja_4.3.23-1+deb12u1_amd64.deb
qubes-core-agent-caja_4.3.23-1+deb13u1_amd64.deb
qubes-core-agent-caja-4.3.23-1.fc40.x86_64.rpm
qubes-core-agent-caja-4.3.23-1.fc41.x86_64.rpm
qubes-core-agent-caja-4.3.23-1.fc42.x86_64.rpm
qubes-core-agent-caja_4.3.23-1+jammy1_amd64.deb
qubes-core-agent-caja_4.3.23-1+noble1_amd64.deb
qubes-core-agent-dbgsym_4.3.23-1+deb12u1_amd64.deb
qubes-core-agent-dbgsym_4.3.23-1+deb13u1_amd64.deb
qubes-core-agent-dom0-updates_4.3.23-1+deb12u1_amd64.deb
qubes-core-agent-dom0-updates_4.3.23-1+deb13u1_amd64.deb
qubes-core-agent-dom0-updates-4.3.23-1.fc40.noarch.rpm
qubes-core-agent-dom0-updates-4.3.23-1.fc41.noarch.rpm
qubes-core-agent-dom0-updates-4.3.23-1.fc42.noarch.rpm
qubes-core-agent-dom0-updates_4.3.23-1+jammy1_amd64.deb
qubes-core-agent-dom0-updates_4.3.23-1+noble1_amd64.deb
qubes-core-agent-nautilus_4.3.23-1+deb12u1_amd64.deb
qubes-core-agent-nautilus_4.3.23-1+deb13u1_amd64.deb
qubes-core-agent-nautilus-4.3.23-1.fc40.x86_64.rpm
qubes-core-agent-nautilus-4.3.23-1.fc41.x86_64.rpm
qubes-core-agent-nautilus-4.3.23-1.fc42.x86_64.rpm
qubes-core-agent-nautilus_4.3.23-1+jammy1_amd64.deb
qubes-core-agent-nautilus_4.3.23-1+noble1_amd64.deb
qubes-core-agent-networking_4.3.23-1+deb12u1_amd64.deb
qubes-core-agent-networking_4.3.23-1+deb13u1_amd64.deb
qubes-core-agent-networking-4.3.23-1.fc40.noarch.rpm
qubes-core-agent-networking-4.3.23-1.fc41.noarch.rpm
qubes-core-agent-networking-4.3.23-1.fc42.noarch.rpm
qubes-core-agent-networking_4.3.23-1+jammy1_amd64.deb
qubes-core-agent-networking_4.3.23-1+noble1_amd64.deb
qubes-core-agent-network-manager_4.3.23-1+deb12u1_amd64.deb
qubes-core-agent-network-manager_4.3.23-1+deb13u1_amd64.deb
qubes-core-agent-network-manager-4.3.23-1.fc40.noarch.rpm
qubes-core-agent-network-manager-4.3.23-1.fc41.noarch.rpm
qubes-core-agent-network-manager-4.3.23-1.fc42.noarch.rpm
qubes-core-agent-network-manager_4.3.23-1+jammy1_amd64.deb
qubes-core-agent-network-manager_4.3.23-1+noble1_amd64.deb
qubes-core-agent-passwordless-root_4.3.23-1+deb12u1_amd64.deb
qubes-core-agent-passwordless-root_4.3.23-1+deb13u1_amd64.deb
qubes-core-agent-passwordless-root-4.3.23-1.fc40.noarch.rpm
qubes-core-agent-passwordless-root-4.3.23-1.fc41.noarch.rpm
qubes-core-agent-passwordless-root-4.3.23-1.fc42.noarch.rpm
qubes-core-agent-passwordless-root_4.3.23-1+jammy1_amd64.deb
qubes-core-agent-passwordless-root_4.3.23-1+noble1_amd64.deb
qubes-core-agent-selinux-4.3.23-1.fc40.noarch.rpm
qubes-core-agent-selinux-4.3.23-1.fc41.noarch.rpm
qubes-core-agent-selinux-4.3.23-1.fc42.noarch.rpm
qubes-core-agent-systemd-4.3.23-1.fc40.x86_64.rpm
qubes-core-agent-systemd-4.3.23-1.fc41.x86_64.rpm
qubes-core-agent-systemd-4.3.23-1.fc42.x86_64.rpm
qubes-core-agent-thunar_4.3.23-1+deb12u1_amd64.deb
qubes-core-agent-thunar_4.3.23-1+deb13u1_amd64.deb
qubes-core-agent-thunar-4.3.23-1.fc40.x86_64.rpm
qubes-core-agent-thunar-4.3.23-1.fc41.x86_64.rpm
qubes-core-agent-thunar-4.3.23-1.fc42.x86_64.rpm
qubes-core-agent-thunar_4.3.23-1+jammy1_amd64.deb
qubes-core-agent-thunar_4.3.23-1+noble1_amd64.deb
qubes-core-dom0-4.3.24-1.fc41.noarch.rpm
qubes-core-dom0-4.3.25-1.fc41.noarch.rpm
qubes-core-dom0-linux-4.3.15-1.fc41.x86_64.rpm
qubes-core-dom0-linux-kernel-install-4.3.15-1.fc41.x86_64.rpm
qubes-core-dom0-vaio-fixes-4.3.15-1.fc41.x86_64.rpm
qubes-core-qrexec_4.3.6-1+deb12u1_amd64.deb
qubes-core-qrexec_4.3.6-1+deb13u1_amd64.deb
qubes-core-qrexec-4.3.6-1.fc40.x86_64.rpm
qubes-core-qrexec-4.3.6-1.fc41.x86_64.rpm
qubes-core-qrexec-4.3.6-1.fc42.x86_64.rpm
qubes-core-qrexec_4.3.6-1+jammy1_amd64.deb
qubes-core-qrexec_4.3.6-1+noble1_amd64.deb
qubes-core-qrexec-dbgsym_4.3.6-1+deb12u1_amd64.deb
qubes-core-qrexec-dbgsym_4.3.6-1+deb13u1_amd64.deb
qubes-core-qrexec-devel-4.3.6-1.fc40.x86_64.rpm
qubes-core-qrexec-devel-4.3.6-1.fc41.x86_64.rpm
qubes-core-qrexec-devel-4.3.6-1.fc42.x86_64.rpm
qubes-core-qrexec-dom0-4.3.6-1.fc41.x86_64.rpm
qubes-core-qrexec-libs-4.3.6-1.fc40.x86_64.rpm
qubes-core-qrexec-libs-4.3.6-1.fc41.x86_64.rpm
qubes-core-qrexec-libs-4.3.6-1.fc42.x86_64.rpm
qubes-core-qrexec-vm-4.3.6-1.fc40.x86_64.rpm
qubes-core-qrexec-vm-4.3.6-1.fc41.x86_64.rpm
qubes-core-qrexec-vm-4.3.6-1.fc42.x86_64.rpm
qubes-core-qrexec-vm-selinux-4.3.6-1.fc40.x86_64.rpm
qubes-core-qrexec-vm-selinux-4.3.6-1.fc41.x86_64.rpm
qubes-core-qrexec-vm-selinux-4.3.6-1.fc42.x86_64.rpm
qubes-mgmt-salt-dom0-qubes-infrastructure-4.2.1-1.fc37.noarch.rpm
qubes-mgmt-salt-dom0-qubes-infrastructure-4.2.1-1.fc41.noarch.rpm
qubes-vm-core-4.3.23-1-x86_64.pkg.tar.zst
qubes-vm-dom0-updates-4.3.23-1-x86_64.pkg.tar.zst
qubes-vm-keyring-4.3.23-1-x86_64.pkg.tar.zst
qubes-vm-networking-4.3.23-1-x86_64.pkg.tar.zst
qubes-vm-passwordless-root-4.3.23-1-x86_64.pkg.tar.zst
qubes-vm-qrexec-4.3.6-1-x86_64.pkg.tar.zst
qubes-vm-xen-4.19.2-1-x86_64.pkg.tar.zst
xen-4.19.2-1.fc41.x86_64.rpm
xen-devel-4.19.2-1.fc41.x86_64.rpm
xen-doc-4.19.2-1.fc41.noarch.rpm
xen-hypervisor-4.19.2-1.fc41.x86_64.rpm
xen-libs-4.19.2-1.fc41.x86_64.rpm
xen-licenses-4.19.2-1.fc41.x86_64.rpm
xen-runtime-4.19.2-1.fc41.x86_64.rpm

Highlights

  • Better Intel SR-IOV pass-through support
  • Final implementation of PCI Device Path assignments
  • Continuation of Qubes Air development

Details

In addition to the usual minor fixes and patches (full list here):

  • core-admin v4.3.24 & v4.3.25 (r4.3)
    . Two updates to the core in one week. One is to wrap-up and finish PCI Device Path implementation. The other is continuation of RemoteVM (Qubes Air) implementation.
    . The behaviour of qvm-pci or PCI device IDs in HVM qube setting is going to change if they are connected to a PCI hub. How this works is documented in the PR.
    . Implementation of RemoteVM introduces relayvm and transport_rpc properties.

  • vmm-xen v4.19.2-1 (r4.3)
    . Xen upgraded from 4.19.1 to 4.19.2
    . Small but significant patch to allow Intel SR-IOV pass-through.
    . A patch for devices without legacy IRQ.

  • core-agent-linux v4.3.23 (r4.3)
    Fixing a bug with apt based TemplateVMs which did not receive update availability notification via their child AppVM automatic periodic checks.

  • core-admin-linux v4.3.15 (r4.3)
    . Assuring PCI assignments based on the new PCI Device Path is properly implemented at boot time.
    . Assuring keyboard with Renesas USB controller are available at boot time to unlock LUKS password.

Epilogue

Users have been reporting success with SR-IOV pass-through and they are enjoying GPU acceleration with it in their qubes. If you want to use it, just use it for trusted qubes and wait for Qubes OS VirtIO Native Context to be developed for other use cases. While it is debated that SR-IOV presents a smaller attack surface within the virtualization layer, Qubes OS does not guaranty Intel’s implementation. Theoretically a malicious program could breach shared Intel’s silicon from a compromised qube and have access to main sys-gui-gpu (which could be dom0).

13 Likes
2

Do you perhaps have a guide or other resources on how to set that up? (Well, once r4.3 gets released I guess).

3

First of all, you have to assure your Intel GPU supports SR-IOV. It is only available for 11th gen and 12th gen Intel integrated graphics. If you have older Intel GPU, then you are out of luck.

Then following this post and down the thread might be helpful:

1 Like
4

No love for 4.2 users?

2 Likes
5

That fix is only one line and straight forward. I guess it will be back-ported to R4.2 very soon. To the best of my knowledge, each change has to be tested “at least one week” before being back-ported to the current stable.

For the time, I advise users to include/check Debian and Whonix templates for updates more frequently while doing their routine updates of the other templates.

3 Likes
6

Yeah, that’s what I do. And fixed/“worked around” the “tee” pipe in a couple of “always in use” debian-12-minimal-based templates to get the update notification.

1 Like
7

yeah, it seems like 4.3 is getting all the goodies while everyone is on 4.2.4

2 Likes
8

As far as I am aware, there is an agreement that every patch has to be tested “at least one week” “at least 5 days” before being eligible for the current stable (reference).

I am also aware that some features will never be backported because of technical difficulties or it is impossible (e.g. they won’t work on r4.2’s fedora-37 in dom0). Examples are the New Devices API or partial Wayland support (for the new KDE Plasma DE on fedora-41).

But for the others, it is also a question for me personally that how long a patch has to be tested to be good for stable.

9

Quoting from https://www.qubes-os.org/doc/testing/#updates:

Every new update is first uploaded to the security-testing repository if it is a security update or current-testing if it is a normal update. The update remains in security-testing or current-testing for a minimum of one week. On occasion, an exception is made for a particularly critical security update, which is immediately pushed to the current stable repository. In general, however, security updates remain in security-testing for two weeks before migrating to current . Normal updates generally remain in current-testing until they have been sufficiently tested by the community, which can last weeks or even months, depending on the amount of feedback received (see Providing feedback).

“Sufficient testing” is, in practice, a fluid term that is up the developers’ judgment. In general, it means either that no negative feedback and at least one piece of positive feedback has been received or that the package has been in current-testing for long enough, depending on the component and the complexity of the changes.

2 Likes
10

I agree in principle, but when you introduce a bug as simple as the one discussed here (“no update notifications for Debian-based templates”), you don’t need to test a long time before rolling back. The testing period is needed when making changes, and brings up the legitimate question “how was the core-agent-linux obvious bug not detected at all before it was pushed to the stable updates?”.

11

Thanks for the information.

Further notes:

Please be advised that the highly requested patch (for apt based outdated notifications) is ported to r4.2 testing here one hour ago.

1 Like