Qubes Upgrade to 4.2 - In Place Upgrade

General Discussion
21

I was wrong, it works if you install apt-transport-tor with default config. But install with --no-install-recommends so tor package won’t be installed as well:

sudo apt install --no-install-recommends apt-transport-tor

The templates in Qubes OS are configured to work with apt-transport-tor by default:

$ cat /etc/apt/apt.conf.d/01qubes-proxy 
### This file is automatically generated by Qubes (/usr/lib/qubes/update-proxy-configs script).
### All modifications here will be lost.
### If you want to override some of this settings, create another file under 
### /etc/apt/apt.conf.d.

# Use Qubes Update Proxy
Acquire::http::Proxy "http://127.0.0.1:8082/";
Acquire::tor::proxy "http://127.0.0.1:8082/";
22

this would be installed in sys-whonix correct?

23

No, in your debian-12 template. You’ll need to remove the tor+ from the sources.lists first, install apt-transport-tor in debian-12 and then you can return tor+ in the sources.lists.

24

Is there any particular reason “tor+” can’t just be allowed to remain?

25

Package manager don’t know how to use tor without apt-transport-tor package installed so you can’t use tor+http links to repositories without it.

26

I followed the documentation regarding the .onion repos, but it returns an error

whenever the #metalink is commented. In reality, the metalink needs to be

uncommented to retrieve the server’s metadata.

I think there is some issue with the GPG Key because of this error message:

W: http://repos.azulsystems.com/debian/dists/stable/Release.gpg: Key is

stored in legacy trusted.gpg keyring (/etc/apt/trusted.gpg)

E: failed to fetch tor+http://…onion

(500 Unable to connect [IP: 127.0.0.1 8082]

500 (internal server error)

Port 8082

→ HTTP Proxy server

27

after running

sudo sed -i “s|tor+||g” /etc/apt/sources.list /etc/apt/sources.list.d/*

the following error is returned:

E: failed to fetch http://

Tinyproxy

I think there’s some issue with how tinyproxy is configured because it returns

an HTTP error 500

28

after checking sys-whonix /etc/tinyproxy/tinyproxy-updates.conf

it appears that the tinyproxy configuration file is not configured. I wonder if there

is Whonix or Qubes documentation on how to correctly configure tinyproxy

29

It’s a warning, not an error and it’s unrelated to your issue.

Try to update the debian-12 template using Qubes Update tool, will it have the same error?
Try to update your other templates using Qubes Update tool, will they be updated successfully?
Maybe there is some issue with your debian-12 template specifically.
If it’s an issue only with your debian-12 template then it’d be faster to just reinstall the debian-12 template.

30

I tried reinstalling debian-12 but the default command doesn’t work. Are you familiar with it?

31

What default command and how exactly it’s not working?
Also there is a Qubes Template Manager GUI tool that you can use to reinstall the template.

32

How can this be done using Template Manager GUI?

Doesn’t the template have to be deleted first? It’s a dependency currently.

33

Shutdown all qubes.
Clone the debian-12 template to debian-12-tmp.
Switch template from debian-12 to debian-12-tmp for all qiubes using Qubes Template Switcher.
Reinstall debian-12 template.
Switch template from debian-12-tmp to debian-12 for all qiubes using Qubes Template Switcher.

34

The file /etc/qubes/repo-templates/qubes-templates.repo

contains the qubes templates repository, and the following URL shows the

directory structure:

http://yum.qubesosfasa4zl44o4tws22di6kepyzfeqv3tg4e3ztknltfxqrymdad.onion/r4.1/

This directory structure is broken down into multiple categories:

[current/
[current-testing/]
[security-testing/]
[templates-community/]
[templates-community-testing/]
[templates-itl/]
[templates-itl-testing/]
[unstable/]

but only templates-itl and templates-itl-testing have debian-12 templates within

the directory. Which is the correct directory to choose?

35

For stable template choose templates-itl.

36

Ok that worked very well. The only holdup now seems to be the mirage_os template

which is a TemplateVM that is not a standard template. Will this template need to

be backed up, deleted, and then restored after the upgrade?

37

I was able to make it to the STAGE 2 of the update script but ran into another

server connection issue:

3isec Qubes dom0 Repository

Errors during downloading metadata for repository ‘3isec-dom0-current’:

Error: Failed to download metadata for repo ‘3isec-dom0-current’: Cannot
download repomd.xml:

Cannot download repodata/repomd.xml: All mirrors were tried

When I checked the 3isec.org URL, it actually states /fc37/ so the script has
a typo because it uses /fc32/

38
39

what does the -k flag do?

40 
    --skip-standalone-upgrade, -k      Don't upgrade StandaloneVM to R4.2 repositories.