[qubes-users] Problems with announced Fedora 35 templates

Mailing Lists qubes-users
21

Hello Demi,

What is the contents of /etc/yum.repos.d in your fedora-34 template?
You might have repositories pointing at the R4.0 repos.

Here’s the content:

[user@fedora-34 ~]$
[user@fedora-34 ~]$ cd /etc/yum.repos.d
[user@fedora-34 yum.repos.d]$ ls -all
total 68
drwxr-xr-x 2 root root 4096 May 20 21:05 .
drwxr-xr-x 114 root root 12288 Jun 12 17:11 …
-rw-r–r-- 1 root root 183 Oct 2 2021 adobe-linux-x86_64.repo
-rw-r–r-- 1 root root 728 Apr 28 2021 fedora-cisco-openh264.repo
-rw-r–r-- 1 root root 1344 Apr 28 2021 fedora-updates-testing.repo
-rw-r–r-- 1 root root 1286 Apr 28 2021 fedora-updates.repo
-rw-r–r-- 1 root root 1239 Apr 28 2021 fedora.repo
-rw-r–r-- 1 root root 191 Oct 2 2021 google-chrome.repo
-rw-r–r-- 1 root root 1483 May 5 02:00 qubes-r4.repo
-rw-r–r-- 1 root root 1324 Oct 2 2021
rpmfusion-free-updates-testing.repo
-rw-r–r-- 1 root root 1264 Oct 2 2021 rpmfusion-free-updates.repo
-rw-r–r-- 1 root root 1248 Oct 2 2021 rpmfusion-free.repo
-rw-r–r-- 1 root root 1369 Oct 2 2021
rpmfusion-nonfree-updates-testing.repo
-rw-r–r-- 1 root root 1309 Oct 2 2021
rpmfusion-nonfree-updates.repo
-rw-r–r-- 1 root root 1312 Oct 2 2021 rpmfusion-nonfree.repo
[user@fedora-34 yum.repos.d]$

With kind regards,

Can you check that qubes-r4.repo points to the R4.1 repository and not
the R4.0 repository? The symptoms you are describing are consistent
with it pointing to the R4.0 repository.

Here’s the content of this file:

[user@fedora-34 yum.repos.d]$
[user@fedora-34 ~]$ cd /etc/yum.repos.d
[user@fedora-34 yum.repos.d]$ cat qubes-r4.repo
[qubes-vm-r4.0-current]
name = Qubes OS Repository for VM (updates)
baseurl = https://yum.qubes-os.org/r4.0/current/vm/fc$releasever
#baseurl = http://yum.qubesosfasa4zl44o4tws22di6kepyzfeqv3tg4e3ztknltfxqrymdad.onion/r4.0/current/vm/fc$releasever
gpgkey = file:///etc/pki/rpm-gpg/RPM-GPG-KEY-qubes-4-primary
skip_if_unavailable=False
gpgcheck = 1
enabled=1

[qubes-vm-r4.0-current-testing]
name = Qubes OS Repository for VM (updates-testing)
baseurl = https://yum.qubes-os.org/r4.0/current-testing/vm/fc$releasever
#baseurl = http://yum.qubesosfasa4zl44o4tws22di6kepyzfeqv3tg4e3ztknltfxqrymdad.onion/r4.0/current-testing/vm/fc$releasever
gpgkey = file:///etc/pki/rpm-gpg/RPM-GPG-KEY-qubes-4-primary
skip_if_unavailable=False
gpgcheck = 1
enabled=0

[qubes-vm-r4.0-security-testing]
name = Qubes OS Repository for VM (security-testing)
baseurl = https://yum.qubes-os.org/r4.0/security-testing/vm/fc$releasever
#baseurl = http://yum.qubesosfasa4zl44o4tws22di6kepyzfeqv3tg4e3ztknltfxqrymdad.onion/r4.0/security-testing/vm/fc$releasever
gpgkey = file:///etc/pki/rpm-gpg/RPM-GPG-KEY-qubes-4-primary
skip_if_unavailable=False
gpgcheck = 1
enabled=0

[qubes-vm-r4.0-unstable]
name = Qubes OS Repository for VM (unstable)
baseurl = https://yum.qubes-os.org/r4.0/unstable/vm/fc$releasever
#baseurl = http://yum.qubesosfasa4zl44o4tws22di6kepyzfeqv3tg4e3ztknltfxqrymdad.onion/r4.0/unstable/vm/fc$releasever
gpgkey = file:///etc/pki/rpm-gpg/RPM-GPG-KEY-qubes-4-unstable
gpgcheck = 1
enabled=0

[user@fedora-34 yum.repos.d]$

You were right - but - I have no clue what went wrong & what to do next …

With kind regards,

Viktor

22

It appears the mail gateway is playing games with my account again. This time only the footer made it through, so I edited it here after it was not delivered in full.

@Viktor

It looks to me like your template is a 4.0 Template regardless of the fedora revision.

Here is what I would do:

  1. Download a R4.1 fedora-35 template rpm here:

https://ftp.qubes-os.org/repo/yum/r4.1/templates-itl/rpm/qubes-template-fedora-35-4.0.6-202205081759.noarch.rpm

  1. The rpm needs to be moved someplace where dom0 can install it.

  2. dom0> sudo dnf install /path/to/template.rpm

    or sudo rpm -i /path/to/template.rpm

  3. Update the template first to get all the current security patches

  4. switch sys-firewall to use the new template and restart sys-firewall

  5. Then use qvm-template to retrieve any other templates you need for R4.1 usage.

23

$ sudo sed -i 's/4\.0/4.1/g' /etc/yum.repos.d/qubes-r4.repo

should fix that.

- --
Sincerely,
Demi Marie Obenour (she/her/hers)
Invisible Things Lab

24

That’s not a good idea. For one, it is insecure. This could be fixed
with appropriate uses of rpmcanon and rpmkeys -K, but it is much simpler
to just fix the repo file. The R4.1 packages will then install over the
R4.0 ones.

- --
Sincerely,
Demi Marie Obenour (she/her/hers)
Invisible Things Lab

25

Hello Demi,

You were right - but - I have no clue what went wrong & what to do next …

$ sudo sed -i ‘s/4.0/4.1/g’ /etc/yum.repos.d/qubes-r4.repo

should fix that

Upgrade of template is still running …

I’ll provide another update as soon as it’s finished.

With kind regards

Viktor

26

Hello Demi,

27

Yes, unless you have a very slow network connection. I recommend using
dnf interactively for this, not Salt; Salt’s lack of progress feedback
will make this extremely frustrating.

- --
Sincerely,
Demi Marie Obenour (she/her/hers)
Invisible Things Lab

28

Hello Demi,

This turns into a never ending story :wink:

You were right - but - I have no clue what went wrong & what to do next
…

$ sudo sed -i ‘s/4.0/4.1/g’ /etc/yum.repos.d/qubes-r4.repo

should fix that

Upgrade of template is still running …

I’ll provide another update as soon as it’s finished.

It is still running, after more than 10 hours. - This should have finished
by now, correct?

Yes, unless you have a very slow network connection. I recommend using
dnf interactively for this, not Salt; Salt’s lack of progress feedback
will make this extremely frustrating.

I performed the operation you suggested, but it did not succeed either …

Here’s the log from dnf:

[user@fedora-34 ~]$
[user@fedora-34 ~]$ sudo dnf -y --refresh upgrade
Fedora 34 - x86_64 78 kB/s | 21 kB 00:00
Fedora 34 openh264 (From Cisco) - x86_64 1.0 kB/s | 989 B 00:00
Fedora 34 - x86_64 - Updates 93 kB/s | 20 kB 00:00
Qubes OS Repository for VM (updates) 13 kB/s | 3.8 kB 00:00
Dependencies resolved.

Problem 1: package qubes-libvchan-xen-4.1.7-1.fc34.x86_64 requires libxenctrl.so.4.14()(64bit), but none of the providers can be installed

  • package qubes-libvchan-xen-4.1.7-1.fc34.x86_64 requires libxenvchan.so.4.14()(64bit), but none of the providers can be installed
  • cannot install both xen-libs-4.14.1-7.fc34.x86_64 and xen-libs-2001:4.8.5-39.fc34.x86_64
  • cannot install both xen-libs-4.14.5-1.fc34.x86_64 and xen-libs-2001:4.8.5-39.fc34.x86_64
  • cannot install the best update candidate for package qubes-libvchan-xen-4.0.9-1.fc34.x86_64
  • problem with installed package xen-libs-2001:4.8.5-39.fc34.x86_64
    Problem 2: package qubes-vm-dependencies-4.1.21-1.fc34.noarch requires xen-runtime, but none of the providers can be installed
  • package xen-runtime-4.14.1-7.fc34.x86_64 requires libxenctrl.so.4.14()(64bit), but none of the providers can be installed
  • package xen-runtime-4.14.1-7.fc34.x86_64 requires libxenguest.so.4.14()(64bit), but none of the providers can be installed
  • package xen-runtime-4.14.1-7.fc34.x86_64 requires libxendevicemodel.so.1()(64bit), but none of the providers can be installed
  • package xen-runtime-4.14.1-7.fc34.x86_64 requires libxenlight.so.4.14()(64bit), but none of the providers can be installed
  • package xen-runtime-4.14.1-7.fc34.x86_64 requires libxentoolcore.so.1()(64bit), but none of the providers can be installed
  • package xen-runtime-4.14.1-7.fc34.x86_64 requires libxlutil.so.4.14()(64bit), but none of the providers can be installed
  • package xen-runtime-4.14.1-7.fc34.x86_64 requires libxenfsimage.so.4.14()(64bit), but none of the providers can be installed
  • package xen-runtime-4.14.1-7.fc34.x86_64 requires libxenhypfs.so.1()(64bit), but none of the providers can be installed
  • package xen-runtime-4.14.1-7.fc34.x86_64 requires libxenstat.so.4.14()(64bit), but none of the providers can be installed
  • package xen-runtime-4.14.1-7.fc34.x86_64 requires libxenvchan.so.4.14()(64bit), but none of the providers can be installed
  • package xen-runtime-4.14.1-7.fc34.x86_64 requires libxencall.so.1(VERS_1.2)(64bit), but none of the providers can be installed
  • package xen-runtime-4.14.1-7.fc34.x86_64 requires libxenfsimage.so.4.14(libfsimage.so.1.0)(64bit), but none of the providers can be installed
  • package xen-runtime-4.14.1-7.fc34.x86_64 requires libxengnttab.so.1(VERS_1.2)(64bit), but none of the providers can be installed
  • package xen-runtime-4.14.1-7.fc34.x86_64 requires libxenhypfs.so.1(VERS_1.0)(64bit), but none of the providers can be installed
  • package xen-runtime-4.14.5-1.fc34.x86_64 requires libxenctrl.so.4.14()(64bit), but none of the providers can be installed
  • package xen-runtime-4.14.5-1.fc34.x86_64 requires libxenguest.so.4.14()(64bit), but none of the providers can be installed
  • package xen-runtime-4.14.5-1.fc34.x86_64 requires libxendevicemodel.so.1()(64bit), but none of the providers can be installed
  • package xen-runtime-4.14.5-1.fc34.x86_64 requires libxenlight.so.4.14()(64bit), but none of the providers can be installed
  • package xen-runtime-4.14.5-1.fc34.x86_64 requires libxentoolcore.so.1()(64bit), but none of the providers can be installed
  • package xen-runtime-4.14.5-1.fc34.x86_64 requires libxlutil.so.4.14()(64bit), but none of the providers can be installed
  • package xen-runtime-4.14.5-1.fc34.x86_64 requires libxenfsimage.so.4.14()(64bit), but none of the providers can be installed
  • package xen-runtime-4.14.5-1.fc34.x86_64 requires libxenhypfs.so.1()(64bit), but none of the providers can be installed
  • package xen-runtime-4.14.5-1.fc34.x86_64 requires libxenstat.so.4.14()(64bit), but none of the providers can be installed
  • package xen-runtime-4.14.5-1.fc34.x86_64 requires libxenvchan.so.4.14()(64bit), but none of the providers can be installed
  • package xen-runtime-4.14.5-1.fc34.x86_64 requires libxencall.so.1(VERS_1.2)(64bit), but none of the providers can be installed
  • package xen-runtime-4.14.5-1.fc34.x86_64 requires libxenfsimage.so.4.14(libfsimage.so.1.0)(64bit), but none of the providers can be installed
  • package xen-runtime-4.14.5-1.fc34.x86_64 requires libxengnttab.so.1(VERS_1.2)(64bit), but none of the providers can be installed
  • package xen-runtime-4.14.5-1.fc34.x86_64 requires libxenhypfs.so.1(VERS_1.0)(64bit), but none of the providers can be installed
  • cannot install both xen-libs-4.14.1-7.fc34.x86_64 and xen-libs-2001:4.8.5-39.fc34.x86_64
  • cannot install both xen-libs-4.14.5-1.fc34.x86_64 and xen-libs-2001:4.8.5-39.fc34.x86_64
  • cannot install the best update candidate for package xen-libs-2001:4.8.5-39.fc34.x86_64
  • cannot install the best update candidate for package qubes-vm-dependencies-4.0.12-1.fc34.noarch
29

Don’t use -y, that way you can check what is going to happen before it
does. Also you might want to clone the VM first; feel free to delete
the clone once everything is working.
- --
Sincerely,
Demi Marie Obenour (she/her/hers)
Invisible Things Lab

30

Hello Demi,

The never ending story - episode 2 :wink:

Don’t use -y, that way you can check what is going to happen before it
does. Also you might want to clone the VM first; feel free to delete
the clone once everything is working.

I cloned the template - and - revised the cmd until no further improvement suggestions were given.

Unfortunately w/o success. - Below you find again my notes & logs:

Notes

Clone ‘fedora-34’ template - and - apply the revised dnf command - Not OK - See “Log-001”.

  • Re-try command with the new additional option suggested - Not OK - See “Log-002”.

Log-001

[user@fedora-34-test ~]$
[user@fedora-34-test ~]$ sudo dnf --refresh --best --allowerasing upgrade
Fedora 34 - x86_64 63 kB/s | 21 kB 00:00
Fedora 34 openh264 (From Cisco) - x86_64 959 B/s | 989 B 00:01
Fedora 34 - x86_64 - Updates 80 kB/s | 19 kB 00:00
Qubes OS Repository for VM (updates) 16 kB/s | 3.8 kB 00:00
Error:
Problem: cannot install the best update candidate for package qubes-gui-agent-4.1.25-1.fc34.x86_64

  • problem with installed package qubes-gui-agent-4.1.25-1.fc34.x86_64
  • cannot install the best update candidate for package qubes-libvchan-xen-4.0.9-1.fc34.x86_64
  • package qubes-gui-agent-4.1.25-1.fc34.x86_64 requires libvchan-xen.so()(64bit), but none of the providers can be installed
  • package qubes-gui-agent-4.1.25-1.fc34.x86_64 requires qubes-libvchan, but none of the providers can be installed
  • package qubes-libvchan-xen-4.1.7-1.fc34.x86_64 requires libxenctrl.so.4.14()(64bit), but none of the providers can be installed
  • package qubes-libvchan-xen-4.1.7-1.fc34.x86_64 requires libxenvchan.so.4.14()(64bit), but none of the providers can be installed
  • cannot install both xen-libs-4.14.1-7.fc34.x86_64 and xen-libs-2001:4.8.5-39.fc34.x86_64
  • cannot install both xen-libs-4.14.5-1.fc34.x86_64 and xen-libs-2001:4.8.5-39.fc34.x86_64
  • package qubes-gui-agent-4.1.25-1.fc34.x86_64 requires libxengnttab.so.1()(64bit), but none of the providers can be installed
  • package qubes-gui-agent-4.1.25-1.fc34.x86_64 requires libxengnttab.so.1(VERS_1.0)(64bit), but none of the providers can be installed
  • cannot install the best update candidate for package xen-libs-2001:4.8.5-39.fc34.x86_64
    (try to add ‘–skip-broken’ to skip uninstallable packages)
    [user@fedora-34-test ~]$

Log-002

[user@fedora-34-test ~]$
[user@fedora-34-test ~]$ sudo dnf --refresh --best --allowerasing --skip-broken upgrade
Fedora 34 - x86_64 75 kB/s | 21 kB 00:00
Fedora 34 openh264 (From Cisco) - x86_64 3.9 kB/s | 989 B 00:00
Fedora 34 - x86_64 - Updates 82 kB/s | 19 kB 00:00
Qubes OS Repository for VM (updates) 15 kB/s | 3.8 kB 00:00
Error:
Problem: cannot install the best update candidate for package qubes-gui-agent-4.1.25-1.fc34.x86_64

  • problem with installed package qubes-gui-agent-4.1.25-1.fc34.x86_64
  • cannot install the best update candidate for package qubes-libvchan-xen-4.0.9-1.fc34.x86_64
  • package qubes-gui-agent-4.1.25-1.fc34.x86_64 requires libvchan-xen.so()(64bit), but none of the providers can be installed
  • package qubes-gui-agent-4.1.25-1.fc34.x86_64 requires qubes-libvchan, but none of the providers can be installed
  • package qubes-libvchan-xen-4.1.7-1.fc34.x86_64 requires libxenctrl.so.4.14()(64bit), but none of the providers can be installed
  • package qubes-libvchan-xen-4.1.7-1.fc34.x86_64 requires libxenvchan.so.4.14()(64bit), but none of the providers can be installed
  • cannot install both xen-libs-4.14.1-7.fc34.x86_64 and xen-libs-2001:4.8.5-39.fc34.x86_64
  • cannot install both xen-libs-4.14.5-1.fc34.x86_64 and xen-libs-2001:4.8.5-39.fc34.x86_64
  • package qubes-gui-agent-4.1.25-1.fc34.x86_64 requires libxengnttab.so.1()(64bit), but none of the providers can be installed
  • package qubes-gui-agent-4.1.25-1.fc34.x86_64 requires libxengnttab.so.1(VERS_1.0)(64bit), but none of the providers can be installed
  • cannot install the best update candidate for package xen-libs-2001:4.8.5-39.fc34.x86_64
    [user@fedora-34-test ~]$
31

Hello Demi,

The never ending story took an unexpected turn …

It looks like I’m running out of options - and - I an now considering a new installation from scratch as my only way going forward!

Or do you still have any other suggestion?

For whatever reason I re-tried to install the ‘fedora-35’ template - and - succeeded.

Based on the ‘naming’ ( * :4.0.6-202205081759) I initially thought that the repos were again pointing to R4.0 - but - they are pointing to R4.1 :slight_smile:

See “Log-001” & “Log-002”.

Log-001 from ‘dom0’

[vr@dom0 ~]$
[vr@dom0 ~]$ sudo qubes-dom0-update qubes-template-fedora-35
Redirecting to ‘qvm-template install fedora-35’
Downloading ‘qubes-template-fedora-35-0:4.0.6-202205081759’…
qubes-template-fedora-35-0:4.0.6-202205081759: 100%|▉| 1.75G/1.75G [06:25<00:00,
Installing template ‘fedora-35’…
fedora-35: Importing data
[vr@dom0 ~]$

Log-002 from ‘fedora-35’ template

[user@fedora-35 ~]$
[user@fedora-35 ~]$ cd /etc/yum.repos.d
[user@fedora-35 yum.repos.d]$
[user@fedora-35 yum.repos.d]$
[user@fedora-35 yum.repos.d]$ cat qubes-r4.repo
[qubes-vm-r4.1-current]
name = Qubes OS Repository for VM (updates)
baseurl = https://yum.qubes-os.org/r4.1/current/vm/fc$releasever
#baseurl = http://yum.qubesosfasa4zl44o4tws22di6kepyzfeqv3tg4e3ztknltfxqrymdad.onion/r4.1/current/vm/fc$releasever
gpgkey = file:///etc/pki/rpm-gpg/RPM-GPG-KEY-qubes-4-primary
skip_if_unavailable=False
gpgcheck = 1
repo_gpgcheck = 1
enabled=1

[qubes-vm-r4.1-current-testing]
name = Qubes OS Repository for VM (updates-testing)
baseurl = https://yum.qubes-os.org/r4.1/current-testing/vm/fc$releasever
#baseurl = http://yum.qubesosfasa4zl44o4tws22di6kepyzfeqv3tg4e3ztknltfxqrymdad.onion/r4.1/current-testing/vm/fc$releasever
gpgkey = file:///etc/pki/rpm-gpg/RPM-GPG-KEY-qubes-4-primary
skip_if_unavailable=False
gpgcheck = 1
repo_gpgcheck = 1
enabled=0

[qubes-vm-r4.1-security-testing]
name = Qubes OS Repository for VM (security-testing)
baseurl = https://yum.qubes-os.org/r4.1/security-testing/vm/fc$releasever
#baseurl = http://yum.qubesosfasa4zl44o4tws22di6kepyzfeqv3tg4e3ztknltfxqrymdad.onion/r4.1/security-testing/vm/fc$releasever
gpgkey = file:///etc/pki/rpm-gpg/RPM-GPG-KEY-qubes-4-primary
skip_if_unavailable=False
gpgcheck = 1
repo_gpgcheck = 1
enabled=0

[qubes-vm-r4.1-unstable]
name = Qubes OS Repository for VM (unstable)
baseurl = https://yum.qubes-os.org/r4.1/unstable/vm/fc$releasever
#baseurl = http://yum.qubesosfasa4zl44o4tws22di6kepyzfeqv3tg4e3ztknltfxqrymdad.onion/r4.1/unstable/vm/fc$releasever
gpgkey = file:///etc/pki/rpm-gpg/RPM-GPG-KEY-qubes-4-unstable
gpgcheck = 1
repo_gpgcheck = 1
enabled=0

[user@fedora-35 yum.repos.d]$

32

I think I see what is happening. DNF thinks that
xen-libs-2001:4.8.5-39.fc34.x86_64 is *better* than
xen-libs-4.14.5-1.fc34.x86_64, but it is actually *worse*. So it gets
confused. I suggest trying “dnf install --allowerasing” with an
explicit list of packages (including version numbers, but no --best).
If that fails, “dnf shell” is the ultimate sledgehammer: it allows
performing arbitrary installs and removes in a single transaction, so
you can use it to override DNF’s dependency solver.
- --
Sincerely,
Demi Marie Obenour (she/her/hers)
Invisible Things Lab

33

Congratulations! I guess you can disregard my last email. Be sure to
update your new template :slight_smile:
- --
Sincerely,
Demi Marie Obenour (she/her/hers)
Invisible Things Lab

34

Hello Demi,