[qubes-users] Qubes Update does not work for Whonix 16 templates ...

Mailing Lists qubes-users
1

I’ve installed Whonix 16 on my Qubes OS R4.0 system - and - have switched ‘sys-whonix’ to ‘whonix-gw-16’ as well as ‘anon-whonix’ to ‘whonix-ws-16’.

Everything seems to work fine - but - Qubes Updater reports that updates are available for ‘whonix-[gw | ws]-16’ but always fails to update the templates with error msgs similar to

2

Fix the time on your update qube,( and possibly your target). It is, as you can see, wrong.

3

Hello ‘unman’,

4

Any recommendation from someone in the community?

With kind regards,

Viktor

5

managed the download on 4.0.4 in the last days without any issues. Just did it with the qubes-dom0-update command and the enablerepo=community switch. No other commands or work. It just went through like it always do with downloads & installs of new templates.
Sorry, if I couldn’t help more.

6

Thanks for your feedback.

My initial problem was not with the ‘upgrade’ from 15 to 16 - but - with the way my Qubes OS instance behaved after having Whonix 15 & 16 installed in parallel. - ‘Unman’ did resolve that issue already.

What I’m still interested in & continue to struggeling with is "how to ensure that AppVMs & TemplateVMs are / can be time-synced " …

With kind regards,

Viktor

7

This time I have new information on the reported issue. - Template updates were reported for ‘fedora-33’ as well as ‘whonix-gw-16’.

I started Qubes Updater w/o adjusting the time in both templates. - The update of ‘fedora-33’ succeeded, while ‘whonix-gw-16’ failed.

Relevant log from ‘fedora-33’:

Updating fedora-33

fedora-33:

8

Viktor Ransmayr:

I don't want to adjust the time for the two Whonix templates manually to
the (wrong?) CET values, whenever an update is necessary.

I don't think I had this issue with Whonix 15 & believe it only started
with Whonix 16.

Do you have any ideas or suggestions?

Check dom0's clockvm with "qubes-prefs" in a terminal. It's probably sys-net. Confirm the timezone and time are set correctly inside sys-net (or your clockvm if different). If that doesn't do it, and you can afford it, might try a fresh install of 4.1rc2, and making sure to set the correct timezone on install. Hard to know which time zone setting is incorrect.

9

Hello awokd,

I don’t want to adjust the time for the two Whonix templates manually to
the (wrong?) CET values, whenever an update is necessary.

I don’t think I had this issue with Whonix 15 & believe it only started
with Whonix 16.

Do you have any ideas or suggestions?

Check dom0’s clockvm with “qubes-prefs” in a terminal. It’s probably
sys-net.

Yes it is. Here are the complete preferences:

[vr@dom0 ~]$ qubes-prefs
check_updates_vm D True
clockvm - sys-net
default_dispvm - fedora-34-dvm
default_kernel - 5.4.143-1.fc25
default_netvm - sys-firewall
default_pool D lvm
default_pool_kernel - linux-kernel
default_pool_private D lvm
default_pool_root D lvm
default_pool_volatile D lvm
default_qrexec_timeout D 60
default_shutdown_timeout D 60
default_template - fedora-34
management_dispvm - default-mgmt-dvm
stats_interval D 3
updatevm - sys-firewall
[vr@dom0 ~]$

Confirm the timezone and time are set correctly inside sys-net
(or your clockvm if different).

Here are the results of ‘timedatectl’:

[user@sys-net ~]$ timedatectl
Local time: Sat 2021-11-20 18:34:11 CET
Universal time: Sat 2021-11-20 17:34:11 UTC
RTC time: Sat 2021-11-20 17:34:11
Time zone: Europe/Berlin (CET, +0100)
System clock synchronized: no
NTP service: inactive
RTC in local TZ: no
[user@sys-net ~]$

If that doesn’t do it, and you can
afford it, might try a fresh install of 4.1rc2, and making sure to set
the correct timezone on install. Hard to know which time zone setting is
incorrect.

A check with / upgrade to 4.1rc2 is not an option for me. - At least not in November …

With kind regards,

Viktor

10

Viktor Ransmayr:

     System clock synchronized: no
                   NTP service: inactive

Any idea why this isn't running? If your hardware clock is close enough to the right time, it might not matter, but can't be helping things. It's showing as synchronized & active on my sys-net. I'm running 4.1, but pretty sure it showed the same on 4.0.

11

Dom0 (timedatctl) doesn't know dom0 has time synchronization, since its provided per sys-net by default which is provided as a qubesos service.

You can force time sync once sys-net is network connected by doing the following from dom0 Terminal Emulator:
sudo qvm-sync-clock

Now, sys-net and dom0 are time synced.
Time to restart all qubes:
qvm-shutdown --all --wait

Then all new qubes launched will have dom0 new synced time.

Hope that helps.