R4.2: Denied Update Proxy and Global Settings shut down

User Support Testing Release
,
1

When Debian or Fedora is updated, an error “Denied qubes.UpdateProxy” is displayed. I chose to update qubes through Whonix with tor and when I tried to take a look at Global Settings/config where that setting is, it flickers on and then turns off. Whonix WS and GW update just fine.

If Debian and Fedora were not updated over tor, what would be the disadvantage? Debian can be configured to use tor onion repositories. The template could just be Kicksecure to begin with. Fedora does not have this option, although there are onion repos for Centos (lysator SE).

So the way forward if no one knows how to fix the Update Proxy is to configure D&F updates through firewall, onionizing D and making sure F is dnf5 (gpg signing) and https sources selected of course? But then the Qubes update mechanism is not in places and templates are not supposed to be directly network connected. Dates that cannot be disrupted is the goal.

So just install without updates over tor? Whonix updates over tor anyway.

2

I am not sure I understand.

3

Dom0, D11, F38 - updates available Y…

But there is a way the updates are blocked both through sys-whonix and sys-firewall.

Whonix GW&WS remain updatable.

A F38 standalone can install dnf5 and install applications with that through sys-firewall. So there must be a barrier in Qubes -pecific non-tor updating mechanisms.

4

The policy is in /etc/qubes/policy.d/90-default.policy (dom0)
Check the active rules (starting with qubes.UpdatesProxy) and edit them like you want them to be.

5

Yes, I tried editing these options and it still wasnt working.

Then I found a new AP and now dnf updates Dom0 and F38 through Qubes Updater. Must have been a network obstacle that can slow down dnf painfully.

Actually, I found that if I turned off Whonix, the dnf updates went faster.