SaltStack and template management: discrepanies between `update.qubes-vm` and in-(Fedora)template `dnf update`?

[balin1]

Hello,

I’m managing my setup using salt and recentlly became aware that the salt setup appears blind to available updates in my fedora-42 template. Independently of whether I am using the QubesOS/distributed update.qubes-vm or include a *.sls file containing

uptodate:
  pkg.uptodate:
    - refresh:      True
    {% if grains.os_family != 'RedHat' %}
    - dist_upgrade: True
    {% endif %}

any qubesctl-mediated action reports that no packages are available for update. If I, however, start the template manually and runsudo dnf update on the console I get hundreds of available upgrades.

I have investigated the corresponding policy files and everything points at sys-whonix as the update VM.

debian-based templates appear to be up to date indeed.

Any pointers on how to figure out what is going on here?

Thanks for your consideration.

Joh

[unman]

Any pointers on how to figure out what is going on here?

Some quick thoughts:

Run the command with --show-output
Change updateVM to sys-firewall, and repeat.

Use standard Qubes salt debugging as here

I never presume to speak for the Qubes team. When I comment in the Forum I speak for myself.

[balin1]

Thank you.
First feedback: changing updateVM to sys-firewall didn’t fix this. But I now see an error Could not create DNF metadata cache - this error does NOT shop up when using sys-whonix.

I looked around and found an old post of yours here:

Updates cache options?

OK. I played with the Fedora templates more and finally got this working. This will work in Debian templates, but not Fedora. In the Fedora templates I go to /etc/yum.repos.d/ and edit all of the *.repo files. Uncomment #baseurl=http://download.example/... and replace that with something like baseurl=http://HTTPS///download.fedoraproject.org/ Comment out #metalink=https://mirrors.fedoraproject.org/... I don’t know it this is overkill, but in the .repo files where there was a baseurl alread…

Changing the repo lines for fedora to http://HTTPS/// did not seem to fix it either.

On to salt debugging.

[balin1]

After manually updating the corresponding fedora templates (using dnf update && dnf clean all) all went back to normal - packages I can see as updatable from within the template system are being updated via salt as well.

In brief: I have no idea what happened here. Very unsatisfying. There were approx. 700 packages updated manually and I am at a loss on how to pinpoit potential culprits.