TemplateVM updates via Qube Manager but NOT Qubes Update tool

User Support
,
1

I created a custom TemplateVM based on the fedora-37-minimal TemplateVM. The Qubes Update tool will indicate an update is available for this TemplateVM. Updating via the Qubes Update tool completes with a green checkmark, but the details reveal

fedora-37-minimal-new:
   [ERROR    ] JSON Render failed for:

       [ERROR    ]  Expecting value: line 1 column 1 (char 0)

However, if I right-click on this minimal TemplateVM in Qube Manager and select Update, the TemplateVM updates successfully.

I already searched for this error and for any qvm.template-x-y-z files in dom0, but didn’t see anything.

I’d like to understand how this works and to be able to update my Qubes from the Qubes Update tool. It does seem to be isolated to TemplateVMs cloned from the default minimal templates.

What am I missing?

1 Like
2

Are you able to update other qubes based on fedora-37-minimal or original fedora-37-minimal template?
Are you using Qubes OS 4.1 or Qubes OS 4.2?

1 Like
3

@apparatus

Great questions. I don’t have any Qubes based on the default fedora-37-minimal TemplateVM. I am running Qubes 4.1.2.

Just to isolate variables, I cloned the debian-12-minimal TemplateVM as debian-12-minimal-clone-1 and forced an update of both via the Qubes Update tool. Both updated successfully. Repeated this test with fedora-37-minimal with the same actually successful result.

I then cloned the clone to see if, perhaps, the issue was related to derivative TemplateVMs, but these clones of clones also updated successfully.

I inspected the changes I made to the minimal TemplateVMs that I could not get to update via the Qubes Update tool and applied them one at a time. I could not isolate the change.

At this point, I am going to rename the problematic minimal TemplateVM and attempt to recreate it until it breaks UNLESS there is some component of the Qubes Update tool that treats TemplateVMs that have known-updates differently than when I uncheck Enable updates for qubes without known available updates to force the update.

1 Like
4

I don’t think that this option makes any difference.

1 Like
5

Speaking of not making a difference, I systematically went through each change to see where things break.

  • Tested triggering updates via Qubes Update on fedora-37-minimal Success
  • Cloned fedora-37-minimal and tested triggering updates for this cloned TemplateVM via Qubes Update Success
  • Installed web-related packages via dnf install qubes-core-agent-networking firefox chromium qubes-app-shutdown-idle qubes-usb-proxy pulseaudio-qubes qubes-audio-daemon -y, launched an AppVM based on this TemplateVM to make sure it works,then tested triggering updates via Qubes Update FAILED with the JSON Render error above.
  • Cloned fedora-37-minimal again to install web-related packages one-at-a-time and tested triggering updates via Qubes Update Success
    • I noticed there seemed to be a conflict between pulseaudio-qubes and qubes-audio-daemon. It didn’t seem to matter if I installed them with the --allowerasing or --skip-broken flags–either option resulted in an Qubes Updates-updatable TemplateVM.
  • Cloned fedora-37-minimal again to install them all at the same time again and tested triggering updates via Qubes Update Success
    • Even launched an AppVM based on this TemplateVM and re-tested triggering updates via Qubes Update Success

At this point, it just feels like witchcraft. However, I suspect that once the Qubes Update tool detects an update for this TemplateVM, the JSON error will return.

1 Like
6

Try running dnf update manually for a failing template, maybe there will be some relevant info in command output.

1 Like
7

Running dnf update manually always works. No errors or non-standard output. I think this is what gets run when updates are triggered via Qube Manager.

Speaking of which, the cloned fedora-37-minimal VM that updated via the Qubes Update tool yesterday is now throwing the JSON Render failed error.

What in the update process uses JSON? What is the difference between updating via the Qubes Update tool and Qube Manager?

8

Try using newer fedora template, fedora-39 is a stable one currently:

9

I tried upgrading to Qubes 4.2 to see if it was something more QubesOS related.

Interestingly, when I try to update the fedora-37-minimal Qube from the menu bar it (still) fails, but when I right-click a TemplateVM in the [Dom0] Qube Manager and select Update, it launches an identical-looking [Dom0] Qubes OS Update window that successfully updates.

I was discouraged when it looked like the Qube Manager launches the same failing update mechanism, but now I’m just confused.

I’ll try moving everything to fedora-39 next. Though I would still like to know what in the update process uses JSON. And why the Qubes OS Update mechanism would behave differently based on where it is called (menu bar vs. Qube Manager).

10

Interestingly, if I run the update via the [Dom0] Qube Manager two more times, it’ll go through.

I’d still like to know what in the update process uses JSON. And why the Qubes OS Update mechanism would behave differently based on where it is called (menu bar vs. Qube Manager). Does anyone have any documentation I could review?

11

Any kind of update launched from the Qube Manager should be opening the exact same Qubes Update tool as the one from the app menu and the Notification Area. If that’s not happening, then please leave a comment on this issue explaining the problem so that it can be reopened and the problem fixed:

12

I think the update launching location was a red herring.

It appears that the update will work if I kick off another update via the [Dom0] Qube Manager before my TemplateVM automatically shuts down. The update seems to fail when the [Dom0] Qube Manager automatically starts the TemplateVM. It seems like a timing issue. If I start the TemplateVM that needs to be updated BEFORE updating it through [Dom0] Qube Manager it works.

Is it possible to configure a longer delay for updates OR to get some indication as to what in the update process uses JSON files?