Update issue with Qubes 4.1, apt-cacher, Debian 12 (bookworm)

User Support
1

I have broken my apt-cacher Qubes updates:
I did an upgraded from Debian 11 to Debian 12 (minimal) template (still on Qubes 4.1; using iptables (not Apt-cacher-ng and debian-12 testing - #23 by apparatus) ).

For debugging, I did:

  1. a fresh apt-cacher appVM (based on Debian 12 minimal)
  2. a fresh debian-12-minimal clone deb-12-m-tvm
  3. (in deb-12-m-tvm) replaced all https:// with http://HTTPS///

Double checked apt-cacher systemctl:

user@apt-cacher:~$ systemctl status apt-cacher-ng
â apt-cacher-ng.service - Apt-Cacher NG software download proxy
     Loaded: loaded (/lib/systemd/system/apt-cacher-ng.service; enabled; preset: enabled)
     Active: active (running) since Wed 2024-01-03 17:41:01 CET; 1h 17min ago
   Main PID: 581 (apt-cacher-ng)
      Tasks: 2 (limit: 374)
     Memory: 3.6M
        CPU: 22ms
     CGroup: /system.slice/apt-cacher-ng.service
             ââ581 /usr/sbin/apt-cacher-ng -c /etc/apt-cacher-ng ForeGround=1

Double checked dom0 policy: 20-user-apt-cacher.policy:

qubes.UpdatesProxy * @type:TemplateVM @default allow target=apt-cacher

Double checked deb-12-m-tvm : /etc/apt/sources.list

root@deb-12-m-tvm:~# cat /etc/apt/sources.list
deb http://HTTPS///deb.debian.org/debian bookworm main contrib non-free-firmware
#deb-src http://HTTPS///deb.debian.org/debian bookworm main contrib non-free-firmware

deb http://HTTPS///deb.debian.org/debian-security bookworm-security main contrib non-free-firmware
#deb-src http://HTTPS///deb.debian.org/debian-security bookworm-security main contrib non-free-firmware

root@deb-12-m-tvm:~#

Updating my newly created template deb-12-m-tvm.

root@deb-12-m-tvm:~# apt update
Err:1 http://HTTPS///deb.debian.org/debian bookworm InRelease
  403  Configuration error (confusing proxy mode) or prohibited port (see AllowUserPorts) [IP: 127.0.0.1 8082]
Err:2 http://HTTPS///deb.debian.org/debian-security bookworm-security InRelease
  403  Configuration error (confusing proxy mode) or prohibited port (see AllowUserPorts) [IP: 127.0.0.1 8082]
Err:3 http://HTTPS///deb.qubes-os.org/r4.1/vm bookworm InRelease
  403  Configuration error (confusing proxy mode) or prohibited port (see AllowUserPorts) [IP: 127.0.0.1 8082]
Reading package lists... Done
N: See apt-secure(8) manpage for repository creation and user configuration details.
N: Updating from such a repository can't be done securely, and is therefore disabled by default.
E: The repository 'http://HTTPS///deb.debian.org/debian bookworm InRelease' is no longer signed.
E: Failed to fetch http://HTTPS///deb.debian.org/debian/dists/bookworm/InRelease  403  Configuration error (confusing proxy mode) or prohibited port (see AllowUserPorts) [IP: 127.0.0.1 8082]
E: Failed to fetch http://HTTPS///deb.debian.org/debian-security/dists/bookworm-security/InRelease  403  Configuration error (confusing proxy mode) or prohibited port (see AllowUserPorts) [IP: 127.0.0.1 8082]
E: The repository 'http://HTTPS///deb.debian.org/debian-security bookworm-security InRelease' is no longer signed.
N: Updating from such a repository can't be done securely, and is therefore disabled by default.
N: See apt-secure(8) manpage for repository creation and user configuration details.
E: Failed to fetch http://HTTPS///deb.qubes-os.org/r4.1/vm/dists/bookworm/InRelease  403  Configuration error (confusing proxy mode) or prohibited port (see AllowUserPorts) [IP: 127.0.0.1 8082]
E: The repository 'http://HTTPS///deb.qubes-os.org/r4.1/vm bookworm InRelease' is no longer signed.
N: Updating from such a repository can't be done securely, and is therefore disabled by default.
N: See apt-secure(8) manpage for repository creation and user configuration details.
root@deb-12-m-tvm:~#

Any suggestions?

2

Did you configure this?

1 Like
3

Hereafter, for the log:

Modify acng.conf in your apt-cacher appVM

sudo nano /etc/apt-cacher-ng/acng.conf

ctrl+w : AllowUserPorts
(uncommend line and add 443):

AllowUserPorts: 80 443

Restart apt-cacher appVM