Updates / Updater fail(s)

User Support
1

Hi all,

Recently all Updates fail when using the Updater (debian11, fedora34, whonix16). Any idea how I can remediate it for each OS?

Log:

Updating debian-11

Error on updating debian-11: Command ‘[‘sudo’, ‘qubesctl’, ‘–skip-dom0’, ‘–targets=debian-11’, ‘–show-output’, ‘state.sls’, ‘update.qubes-vm’]’ returned non-zero exit status 20
debian-11:

        ID: update
  Function: pkg.uptodate
    Result: False
   Comment: Problem encountered upgrading packages. Additional info follows:
            
            result:
                ----------
                pid:
                    1213
                retcode:
                    100
                stderr:
                    Running scope as unit: run-r270790599f5d43baa3e9d3c7c02ffbfd.scope
                    E: Failed to fetch https://deb.debian.org/debian/pool/main/l/linux/linux-headers-5.10.0-13-common_5.10.106-1_all.deb  Invalid response from proxy: HTTP/1.0 500 Unable to connect  Server: tinyproxy/1.10.0  Content-Type: text/html  Connection: close     [IP: 127.0.0.1 8082]
                    E: Failed to fetch https://deb.debian.org/debian/pool/main/l/linux/linux-kbuild-5.10_5.10.106-1_amd64.deb  Invalid response from proxy: HTTP/1.0 500 Unable to connect  Server: tinyproxy/1.10.0  Content-Type: text/html  Connection: close     [IP: 127.0.0.1 8082]
                    E: Failed to fetch https://deb.debian.org/debian/pool/main/l/linux/linux-headers-5.10.0-13-amd64_5.10.106-1_amd64.deb  Invalid response from proxy: HTTP/1.0 500 Unable to connect  Server: tinyproxy/1.10.0  Content-Type: text/html  Connection: close     [IP: 127.0.0.1 8082]
                    E: Failed to fetch https://deb.debian.org/debian/pool/main/l/linux-signed-amd64/linux-headers-amd64_5.10.106-1_amd64.deb  Invalid response from proxy: HTTP/1.0 500 Unable to connect  Server: tinyproxy/1.10.0  Content-Type: text/html  Connection: close     [IP: 127.0.0.1 8082]
                    E: Failed to fetch https://deb.debian.org/debian/pool/main/l/linux-signed-amd64/linux-image-5.10.0-13-amd64_5.10.106-1_amd64.deb  Invalid response from proxy: HTTP/1.0 500 Unable to connect  Server: tinyproxy/1.10.0  Content-Type: text/html  Connection: close     [IP: 127.0.0.1 8082]
                    E: Failed to fetch https://deb.debian.org/debian/pool/main/l/linux-signed-amd64/linux-image-amd64_5.10.106-1_amd64.deb  Invalid response from proxy: HTTP/1.0 500 Unable to connect  Server: tinyproxy/1.10.0  Content-Type: text/html  Connection: close     [IP: 127.0.0.1 8082]
                    E: Failed to fetch https://deb.debian.org/debian/pool/main/g/glibc/locales-all_2.31-13%2bdeb11u3_amd64.deb  Invalid response from proxy: HTTP/1.0 500 Unable to connect  Server: tinyproxy/1.10.0  Content-Type: text/html  Connection: close     [IP: 127.0.0.1 8082]
                    E: Failed to fetch https://deb.debian.org/debian/pool/main/o/openssl/openssl_1.1.1n-0%2bdeb11u1_amd64.deb  Invalid response from proxy: HTTP/1.0 500 Unable to connect  Server: tinyproxy/1.10.0  Content-Type: text/html  Connection: close     [IP: 127.0.0.1 8082]
                    E: Failed to fetch https://deb.debian.org/debian/pool/main/u/usb.ids/usb.ids_2022.02.15-0%2bdeb11u1_all.deb  Invalid response from proxy: HTTP/1.0 500 Unable to connect  Server: tinyproxy/1.10.0  Content-Type: text/html  Connection: close     [IP: 127.0.0.1 8082]
                    E: Failed to fetch https://deb.debian.org/debian/pool/main/x/xserver-xorg-video-intel/xserver-xorg-video-intel_2.99.917%2bgit20200714-1%2bdeb11u1_amd64.deb  Invalid response from proxy: HTTP/1.0 500 Unable to connect  Server: tinyproxy/1.10.0  Content-Type: text/html  Connection: close     [IP: 127.0.0.1 8082]
                    E: Failed to fetch https://deb.debian.org/debian/pool/main/x/xterm/xterm_366-1%2bdeb11u1_amd64.deb  Invalid response from proxy: HTTP/1.0 500 Unable to connect  Server: tinyproxy/1.10.0  Content-Type: text/html  Connection: close     [IP: 127.0.0.1 8082]
                    E: Unable to fetch some archives, maybe run apt-get update or try with --fix-missing?
                stdout:
                    Reading package lists...
                    Building dependency tree...
                    Reading state information...
                    Calculating upgrade...
                    The following packages were automatically installed and are no longer required:
                      linux-headers-5.10.0-10-amd64 linux-headers-5.10.0-10-common
                      linux-headers-5.10.0-8-amd64 linux-headers-5.10.0-8-common
                      linux-image-5.10.0-10-amd64 linux-image-5.10.0-8-amd64
                    Use 'apt autoremove' to remove them.
                    The following NEW packages will be installed:
                      linux-headers-5.10.0-13-amd64 linux-headers-5.10.0-13-common
                      linux-image-5.10.0-13-amd64
                    The following packages will be upgraded:
                      base-files brave-browser chromium chromium-common chromium-sandbox
                      cups-browsed cups-filters cups-filters-core-drivers dirmngr gir1.2-gtk-3.0
                      gnupg gnupg-l10n gnupg-utils gnupg2 gpg gpg-agent gpg-wks-client
                      gpg-wks-server gpgconf gpgsm gpgv gtk-update-icon-cache intel-microcode
                      libarchive13 libc-bin libc-dev-bin libc-devtools libc-l10n libc6 libc6-dev
                      libcupsfilters1 libflac8 libfontembed1 libgtk-3-0 libgtk-3-bin
                      libgtk-3-common liblog4j1.2-java libmariadb3 libnss-systemd libpam-systemd
                      libssl1.1 libsystemd0 libudev1 libxml2 linux-compiler-gcc-10-x86
                      linux-headers-amd64 linux-image-amd64 linux-kbuild-5.10 linux-libc-dev
                      locales locales-all mariadb-common openssl systemd systemd-sysv
                      systemd-timesyncd sysvinit-utils tasksel tasksel-data udev usb.ids
                      xserver-xorg-video-intel xterm
                    63 upgraded, 3 newly installed, 0 to remove and 0 not upgraded.
                    Need to get 78.8 MB/281 MB of archives.
                    After this operation, 360 MB of additional disk space will be used.
                    Err:1 https://deb.debian.org/debian bullseye/main amd64 linux-headers-5.10.0-13-common all 5.10.106-1
                      Invalid response from proxy: HTTP/1.0 500 Unable to connect  Server: tinyproxy/1.10.0  Content-Type: text/html  Connection: close     [IP: 127.0.0.1 8082]
                    Err:2 https://deb.debian.org/debian bullseye/main amd64 linux-kbuild-5.10 amd64 5.10.106-1
                      Invalid response from proxy: HTTP/1.0 500 Unable to connect  Server: tinyproxy/1.10.0  Content-Type: text/html  Connection: close     [IP: 127.0.0.1 8082]
                    Err:3 https://deb.debian.org/debian bullseye/main amd64 linux-headers-5.10.0-13-amd64 amd64 5.10.106-1
                      Invalid response from proxy: HTTP/1.0 500 Unable to connect  Server: tinyproxy/1.10.0  Content-Type: text/html  Connection: close     [IP: 127.0.0.1 8082]
                    Err:4 https://deb.debian.org/debian bullseye/main amd64 linux-headers-amd64 amd64 5.10.106-1
                      Invalid response from proxy: HTTP/1.0 500 Unable to connect  Server: tinyproxy/1.10.0  Content-Type: text/html  Connection: close     [IP: 127.0.0.1 8082]
                    Err:5 https://deb.debian.org/debian bullseye/main amd64 linux-image-5.10.0-13-amd64 amd64 5.10.106-1
                      Invalid response from proxy: HTTP/1.0 500 Unable to connect  Server: tinyproxy/1.10.0  Content-Type: text/html  Connection: close     [IP: 127.0.0.1 8082]
                    Err:6 https://deb.debian.org/debian bullseye/main amd64 linux-image-amd64 amd64 5.10.106-1
                      Invalid response from proxy: HTTP/1.0 500 Unable to connect  Server: tinyproxy/1.10.0  Content-Type: text/html  Connection: close     [IP: 127.0.0.1 8082]
                    Err:7 https://deb.debian.org/debian bullseye/main amd64 locales-all amd64 2.31-13+deb11u3
                      Invalid response from proxy: HTTP/1.0 500 Unable to connect  Server: tinyproxy/1.10.0  Content-Type: text/html  Connection: close     [IP: 127.0.0.1 8082]
                    Err:8 https://deb.debian.org/debian bullseye/main amd64 openssl amd64 1.1.1n-0+deb11u1
                      Invalid response from proxy: HTTP/1.0 500 Unable to connect  Server: tinyproxy/1.10.0  Content-Type: text/html  Connection: close     [IP: 127.0.0.1 8082]
                    Err:9 https://deb.debian.org/debian bullseye/main amd64 usb.ids all 2022.02.15-0+deb11u1
                      Invalid response from proxy: HTTP/1.0 500 Unable to connect  Server: tinyproxy/1.10.0  Content-Type: text/html  Connection: close     [IP: 127.0.0.1 8082]
                    Err:10 https://deb.debian.org/debian bullseye/main amd64 xserver-xorg-video-intel amd64 2:2.99.917+git20200714-1+deb11u1
                      Invalid response from proxy: HTTP/1.0 500 Unable to connect  Server: tinyproxy/1.10.0  Content-Type: text/html  Connection: close     [IP: 127.0.0.1 8082]
                    Err:11 https://deb.debian.org/debian bullseye/main amd64 xterm amd64 366-1+deb11u1
                      Invalid response from proxy: HTTP/1.0 500 Unable to connect  Server: tinyproxy/1.10.0  Content-Type: text/html  Connection: close     [IP: 127.0.0.1 8082]
   Started: 13:06:48.806518
  Duration: 157312.082 ms
   Changes:   

        ID: notify-updates
  Function: cmd.run
      Name: /usr/lib/qubes/upgrades-status-notify
    Result: True
   Comment: Command "/usr/lib/qubes/upgrades-status-notify" run
   Started: 13:09:26.138595
  Duration: 23538.86 ms
   Changes:   
            ----------
            pid:
                1252
            retcode:
                0
            stderr:
            stdout:

Summary for debian-11

Succeeded: 1 (changed=1)
Failed: 1

Total states run: 2
Total run time: 180.851 s

Updating fedora-34

Error on updating fedora-34: Command ‘[‘sudo’, ‘qubesctl’, ‘–skip-dom0’, ‘–targets=fedora-34’, ‘–show-output’, ‘state.sls’, ‘update.qubes-vm’]’ returned non-zero exit status 20
fedora-34:

        ID: dnf-and-rpm
  Function: pkg.installed
    Result: True
   Comment: All specified packages are already installed and are at the desired version
   Started: 13:10:46.561353
  Duration: 4664.788 ms
   Changes:   

        ID: /usr/lib/rpm/macros.d/macros.qubes
  Function: file.absent
    Result: True
   Comment: File /usr/lib/rpm/macros.d/macros.qubes is not present
   Started: 13:10:51.231757
  Duration: 0.77 ms
   Changes:   

        ID: dnf-makecache
  Function: cmd.script
    Result: False
   Comment: Could not create DNF metadata cache
   Started: 13:10:51.234143
  Duration: 124455.032 ms
   Changes:   

        ID: update
  Function: pkg.uptodate
    Result: False
   Comment: One or more requisite failed: update.qubes-vm.dnf-makecache
   Started: 13:12:55.691464
  Duration: 0.02 ms
   Changes:   

        ID: notify-updates
  Function: cmd.run
      Name: /usr/lib/qubes/upgrades-status-notify
    Result: False
   Comment: Command "/usr/lib/qubes/upgrades-status-notify" run
   Started: 13:12:55.691711
  Duration: 125554.592 ms
   Changes:   
            ----------
            pid:
                1136
            retcode:
                1
            stderr:
                Error: Failed to download metadata for repo 'fedora': Cannot prepare internal mirrorlist: Curl error (56): Failure when receiving data from the peer for https://mirrors.fedoraproject.org/metalink?repo=fedora-34&arch=x86_64 [Received HTTP code 500 from proxy after CONNECT]
            stdout:

Summary for fedora-34

Succeeded: 2 (changed=1)
Failed: 3

Total states run: 5
Total run time: 254.675 s

Updating whonix-gw-16

Error on updating whonix-gw-16: Command ‘[‘sudo’, ‘qubesctl’, ‘–skip-dom0’, ‘–targets=whonix-gw-16’, ‘–show-output’, ‘state.sls’, ‘update.qubes-vm’]’ returned non-zero exit status 20
whonix-gw-16:

        ID: update
  Function: pkg.uptodate
    Result: False
   Comment: E: Failed to fetch tor+https://deb.debian.org/debian/dists/bullseye/InRelease  Invalid response from proxy: HTTP/1.0 500 Unable to connect  Server: tinyproxy/1.10.0  Content-Type: text/html  Connection: close     [IP: 127.0.0.1 8082]
            E: Failed to fetch tor+https://deb.debian.org/debian/dists/bullseye-updates/InRelease  Invalid response from proxy: HTTP/1.0 500 Unable to connect  Server: tinyproxy/1.10.0  Content-Type: text/html  Connection: close     [IP: 127.0.0.1 8082]
            E: Failed to fetch tor+https://deb.debian.org/debian-security/dists/bullseye-security/InRelease  Invalid response from proxy: HTTP/1.0 500 Unable to connect  Server: tinyproxy/1.10.0  Content-Type: text/html  Connection: close     [IP: 127.0.0.1 8082]
            E: Failed to fetch tor+https://deb.debian.org/debian/dists/bullseye-backports/InRelease  Invalid response from proxy: HTTP/1.0 500 Unable to connect  Server: tinyproxy/1.10.0  Content-Type: text/html  Connection: close     [IP: 127.0.0.1 8082]
            E: Failed to fetch tor+https://fasttrack.debian.net/debian/dists/bullseye-fasttrack/InRelease  Invalid response from proxy: HTTP/1.0 500 Unable to connect  Server: tinyproxy/1.10.0  Content-Type: text/html  Connection: close     [IP: 127.0.0.1 8082]
            E: Failed to fetch tor+https://deb.whonix.org/dists/bullseye/InRelease  Invalid response from proxy: HTTP/1.0 500 Unable to connect  Server: tinyproxy/1.10.0  Content-Type: text/html  Connection: close     [IP: 127.0.0.1 8082]
            E: Failed to fetch https://deb.qubes-os.org/r4.0/vm/dists/bullseye/InRelease  Invalid response from proxy: HTTP/1.0 500 Unable to connect  Server: tinyproxy/1.10.0  Content-Type: text/html  Connection: close     [IP: 127.0.0.1 8082]
            E: Some index files failed to download. They have been ignored, or old ones used instead.
   Started: 11:14:21.495490
  Duration: 164365.055 ms
   Changes:   

        ID: notify-updates
  Function: cmd.run
      Name: /usr/lib/qubes/upgrades-status-notify
    Result: False
   Comment: Command "/usr/lib/qubes/upgrades-status-notify" run
   Started: 11:17:05.907389
  Duration: 164227.464 ms
   Changes:   
            ----------
            pid:
                1262
            retcode:
                100
            stderr:
            stdout:

Summary for whonix-gw-16

Succeeded: 0 (changed=1)
Failed: 2

Total states run: 2
Total run time: 328.593 s

Updating whonix-ws-16

Error on updating whonix-ws-16: Command ‘[‘sudo’, ‘qubesctl’, ‘–skip-dom0’, ‘–targets=whonix-ws-16’, ‘–show-output’, ‘state.sls’, ‘update.qubes-vm’]’ returned non-zero exit status 20
whonix-ws-16:

        ID: update
  Function: pkg.uptodate
    Result: False
   Comment: E: Failed to fetch tor+https://deb.debian.org/debian/dists/bullseye/InRelease  Invalid response from proxy: HTTP/1.0 500 Unable to connect  Server: tinyproxy/1.10.0  Content-Type: text/html  Connection: close     [IP: 127.0.0.1 8082]
            E: Failed to fetch tor+https://deb.debian.org/debian/dists/bullseye-updates/InRelease  Invalid response from proxy: HTTP/1.0 500 Unable to connect  Server: tinyproxy/1.10.0  Content-Type: text/html  Connection: close     [IP: 127.0.0.1 8082]
            E: Failed to fetch tor+https://deb.debian.org/debian-security/dists/bullseye-security/InRelease  Invalid response from proxy: HTTP/1.0 500 Unable to connect  Server: tinyproxy/1.10.0  Content-Type: text/html  Connection: close     [IP: 127.0.0.1 8082]
            E: Failed to fetch tor+https://deb.debian.org/debian/dists/bullseye-backports/InRelease  Invalid response from proxy: HTTP/1.0 500 Unable to connect  Server: tinyproxy/1.10.0  Content-Type: text/html  Connection: close     [IP: 127.0.0.1 8082]
            E: Failed to fetch tor+https://fasttrack.debian.net/debian/dists/bullseye-fasttrack/InRelease  Invalid response from proxy: HTTP/1.0 500 Unable to connect  Server: tinyproxy/1.10.0  Content-Type: text/html  Connection: close     [IP: 127.0.0.1 8082]
            E: Failed to fetch tor+https://deb.whonix.org/dists/bullseye/InRelease  Invalid response from proxy: HTTP/1.0 500 Unable to connect  Server: tinyproxy/1.10.0  Content-Type: text/html  Connection: close     [IP: 127.0.0.1 8082]
            E: Failed to fetch https://deb.qubes-os.org/r4.0/vm/dists/bullseye/InRelease  Invalid response from proxy: HTTP/1.0 500 Unable to connect  Server: tinyproxy/1.10.0  Content-Type: text/html  Connection: close     [IP: 127.0.0.1 8082]
            E: Some index files failed to download. They have been ignored, or old ones used instead.
   Started: 11:24:45.391081
  Duration: 164518.341 ms
   Changes:   

        ID: notify-updates
  Function: cmd.run
      Name: /usr/lib/qubes/upgrades-status-notify
    Result: False
   Comment: Command "/usr/lib/qubes/upgrades-status-notify" run
   Started: 11:27:29.913416
  Duration: 164361.262 ms
   Changes:   
            ----------
            pid:
                1534
            retcode:
                100
            stderr:
            stdout:

Summary for whonix-ws-16

Succeeded: 0 (changed=1)
Failed: 2

Total states run: 2
Total run time: 328.880 s

2

Please, could you check if it’s a name resolving issue with your update-vm?

If yes, is your update-vm is a fedora VM with systemd-resolved >= 249
?

If yes, then read #7429.

3

Hello my friend,
Since I may not know how to check properly, could you be so kind and instruct in more detail?
#7429 seems next level to me too :smiley:
Thank you very much!

4

Error 500 is genereal error not telling us anything more specific as far as I know.
I have experienced this yesterday too both in fedora and debian qubes, and I was unlucky to face it while setting app qubes (not dom0 and templates) updating over apt-cacher-ng over qrexec. Cacher qube is debian based, chained to sys-whonix->sys-firewall->sys-net (the latter two, fedora 35 disposables). Update was working, then it didn’t, then I;d changed something then it worked. Then it didn’t and so on. I thought something was wrong with the way I configured it, until the issue actually resolved itself.

Do you still experience it?

If you do, just follow Ludovic’s post and/or the next one.

5

Hoi,
Still experiencing the same issues.
Within Ludovic’s post, is the following the steps to take within the templates to shortcut the problem?

sudo systemctl stop systemd-resolved
sudo systemctl disable systemd-resolved
sudo rm /etc/resolv.conf
sudo touch /etc/resolv.conf

I just tried it on the Debian template, changed nothing.
Don t know what to do really.

6

You have to read carefully, word by word. Everything is there and here in @ludovic’s post, where, how, so indeed no additional explanation is needed.

7

I have the same issue on a debian template.
Please explain what is so obvious to you in that post.
The only debian reference in that post is (No DNS in inheriting VMs after enabling fedora-35 template's fedora-updates-testing repo and updating · Issue #7429 · QubesOS/qubes-issues · GitHub). To make it work one have to have a working “apt update”.
I don’t understand the necessary steps to apply the workaround.

8

I don’t understand.
Ludovic thoroughly explained what he did and how he tested in which VMs. If not sure look for [user…] entries, and repeat the process. He was also specific: if your update-vm is fedora based! You didn’t do that. So please try to repeat what he suggested in his post here then if it turns out that it is so, then repeat what he did there and write all it here. It’s not immediatelly about what the other user did after him. You all quote crat0z but not ludovics post?
For example

What does this mean? It doesn’t matter in which template, but on which template your netVM is based and that is absolutely not clear from your statement what did you mean by this.
Out of fedora based netVM, no one experienced such problems as I am aware.

9

For me it’s not clear in wich vm I need to execute these commands.
sys-net, sys-firewall, all template vms?

10

The Qubes update process allows templates (which are, by default, not
attached to a network) to use a proxy for updates. Access to the proxy
is via qrexec.
You can read the details here

You need to check which qube you are using as the UpdateVM: by
default this will be sys-net.
Check to see what template that qube is using.
If it is Fedora based, apply those commands.