Qubes 3.0-rc3 has been released

1,018 views
Skip to first unread message

Marek Marczykowski-Górecki

unread,
Sep 16, 2015, 10:25:19 AM9/16/15
to qubes-users
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

Hello,

We're releasing today the 3rd release candidate for Qubes 3.0 branch,
Qubes 3.0-rc3.

You can get the new ISO from:

https://www.qubes-os.org/doc/QubesDownloads/

If you've already installed Qubes 3.0 rc1 or rc2, no need to reinstall,
just update the system (both dom0 and templates) using standard
procedure.

As already explained in the previous announcement, for the Qubes 3
branch and onwards, we have adopted a new versioning scheme that is
discussed in more detail here:
http://www.qubes-os.org/doc/VersionScheme/

Recently we've also introduced release schedule to that scheme. This is
mainly to speed up release process, have some rules when the release is
ready. Without such rules our release process is rather lengthly and
have negative effects for both users (months to wait for cool new
features) and developers ("stable" and "development" versions
divergence).

The new scheme means that we publish release candidates about 5 weeks
after the previous one. Two weeks after such release we will decide
whether it is good enough to be considered the final release. "Good
enough" means that there is no critical bugs found. Even if some bugs
are found there, we may decide to release final version anyway and later
release fixes as updates. Otherwise we would never be able to release
anything...

According to that scheme, we've already established release schedule for
R3.0:
https://www.qubes-os.org/doc/releases/3.0/schedule/
According to that schedule:
1. current-testing repository was frozen for about a week before 3.0 rc3
release (last package went in on September 4)
2. we are releasing 3.0 rc3 about 5 weeks after previous release
candidate (actually 6 weeks...)

All that means that if no critical bugs will be discovered, the final
R3.0 will be released in two weeks.

- --
Best Regards,
Marek Marczykowski-Górecki
Invisible Things Lab
A: Because it messes up the order in which people normally read text.
Q: Why is top-posting such a bad thing?
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1

iQEcBAEBCAAGBQJV+XvIAAoJENuP0xzK19cs74cIAINnxzImV6/GDY3qcrw9S1ZO
CMfDvy0CnISW2ZjQDEUVgLCRLImaNmzjfYz6Kui1I4zVXsBFJI0cQyJA3ibESGK0
/AozXt4TysZ3nAwhP9FCRfTj76UXBX7YhrdVJ2ESS+uomzSUzUPKENZnh+2lk/mR
YEgcewklbIk7CW6twYRrBVlqVQ64rOe5T6z4C4+EHB4f5cErdZsQXADLUGfNs2Yl
V1QLlj0vgo4hg0A8HqKuMDy+cE36McPSsiPBNEh5MlYOACm0oEw/7a4SO2DzJJIN
CWmfNXyhNEr1xyxWdVmKsZ2n/yKjtHtIG8JG4ffPoGtSh6gQG6X90R52tnyZPh0=
=KqIA
-----END PGP SIGNATURE-----

J.M. Porup

unread,
Sep 18, 2015, 9:45:08 AM9/18/15
to Marek Marczykowski-Górecki, qubes...@googlegroups.com
On Wed, Sep 16, 2015 at 04:25:12PM +0200, Marek Marczykowski-Górecki wrote:
> Hello,
>
> We're releasing today the 3rd release candidate for Qubes 3.0 branch,
> Qubes 3.0-rc3.
>
> You can get the new ISO from:
>
> https://www.qubes-os.org/doc/QubesDownloads/
>
> If you've already installed Qubes 3.0 rc1 or rc2, no need to reinstall,
> just update the system (both dom0 and templates) using standard
> procedure.

Using a firewallvm based on an updated Debian 8 template as the dom0
update vm causes qubes-dom0-update to fail with bunches of "Permission
denied" errors. Switching template to Fedora 21 allows the update to
proceed.

Is it possible the Debian 8 template is missing some qubes integration
packages?

JMP


raah...@gmail.com

unread,
Sep 18, 2015, 1:01:30 PM9/18/15
to qubes-users, marm...@invisiblethingslab.com
I had the same problem when trying use a debian8 netvm and firewallvm and setting them to dom0.

turak...@gmail.com

unread,
Sep 18, 2015, 1:27:04 PM9/18/15
to qubes-users
>
> All that means that if no critical bugs will be discovered, the final
> R3.0 will be released in two weeks.
>

With "qubes-gui-vm-3.0.10-1.fc21.x86_64.rpm" from testing repo everything works fine, but with "qubes-gui-vm-3.0.11-1.fc21.x86_64.rpm" from current:

- ~/.config/autostart/*.desktop does not working, nothing happens on VM startup
- Zoiper voip client gives Segfault and dumps

That's why I downgraded to "qubes-gui-vm-3.0.10-1.fc21.x86_64.rpm".

Anita

Marek Marczykowski-Górecki

unread,
Sep 18, 2015, 3:27:22 PM9/18/15
to turak...@gmail.com, qubes-users
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

On Fri, Sep 18, 2015 at 10:27:04AM -0700, turak...@gmail.com wrote:
> >
> > All that means that if no critical bugs will be discovered, the final
> > R3.0 will be released in two weeks.
> >
>
> With "qubes-gui-vm-3.0.10-1.fc21.x86_64.rpm" from testing repo everything works fine, but with "qubes-gui-vm-3.0.11-1.fc21.x86_64.rpm" from current:
>
> - ~/.config/autostart/*.desktop does not working, nothing happens on VM startup

Can you give some example file? Maybe you have some entry like
"ShowOnlyIn=GNOME;" there - so something not meant to be started on
Qubes. Recently we've fixed support for such options.

> - Zoiper voip client gives Segfault and dumps

Does downgrading qubes-gui-vm fixed that? This can be related to some
autostart service missing, but if not, it would be good idea to check
what is exactly wrong there.

> That's why I downgraded to "qubes-gui-vm-3.0.10-1.fc21.x86_64.rpm".

What version of qubes-core-vm do you have? Also the newest one?

- --
Best Regards,
Marek Marczykowski-Górecki
Invisible Things Lab
A: Because it messes up the order in which people normally read text.
Q: Why is top-posting such a bad thing?
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1

iQEcBAEBCAAGBQJV/GWTAAoJENuP0xzK19csYGkH/jdxwBuwJ9F5K9C0TqeohK9r
EPAGmyHUQ+oOMnnkPDIu5AY0xxZSkQoYvl5ZDYO6QDApb1nZRnpluz4RGazmLzhg
O+Y0yZuPnmLzPZE325eitUqHFR+kY9bI4Ko/JKEXAHhZ1uV7jrdzb7mZtYb2G7wJ
KTey3W0mo0kouFHmLiRFk/DxnKzk6r+TzU6572sDKmN2/eilCNzv5UFFGGrFeC0u
qoiZ0/OuU5fKKbL0Kvkg8T4cTeiOW9jc3o0Bkx82oS42fCLnGBCaXxQct3vcn7HX
DnZay1MIBSBJPn2nQrNpBnCiSG8ZAoiPYj7S+SsQ/oafWZpHgf6RALdhbTJT8xU=
=DGoD
-----END PGP SIGNATURE-----

Marek Marczykowski-Górecki

unread,
Sep 18, 2015, 4:18:54 PM9/18/15
to J.M. Porup, qubes...@googlegroups.com
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

Strange, just tried on fully updated Debian 8 template and cannot
reproduce the problem. What version of qubes-core-agent do you have? It
should be 3.0.16-1+deb8u1.

- --
Best Regards,
Marek Marczykowski-Górecki
Invisible Things Lab
A: Because it messes up the order in which people normally read text.
Q: Why is top-posting such a bad thing?
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1

iQEcBAEBCAAGBQJV/HGmAAoJENuP0xzK19cspyQH/iW37v+To9p//Cjq2hY3Zzb0
SyyPLvG6qcbKAivRHBkMFNZhQXO4tBEhqIFrjREEnzgBxVCw64RSk76bAClZundd
QNn4WsRbcAfPvmmV8okXjhXBjoF5VzkZQcyHXG9JmooAlzRTLXpre0xi7prKRhNM
cLnBvs/8ZjyM2XDYEl1EhzPt1nbUSCC7X1Qr2BTdA/f0FMYHjTJjYUx7xVm62cty
J74acuExGzliPJIhViMWh9Fc1lJZ+Zcg7OLFgbQ8YvzaRUA39Sq8gsYCWD5VBA4B
MlUuPEGXhaHHYFbREnNARWDi5OCU0Anr1xJ8WW3/Z+SyF+GaMMHJK+eNMgCm394=
=5f3r
-----END PGP SIGNATURE-----

J.M. Porup

unread,
Sep 18, 2015, 4:37:56 PM9/18/15
to Marek Marczykowski-Górecki, qubes...@googlegroups.com
On Fri, Sep 18, 2015 at 10:18:46PM +0200, Marek Marczykowski-Górecki wrote:
> On Fri, Sep 18, 2015 at 09:45:02AM -0400, J.M. Porup wrote:
> > On Wed, Sep 16, 2015 at 04:25:12PM +0200, Marek Marczykowski-Górecki wrote:
> > > Hello,
> > >
> > > We're releasing today the 3rd release candidate for Qubes 3.0 branch,
> > > Qubes 3.0-rc3.
> > >
> > > You can get the new ISO from:
> > >
> > > https://www.qubes-os.org/doc/QubesDownloads/
> > >
> > > If you've already installed Qubes 3.0 rc1 or rc2, no need to reinstall,
> > > just update the system (both dom0 and templates) using standard
> > > procedure.
> >
> > Using a firewallvm based on an updated Debian 8 template as the dom0
> > update vm causes qubes-dom0-update to fail with bunches of "Permission
> > denied" errors. Switching template to Fedora 21 allows the update to
> > proceed.
> >
> > Is it possible the Debian 8 template is missing some qubes integration
> > packages?
>
> Strange, just tried on fully updated Debian 8 template and cannot
> reproduce the problem. What version of qubes-core-agent do you have? It
> should be 3.0.16-1+deb8u1.

My Debian 8 template is running qubes-core-agent 3.0.13-1+jessie1

running apt-get update && apt-get upgrade tells me that qubes-core-agent and
qubes-gui-agent have been kept back.

In my experience apt-get dist-upgrade can introduce instabilities when
running Debian testing, so as a matter of habit I usually stick to a
straight upgrade.

I suppose I'll just do a dist-upgrade for now, but is there a reason
that the two packages are being kept back?

JMP

Marek Marczykowski-Górecki

unread,
Sep 18, 2015, 4:53:17 PM9/18/15
to J.M. Porup, qubes...@googlegroups.com
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

apt-get upgrade do not install new packages. New qubes-core-agent has
introduced some dependencies - mistakenly missing in previous version
(for example python-xdg), so this is the reason.

- --
Best Regards,
Marek Marczykowski-Górecki
Invisible Things Lab
A: Because it messes up the order in which people normally read text.
Q: Why is top-posting such a bad thing?
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1

iQEcBAEBCAAGBQJV/Hm0AAoJENuP0xzK19csE8gH/0RZZlzZWghf62vTOt76LvgJ
24+TeV1VO09Ly2Npr0rwgypXF386+VijT7tikSwUxC9YyOYUh/OV3mjtMCRZvdaR
Ej4meHhi3/I84Oi5212XZHHPzM+M/LpPQdvo2kqTMFkSGJhQ2RW22R8aBnK/Z9q3
hW6OT5ywDkuaXLJzG3DiL6zlwbveg+JLIsh1RhmsyaHlM1LxekxOjCHd5oOEl6ZU
BcnR4s+JERr7cZsxLCHFuGVaS6+4MLPw9AJD2Jrd/OGSqxqC3cleGTToilooxcyY
13tmdoDWTscNj8c3wesPAhZSccFKBpNlCN5lsZlAxa1y+BoOcEKW5ESX0OVgCFw=
=py2F
-----END PGP SIGNATURE-----

Jeremias E.

unread,
Sep 18, 2015, 5:01:16 PM9/18/15
to qubes-users, marm...@invisiblethingslab.com


Am Freitag, 18. September 2015 22:37:56 UTC+2 schrieb jm:
On Fri, Sep 18, 2015 at 10:18:46PM +0200, Marek Marczykowski-Górecki wrote:
> On Fri, Sep 18, 2015 at 09:45:02AM -0400, J.M. Porup wrote:
> > On Wed, Sep 16, 2015 at 04:25:12PM +0200, Marek Marczykowski-Górecki wrote:
> > > Hello,
> > >
> > > We're releasing today the 3rd release candidate for Qubes 3.0 branch,
> > > Qubes 3.0-rc3.
> > >
> > > You can get the new ISO from:
> > >
> > > https://www.qubes-os.org/doc/QubesDownloads/
> > >
> > > If you've already installed Qubes 3.0 rc1 or rc2, no need to reinstall,
> > > just update the system (both dom0 and templates) using standard
> > > procedure.
> >
> > Using a firewallvm based on an updated Debian 8 template as the dom0
> > update vm causes qubes-dom0-update to fail with bunches of "Permission
> > denied" errors. Switching template to Fedora 21 allows the update to
> > proceed.
> >
> > Is it possible the Debian 8 template is missing some qubes integration
> > packages?
>
> Strange, just tried on fully updated Debian 8 template and cannot
> reproduce the problem. What version of qubes-core-agent do you have? It
> should be 3.0.16-1+deb8u1.

My Debian 8 template is running qubes-core-agent 3.0.13-1+jessie1

running apt-get update && apt-get upgrade tells me that qubes-core-agent and
qubes-gui-agent have been kept back.

I could reproduce it.
 
In my experience apt-get dist-upgrade can introduce instabilities when
running Debian testing, so as a matter of habit I usually stick to a
straight upgrade.

The Qubes OS Debian 8 Template is not based on Debian testing it is fully based on Debian 8 code name "Jessie"

I suppose I'll just do a dist-upgrade for now, but is there a reason
that the two packages are being kept back?

This explains very well why packages are kept back:

"If the dependencies have changed on one of the packages you have installed so that a new package must be installed to perform the upgrade then that will be listed as "kept-back"." (http://www.debian-administration.org/article/69/Some_upgrades_show_packages_being_kept_back)

JMP


apt-get dist-upgrade does not upgrade your distribution to testing or unstable under debian, it just upgrades your complete system.

Best regards
  J. Eppler

Marek Marczykowski-Górecki

unread,
Sep 18, 2015, 5:18:24 PM9/18/15
to Jeremias E., qubes-users
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

With qubes-core-agent-3.0.16?

- --
Best Regards,
Marek Marczykowski-Górecki
Invisible Things Lab
A: Because it messes up the order in which people normally read text.
Q: Why is top-posting such a bad thing?
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1

iQEcBAEBCAAGBQJV/H+ZAAoJENuP0xzK19cseCMIAJDZP2w0bckO5IPSgJLQcNsq
wWhWj4ed6vNcT/7tGqE+sPtThxRbG7SgKsh0HcAppz9guQf+IdxVF5VfMpHLWXtJ
npDOpKcAEsNJcg7pWUoQLFK4L1pCg+8NzS25Db35Mwh7uhxmasUKu/IKo2aMkZ4o
e9G9NoNCTJIj16Kipr6UzH36PxBsQhPjTJmyoJB7Ue53TUjPRHN2drJiI3BvD9Hn
5G38S7sC/1N+iwTuaZfTMzUx0P9PHcVgYsPZbzptyI3vnQFIWmYzMW1LzEXUL9NH
arX8DYz0mDR3deZSR+TVdFHj9EGSluYEZlYTuvrCPBWbr3Ggu0EJbhQz5uN/JAA=
=Rk9/
-----END PGP SIGNATURE-----

Jeremias E.

unread,
Sep 18, 2015, 6:30:34 PM9/18/15
to qubes-users, j.ep...@openmailbox.org
Hello Marek,

here the debian 8 template before upgrading:

root@debian-8:/home/user# apt-get upgrade
Reading package lists... Done
Building dependency tree      
Reading state information... Done
Calculating upgrade... Done

The following packages have been kept back:
  qubes-core-agent qubes-gui-agent

The following packages will be upgraded:
  apt apt-utils base-files cron dbus dbus-x11 gir1.2-gtk-3.0 gnome-terminal
  gnome-terminal-data libapt-inst1.5 libapt-pkg4.12 libc-bin libc6 libdbus-1-3
  libegl1-mesa libegl1-mesa-drivers libgail-3-0 libgbm1 libgl1-mesa-dri
  libgl1-mesa-glx libglapi-mesa libgnutls-deb0-28 libgnutls-openssl27
  libgtk-3-0 libgtk-3-bin libgtk-3-common libgudev-1.0-0 libicu52
  libio-socket-ssl-perl libldap-2.4-2 libmp3lame0 libnss3 libopenvg1-mesa
  libpam-systemd libruby2.1 libsystemd0 libudev1 libvchan-xen libvdpau1
  libwayland-egl1-mesa locales multiarch-support python-apt python-apt-common
  python3-apt qubes-utils qubesdb rsyslog systemd systemd-sysv tzdata udev
52 upgraded, 0 newly installed, 0 to remove and 2 not upgraded.
Need to get 46.4 MB of archives.
After this operation, 1,037 kB disk space will be freed.
Do you want to continue? [Y/n]

here all qubes package version:
root@debian-8:/home/user# dpkg -l \*qubes\*
....
||/ Name                       Version            Architecture       Description
+++-==========================-==================-==================-=========================================================
ii  libqubesdb                 3.0.3-1+jessie1    amd64              QubesDB libs.
ii  qubes-core-agent           3.0.13-1+jessie1   amd64              Qubes core agent
un  qubes-core-agent-linux     <none>             <none>             (no description available)
un  qubes-core-vchan-xen       <none>             <none>             (no description available)
un  qubes-core-vm-sysvinit     <none>             <none>             (no description available)
ii  qubes-gui-agent            3.0.8+jessie1      amd64              Makes X11 windows available to qubes dom0
un  qubes-linux-utils          <none>             <none>             (no description available)
ii  qubes-utils                3.0.9+jessie1      amd64              Qubes Linux utilities
ii  qubesdb                    3.0.3-1+jessie1    amd64              QubesDB management tools and daemon.
ii  qubesdb-vm                 3.0.3-1+jessie1    amd64              QubesDB VM service.

I hope this answers your question.

Best regards
  J. Eppler

Marek Marczykowski-Górecki

unread,
Sep 18, 2015, 7:10:25 PM9/18/15
to Jeremias E., qubes-users
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

Yes. You have qubes-core-agent version 3.0.13. So, if you want to use
Debian for downloading dom0 updates, you need to update qubes-core-agent
(use apt-get dist-upgrade). New qubes-core-agent includes fix for that.

- --
Best Regards,
Marek Marczykowski-Górecki
Invisible Things Lab
A: Because it messes up the order in which people normally read text.
Q: Why is top-posting such a bad thing?
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1

iQEcBAEBCAAGBQJV/JnZAAoJENuP0xzK19cskucH/0Zuq8CoY/lB3iY9mefuyb9i
Bu1Dpvw2NShrVrLyO8K8pzxRmEtR5WnBrPVS0XL6bZ24cFtub3AUGgy6j5lZjYSo
Z1xhj4APHJH4/vJkfLQdy9sTrW96ziKbqo2K/brprikOSbTj6KgzWpWO/+JO9CnA
2/6FyQE0UavDvBQttAqvhCk8gNd4xjXcejjpL7pkwtmHIP49fxcoA5h73HTZY2hj
94lP2qQifk56GcNyMSGU76SvNRI9TJFdSP2l161jNFzLJrAwXOgs7bpaIdBBJ8cr
zzi39P4peQNhBgAuj9IBWjt1RGKy036Y5uaFlRjzxihAxa0wZBzO66GFE53YwRg=
=3Lbv
-----END PGP SIGNATURE-----

turak...@gmail.com

unread,
Sep 19, 2015, 5:57:42 AM9/19/15
to qubes-users, turak...@gmail.com
>
> Can you give some example file? Maybe you have some entry like
> "ShowOnlyIn=GNOME;" there - so something not meant to be started on
> Qubes. Recently we've fixed support for such options.
>
Example:
~/.config/autostart/zoiper.desktop
[Desktop Entry]
Encoding=UTF-8
Name=Zoiper
Comment=Zoiper
GenericName=Zoiper
Keywords=VoIP
Exec=/usr/bin/zoiper
Terminal=false
X-MultipleArgs=false
Type=Application
Icon=/usr/share/pixmaps/zoiper.png
Categories=Application;Network;
StartupNotify=true

But there are several other desktop files that I cannot start automatically. For example: EtherApe. It means that it wont start ANY desktop file automatically from ~/.config/autostart/*.desktop

> Does downgrading qubes-gui-vm fixed that? This can be related to some
> autostart service missing, but if not, it would be good idea to check
> what is exactly wrong there.
>

Downgrading qubes-gui-vm fixed everything. It means that autostart is working correctly and Zoiper client works fine without segfaults. I am using Fedora 21 minimal template.



>
> What version of qubes-core-vm do you have? Also the newest one?
>

Everything is updated to the newest version except qubes-gui-vm.
qubes-core-vm: 3.0.16-1
qubes-core-vm-systemd: 3.0.16-1
*** qubes-gui-vm: 3.0.10-1 ***
qubes-libchan-xen: 3.0.8-1
qubes-utils: 3.0.10-1
qubes-utils-libs: 3.0.10-1

I have to downgrade ONLY the gubes-gui-vm and segfault disappeared and every *.desktop file can be started automatically.

Anita

Marek Marczykowski-Górecki

unread,
Sep 19, 2015, 6:11:02 AM9/19/15
to turak...@gmail.com, qubes-users
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

On Sat, Sep 19, 2015 at 02:57:42AM -0700, turak...@gmail.com wrote:
> Downgrading qubes-gui-vm fixed everything. It means that autostart is working correctly and Zoiper client works fine without segfaults. I am using Fedora 21 minimal template.

Ah, minimal template... Make sure you have package dbus-python
installed. There is a missing dependency (will be fixed soon).

- --
Best Regards,
Marek Marczykowski-Górecki
Invisible Things Lab
A: Because it messes up the order in which people normally read text.
Q: Why is top-posting such a bad thing?
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1

iQEcBAEBCAAGBQJV/TStAAoJENuP0xzK19csVZwH+wan964FGFJI+Ht2MH8DZAa2
vNz6hM5sgPxvFCL+gbH8U4wFPc0ZKfZ7tDYVMULDM5oaUu5iHYmfI4rAnbA1+b70
VtGZ4961dj9+PFVm/6kJvVJb6aVGw3ZRZob8nHgNbYpP8FWfZ1SHc1nKDRgnWfng
LZHLi+HPTtmeuHJ9a3UgDTrHP8LkLNVXvxdeQImbf5vXZCxnar9vja8M2ekyis6p
WKBpmHAsEPTxGBJbAyXAz75nsdN2V0Bh1FXPTHiky6dOiporzJYWjtbRYfZWHche
D5MPgqbXLXrBS3FTxAFXZoj1/QnZeXfo8eMKWS+ZgkdeyhcPJuZXpCq4rMnWteA=
=38TQ
-----END PGP SIGNATURE-----

turak...@gmail.com

unread,
Sep 19, 2015, 6:17:57 AM9/19/15
to qubes-users, turak...@gmail.com
It seems that installing dbus-python solved the problem.
Reply all
Reply to author
Forward
0 new messages