Thanks and howto install Python version >= 2.6.4 on debian-9 template?

[gone]

Hello, 1st of all, I want to thank all the developers and supporters for
that great stuff called Qubes OS. My first question here after some hard
time of setting up version 4.0, updating it step by step and studying is
the following:

I have a debian-9 template running and for some application to get
installed on it I need Python with Version >= 3.6 as a prerequisite.

Since the preinstalled versions in debian-9 are 2.7 and 3.5 I attempted
to install version 3.6.4 from source as described at
https://www.rosehosting.com/blog/how-to-install-python-3-6-4-on-debian-9/
in order not to run into problems with incompatibilities when switching
to another repo.

Installing the build tools with "sudo apt-get install -y ..." worked
fine but the next step, downloading the source file, with

"wget https://www.python.org/ftp/python/3.6.4/Python-3.6.4.tgz"

brings "... failed: Temporary failure in name resolution.
wget: unable to resolve host address ‘www.python.org’ "

As I am neither an expert nor an experienced from-source-installer I
need some help and hope to get it here. Thanks very much in advance and
all the best for 2019.

[Chris Laprise]

Installing from Debian testing is much easier and it has Python 3.7.
Just set the default release as in the following link, then add a line
for "testing" in your /etc/apt/sources.list (and then 'apt update'):

https://www.debian.org/doc/manuals/apt-howto/ch-apt-get.en.html#s-default-version

--

Chris Laprise, tas...@posteo.net
https://github.com/tasket
https://twitter.com/ttaskett
PGP: BEE2 20C5 356E 764A 73EB 4AB3 1DC4 D106 F07F 1886

[gone]

Thanks Chris for the explanation. Yes, it may be easier to change to the
testing repo, but in general I would like to stay on the stable path
with that template. Switching to the testing repo and 'apt update' would
probably cause trouble with other software running smoothly so far. Or
can I use that only for python install and then fall back?

[unman]

If you follow the instructions that Chris linked to you should be fine.
apt update just updates the list of available packages. It doesn't in
itself do anything more.

By setting the default release to stable, you ensure that you wont be
"accidentally" installing stuff from testing. That will only happen if
you explicitly specify the testing repo:
apt-get -t testing install foo

I'd strongly recommend aptitude, which does an excellent job of dealing
with packages from different releases, and allows you to explicilt
choose the version you want. It also lets you review in detail what the
consequnces will be , so you are always able to roll back.

And, of course, with Qubes it's trivial to clone the template, try out
your proposed update from testing, and make sure that everything works
fine before you commit your precious qubes to use the new template.

[Matthias Link]

Thanks unman and Chris. Gonna try that at the next opportunity.

[gone]

On 1/3/19 12:50 AM, unman wrote:

OK, I've done setting the default version to "testing" in the newly
created /etc/apt/apt.conf but for the additional line in the
sources.list I'm not sure, what really is to do.

I've tried it with

"deb http://deb.debian.org/debian stretch testing contrib non-free"

but that seems to be wrong, as I get the following output in the terminal:

user@debian-9:~$ sudo apt update
Hit:1 http://deb.qubes-os.org/r4.0/vm stretch InRelease
Hit:2 http://security-cdn.debian.org stretch/updates InRelease
Ign:3 http://cdn-fastly.deb.debian.org/debian stretch InRelease
Hit:4 http://cdn-fastly.deb.debian.org/debian stretch Release
Reading package lists... Done
Building dependency tree
Reading state information... Done
All packages are up to date.
W: Target Packages (contrib/binary-amd64/Packages) is configured
multiple times in /etc/apt/sources.list:4 and /etc/apt/sources.list:10
W: Target Packages (contrib/binary-all/Packages) is configured multiple
times in /etc/apt/sources.list:4 and /etc/apt/sources.list:10
W: Target Translations (contrib/i18n/Translat.....and several more lines
with W: at the beginning.

Sorry but I'm absolutely not familiar with that, although it's pretty
interesting.

@unman: As soon as it will have worked this way I promise to try
aptitude next ;-) .

[Chris Laprise]

The relevant advice here is "set the default release as in the following
link...". Not set default release to testing! In this case it should be
set to stretch because that's the Debian release you're using.

You should add testing only as an additional line in sources.list:
> deb http://deb.debian.org/debian testing main

[gone]

Oh sorry, Chris, I reported wrong. The default in apt.conf is correctly
set to stable.

Thank you for the correct line to put in sources.list.

[Chris Laprise]

FWIW, the debian page isn't terribly clear about it. Also, I believe
that if you set the default to "stable" instead of the more specific
"stretch", the system could try to upgrade everything when buster (v10)
becomes the new stable (though I'm not sure if it would get anywhere
with no matching reference in sources.list).

[gone]

still strange to me. I had the lines in the config files like that:

user@debian-9:~$ cat /etc/apt/apt.conf
APT::Default-Release "stable";

user@debian-9:~$ cat /etc/apt/sources.list
deb http://deb.debian.org/debian stretch main contrib non-free
#deb-src http://http.debian.net/debian main/stretch main contrib non-free

deb http://security.debian.org stretch/updates main contrib non-free
#deb-src http://security.debian.org stretch/updates main contrib non-free

deb http://deb.debian.org/debian testing main

Then a

user@debian-9:~$ sudo apt-get -t testing install python

did 19 Packages of updating and installed 9 packages newly but it seems that happened only for the 2.7 version because

user@debian-9:~$ which python
/usr/bin/python
user@debian-9:~$ ls -la /usr/bin/python*
lrwxrwxrwx 1 root root       7 Jun  7  2018 /usr/bin/python -> python2
lrwxrwxrwx 1 root root       9 Jun  7  2018 /usr/bin/python2 -> python2.7
-rwxr-xr-x 1 root root 3685056 Nov 28 17:27 /usr/bin/python2.7
lrwxrwxrwx 1 root root       9 Jan 20  2017 /usr/bin/python3 -> python3.5
-rwxr-xr-x 2 root root 4751184 Sep 27 18:03 /usr/bin/python3.5
lrwxrwxrwx 1 root root      33 Sep 27 18:03 /usr/bin/python3.5-config -> x86_64-linux-gnu-python3.5-config
-rwxr-xr-x 2 root root 4751184 Sep 27 18:03 /usr/bin/python3.5m
lrwxrwxrwx 1 root root      34 Sep 27 18:03 /usr/bin/python3.5m-config -> x86_64-linux-gnu-python3.5m-config
lrwxrwxrwx 1 root root      16 Jan 20  2017 /usr/bin/python3-config -> python3.5-config
lrwxrwxrwx 1 root root      10 Jan 20  2017 /usr/bin/python3m -> python3.5m
lrwxrwxrwx 1 root root      17 Jan 20  2017 /usr/bin/python3m-config -> python3.5m-config
user@debian-9:~$ python -V
Python 2.7.15+
user@debian-9:~$ python 3.7 -V
python: can't open file '3.7': [Errno 2] No such file or directory

I still don't know what I've done wrong. Maybe have to sleep over it...and then come up here and try again.

[unman]

> /still strange to me. I had the lines in the config files like that:/

>
> user@debian-9:~$ cat /etc/apt/apt.conf
> APT::Default-Release "stable";
>
> user@debian-9:~$ cat /etc/apt/sources.list
> deb http://deb.debian.org/debian stretch main contrib non-free
> #deb-src http://http.debian.net/debian main/stretch main contrib non-free
>
> deb http://security.debian.org stretch/updates main contrib non-free
> #deb-src http://security.debian.org stretch/updates main contrib non-free
>
> deb http://deb.debian.org/debian testing main
>

> /Then a //
> /
>
> /user@debian-9:~$ sudo apt-get -t testing install python/
>
> /did 19 Packages of updating and installed 9 packages newly but it seems
> that happened only for the 2.7 version because/

>
> user@debian-9:~$ which python
> /usr/bin/python
> user@debian-9:~$ ls -la /usr/bin/python*
> lrwxrwxrwx 1 root root       7 Jun  7  2018 /usr/bin/python -> python2
> lrwxrwxrwx 1 root root       9 Jun  7  2018 /usr/bin/python2 -> python2.7
> -rwxr-xr-x 1 root root 3685056 Nov 28 17:27 /usr/bin/python2.7
> lrwxrwxrwx 1 root root       9 Jan 20  2017 /usr/bin/python3 -> python3.5
> -rwxr-xr-x 2 root root 4751184 Sep 27 18:03 /usr/bin/python3.5
> lrwxrwxrwx 1 root root      33 Sep 27 18:03 /usr/bin/python3.5-config ->
> x86_64-linux-gnu-python3.5-config
> -rwxr-xr-x 2 root root 4751184 Sep 27 18:03 /usr/bin/python3.5m
> lrwxrwxrwx 1 root root      34 Sep 27 18:03 /usr/bin/python3.5m-config ->
> x86_64-linux-gnu-python3.5m-config
> lrwxrwxrwx 1 root root      16 Jan 20  2017 /usr/bin/python3-config ->
> python3.5-config
> lrwxrwxrwx 1 root root      10 Jan 20  2017 /usr/bin/python3m -> python3.5m
> lrwxrwxrwx 1 root root      17 Jan 20  2017 /usr/bin/python3m-config ->
> python3.5m-config
> user@debian-9:~$ python -V
> Python 2.7.15+
> user@debian-9:~$ python 3.7 -V

> python: can't open file '3.7': [Errno 2] No such file or directory/
> /
>
> /I still don't know what I've done wrong. Maybe have to sleep over it...and
> then come up here and try again./
>

Here's what I would do to avoid dependency hell:
1. qvm-clone debian-9 debian-9-mix

In debian-9-mix:
2. apt-get update
3. apt-get upgrade
4. edit /etc/apt/sources.list to add line at end:
deb http://deb.debian.org/debian buster main

5. apt-get update
6. apt-get install python3.7
STOP - LOOK AT OUTPUT and you'll see that this breaks mgmt-salt and
therefore would remove qubes-vm-recommended which has all sorts of
useful stuff. Say NO.

7. apt-get install python3.7 qubes-core-agent-dom0-updates qubes-core-agent-passwordless-root qubes-gpg-split qubes-img-converter qubes-thunderbird qubes-usb-proxy
This will install python3.7 AND mark those qubes packages as manually
installed so they wont be removed.

8. Edit /etc/apt/apt.conf.d/7debconf and ADD:
APT::Default-Release "stretch";

Now you've pinned to stretch, so update and upgrade will only pull
in stretch packages.

You now have python3.5 AND python3.7 installed. You can change link in
/usr/bin to have python3 pointing to 3.7, or whatever suits you.
Test and test. Switch qubes to new template.
When you're happy, you could try removing 3.5 (in a cloned template).

unman

[gone]

Thanks again, unman.

I think I've understood all the steps up to 5. and executed them. Then
with Step 6 it went different to what you predicted. No output about
mgmt-salt (btw. what is that?) and unfortunately no option to "say NO":

user@debian-9-mix:~$ sudo apt-get install python3.7

Reading package lists... Done
Building dependency tree
Reading state information... Done

Some packages could not be installed. This may mean that you have
requested an impossible situation or if you are using the unstable
distribution that some required packages have not yet been created
or been moved out of Incoming.
The following information may help to resolve the situation:

The following packages have unmet dependencies:
python3.7 : Depends: python3.7-minimal (= 3.7.2~rc1-1) but it is not
going to be installed
Depends: libpython3.7-stdlib (= 3.7.2~rc1-1) but it is not
going to be installed
E: Unable to correct problems, you have held broken packages.

Is that problematic? Would you propose to go on with step 7 or do
something else first?

[Chris Laprise]

On 01/04/2019 04:18 PM, gone wrote:

> Thanks again, unman.
>
> I think I've understood all the steps up to 5. and executed them. Then
> with Step 6 it went different to what you predicted. No output about
> mgmt-salt (btw. what is that?) and unfortunately no option to "say NO":
>
> user@debian-9-mix:~$ sudo apt-get install python3.7
> Reading package lists... Done
> Building dependency tree
> Reading state information... Done
> Some packages could not be installed. This may mean that you have
> requested an impossible situation or if you are using the unstable
> distribution that some required packages have not yet been created
> or been moved out of Incoming.
> The following information may help to resolve the situation:
>
> The following packages have unmet dependencies:
>  python3.7 : Depends: python3.7-minimal (= 3.7.2~rc1-1) but it is not
> going to be installed
>              Depends: libpython3.7-stdlib (= 3.7.2~rc1-1) but it is not
> going to be installed
> E: Unable to correct problems, you have held broken packages.
>
> Is that problematic? Would you propose to go on with step 7 or do
> something else first?
>

I think you need to include the '-t buster' option for apt-get install.
Otherwise it won't look for newer dependencies in the buster repo and so
won't be able to find them.

[unman]

If you look at my instructions, you'll see I didnt suggest setting the
Default-Release until *after* you'd installed Python3.7.
My guess is that you've pinned to stretch already, so you have to
specify buster for the install, as Chris says.
If you do, you'll see the warning - mgmt-salt-vm-connector is the backend
that allows for salt control of qubes. The new update tool uses this to
run updates so you'll wont be able to use it on the new template.

[gone]

Fine, I performed Step 6 with the -t buster option, got the warning and
said NO.

Same done in Step 7 apt tells, that the qubes-* packages are already the
newest version and set to manually installed. But after that still the
warning appears:

The following packages will be REMOVED:
libqt5designer5 libqt5gui5 libqt5help5 libqt5printsupport5 libqt5svg5
libqt5widgets5
python3-pyqt5 qt5-gtk-platformtheme qubes-mgmt-salt-vm-connector
qubes-vm-recommended
salt-common salt-ssh
The following NEW packages will be installed:
libboost-iostreams1.67.0 libboost-system1.67.0 libdrm-common
libevent-2.1-6 libicu63
libpcre2-16-0 libpython3.7 libpython3.7-dev libpython3.7-minimal
libpython3.7-stdlib
libunbound8 libwebpmux3 libzstd1 python3-distutils python3-lib2to3
python3.7
python3.7-dev python3.7-minimal uuid-dev


I'm not sure. Will they really be removed or rather not because before
they will get set to manually installed? Or in different words: Should I
say yes here?

[unman]

It's always difficult troubleshooting someone else's problems without
knowing exactly what the setup is, or exactly what commands they are
running.
I've installed all those packages, and when I run step7 I
DONT see that note about removing these packages. (As I've explained
qubes-vm-recommended, salt-common and salt-ssh have to go.)
This makes me think that you have a range of packages installed, some of
which are dependencies of the packages in the REMOVED list, and that
they are incompatible with python3.7 or ITS dependencies. Obviously I
don't know what they might be.

You haven't commented on whether you followed my instructions or whether
you set the Default before starting out. If you did then I would start
from a fresh clone and NOT set the default. (One reason for this is that
you may not want to restrict yourself to buster which is what '-t
buster' is doing.) If you do this then DONT use the -t option as that
will FORCE apt to install everything from testing.

If you want those named packages to be retained, then try adding them
to the list of packages to be installed, or use aptitude which will help
you to see exactly what is going on with these particular versions.

There really isn't anything to be lost (assuming you are working in a
cloned template.)

[gone]

On 1/5/19 5:39 PM, unman wrote:

>
> There really isn't anything to be lost (assuming you are working in a
> cloned template.)
>

You are completely right. I should more often just try what happens than
ask for every little step in fear of crushing the system on the playground.

[unman]

I didnt mean to give you the brush off - just to remind you that Qubes
*does* allow you to make (serious) mistakes without pain, if you clone
and test first.
Try including the threatened packages in the install line, and let us know
how you get on. Don't forget to set the Default to "stretch" when you're
all installed.

unman

[gone]

On 1/6/19 12:57 PM, unman wrote:
>
> I didnt mean to give you the brush off - just to remind you that Qubes
> *does* allow you to make (serious) mistakes without pain, if you clone
> and test first.

Oh yes, everything is fine to me and I got you right. I really
appreciate your way of helping. Have a nice Sunday :-)