qubes dom0 update breaks template updating

[qtpie]

The latest dom0 update broke updating my templates. I altered
/etc/qubes-rpc/policy/qubes.UpdatesProxy to change the updateproxy to
sys-whonix.

My solution is to uncomment the lines starting with 'tag', while leaving
the lines in the old formatting untouched.

This solution seems weird since here it is suggested that the lines
starting with 'tag' should replace the other lines:
https://github.com/QubesOS/qubes-mgmt-salt-dom0-virtual-machines/commit/ca27a33b0ec59f5ea2d4b334973eaa837f11ffc4

I'm not saying this is a bug, I can understand that an update is not
compatible with certain customisations and it is the users responsiblity
to fix this.

In any case - enjoying Qubes everyday!

[Marek Marczykowski-Górecki]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

On Wed, Jan 09, 2019 at 10:19:00PM +0000, qtpie wrote:
> The latest dom0 update broke updating my templates. I altered
> /etc/qubes-rpc/policy/qubes.UpdatesProxy to change the updateproxy to
> sys-whonix.

Can you explain what/how exactly it's broken?
/etc/qubes-rpc/policy/qubes.UpdatesProxy should not be overridden by an
update, so any local modifications should remain. Also, using sys-whonix
as updates proxy is a valid configuration we test regularly and did not
spotted any issues recently...

> My solution is to uncomment the lines starting with 'tag', while leaving
> the lines in the old formatting untouched.
>
> This solution seems weird since here it is suggested that the lines
> starting with 'tag' should replace the other lines:
> https://github.com/QubesOS/qubes-mgmt-salt-dom0-virtual-machines/commit/ca27a33b0ec59f5ea2d4b334973eaa837f11ffc4
>
> I'm not saying this is a bug, I can understand that an update is not
> compatible with certain customisations and it is the users responsiblity
> to fix this.
>
> In any case - enjoying Qubes everyday!

- --
Best Regards,
Marek Marczykowski-Górecki
Invisible Things Lab
A: Because it messes up the order in which people normally read text.
Q: Why is top-posting such a bad thing?
-----BEGIN PGP SIGNATURE-----

iQEzBAEBCAAdFiEEhrpukzGPukRmQqkK24/THMrX1ywFAlw2lpUACgkQ24/THMrX
1yw3PQf/YuxS53SSNvIjyjbUxNXjCMMRO6RU3p1JjdrPwYbmo+8adCFRdmyDJake
kH+1FginUxsUpqySOvX1Xw516p00Ct+1sKVOcgfmLKU9Ama7peNoUNcRBTr3jmst
FC3rRsrxofT3E3ceCmd/BXFJdIK/JEof130DXEYsBxKdf/9qm5BVYVkN+Q3VmvIA
uwz0VWstF3Z2vXvwgWLcMyTjpuxhdWBMuLeJSGqI0gWwltztgpyGERp24UjraK6E
xZtVIie+7MGnfXI6ZpONeLjdTAAW+VKGvvWs5YncbxKVQIdUucILbkQamwqiyD1m
XatKifnvLe9WO4MrrzZR22h79gua5A==
=WJ+F
-----END PGP SIGNATURE-----

[qtpie]

Marek Marczykowski-Górecki:

> On Wed, Jan 09, 2019 at 10:19:00PM +0000, qtpie wrote:
>> The latest dom0 update broke updating my templates. I altered
>> /etc/qubes-rpc/policy/qubes.UpdatesProxy to change the updateproxy to
>> sys-whonix.
>
> Can you explain what/how exactly it's broken?
> /etc/qubes-rpc/policy/qubes.UpdatesProxy should not be overridden by an
> update, so any local modifications should remain. Also, using sys-whonix
> as updates proxy is a valid configuration we test regularly and did not
> spotted any issues recently...
>

I cant reproduce the exact situation anymore. What was broken was that
on apt update or dnf upgrade, I got a 500 error on the repository URL,
and the error below.

The error below I can still trigger by commenting out the line starting
with $type, and uncommenting the line starting with $tag.

The 500 error I cant reproduce.Sorry if I cried too soon.

E: The repository 'http://deb.qubes-os.org/r4.0/vm stretch Release' does
no longer have a Release file.
N: Updating from such a repository can't be done securely, and is
therefore disabled by default.
N: See apt-secure(8) manpage for repository creation and user
configuration details.

[Marek Marczykowski-Górecki]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

On Fri, Jan 11, 2019 at 11:23:00AM +0000, qtpie wrote:
>
>
> Marek Marczykowski-Górecki:
> > On Wed, Jan 09, 2019 at 10:19:00PM +0000, qtpie wrote:
> >> The latest dom0 update broke updating my templates. I altered
> >> /etc/qubes-rpc/policy/qubes.UpdatesProxy to change the updateproxy to
> >> sys-whonix.
> >
> > Can you explain what/how exactly it's broken?
> > /etc/qubes-rpc/policy/qubes.UpdatesProxy should not be overridden by an
> > update, so any local modifications should remain. Also, using sys-whonix
> > as updates proxy is a valid configuration we test regularly and did not
> > spotted any issues recently...
> >
>
> I cant reproduce the exact situation anymore. What was broken was that
> on apt update or dnf upgrade, I got a 500 error on the repository URL,
> and the error below.
>
> The error below I can still trigger by commenting out the line starting
> with $type, and uncommenting the line starting with $tag.

If you leave _only_ lines with $tag, then templates without that tag
won't have access to any updates proxy (as you define it only for
templates with a tag).

- --
Best Regards,
Marek Marczykowski-Górecki
Invisible Things Lab
A: Because it messes up the order in which people normally read text.
Q: Why is top-posting such a bad thing?
-----BEGIN PGP SIGNATURE-----

iQEzBAEBCAAdFiEEhrpukzGPukRmQqkK24/THMrX1ywFAlw4gF4ACgkQ24/THMrX
1yxrdQf+K1K8P9IDlQ/vmTOv9fWNkSfWofAcmF0VTPGQukRKmYLVrHQu3xSiH9eV
C/bBszQZ2wY4HIzMcPpSxqQ37NSRec/V+s5NUogjzuIvD5vF/MM2pWOZN9A8kM3Z
GmwYTuPh6wjww6tJ+CjKHFOZo1U2/gSQ86h5bsO2NeJMwV8IWwkzSkOKJyuuqxKg
eo66yw9aS3iehEUIz/R68ApXWBlM7L0PRDpgWR96FwcaG1v2SSfFsEE7PODpdTgi
sdbyTNKIIe5G+GCodfzi2RbT0C1hkA3CF8hUrY1+0C+RHuOkH6Vrqa8FCfDuxObl
hiTCm1COw3jGYp4mcJ+EZcaPoeR99Q==
=zQ9b
-----END PGP SIGNATURE-----