debian 10 minimal ... issue with update proxy

[Sven Semmler]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512


My template tpl-deb-10-min was created by installing the
debian-9-minimal from itl-testing then cloning and updating it and
finally upgrading to it to buster.

The template is the basis of an AppVM dvm-min, which in turn is a
template for dispvms: sys-net, sys-firewall and sys-usb.

The sys qubes work (network, firewall and usb proxy), however my
update proxy seems to be broken.

Running qubes-dom0-update seems to work ... although I have no updates
currently. At least I don't see any error messages.

But when I run "sudo apt-get update" in the template I get this...

user@tpl-deb-10:~$ sudo apt-get update
Err:1 https://deb.debian.org/debian buster InRelease
Reading from proxy failed - read (11: Resource temporarily
unavailable) [IP: 127.0.0.1 8082]
Err:2 https://deb.qubes-os.org/r4.0/vm buster InRelease

Reading from proxy failed - read (11: Resource temporarily
unavailable) [IP: 127.0.0.1 8082]
Err:3 https://updates.signal.org/desktop/apt xenial InRelease

Reading from proxy failed - read (11: Resource temporarily
unavailable) [IP: 127.0.0.1 8082]
Err:4 https://deb.debian.org/debian-security buster/updates InRelease

Reading from proxy failed - read (11: Resource temporarily
unavailable) [IP: 127.0.0.1 8082]
Reading package lists... Done
W: Failed to fetch
https://deb.debian.org/debian/dists/buster/InRelease Reading from
proxy failed - read (11: Resource temporarily unavailable) [IP:
127.0.0.1 8082]
W: Failed to fetch
https://deb.debian.org/debian-security/dists/buster/updates/InRelease
Reading from proxy failed - read (11: Resource temporarily
unavailable) [IP: 127.0.0.1 8082]
W: Failed to fetch
https://deb.qubes-os.org/r4.0/vm/dists/buster/InRelease Reading from
proxy failed - read (11: Resource temporarily unavailable) [IP:
127.0.0.1 8082]
W: Failed to fetch
https://updates.signal.org/desktop/apt/dists/xenial/InRelease Reading
from proxy failed - read (11: Resource temporarily unavailable) [IP:
127.0.0.1 8082]
W: Some index files failed to download. They have been ignored, or old
ones used instead.

What did I mess up?

/Sven
-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEE18ry22WNibwI1qeq2m4We49UH7YFAlyec1wACgkQ2m4We49U
H7a9Rg//cqn6Mm+Njrbq/z0nN/3ags354RWxZf9luuSrT5ALh99VzA5YTRTPk7rG
VUhPlqWuqLbsy0e0YT7mw+45rzJOadpXKbYHAvon+fbfsfNPiqDwO+DhMo0KBXV/
C/4L56hzYPtibZpWEdvfO9E7dPZH0WWvL5kYS5Gkbu4ygukUHn40NweiblparR7e
QxMYIJgTJMjnwivHrTwMH2hHmKDtq8hgQ3j4xpS7/4xLjyF/jNU4nG9HR+zCJkZr
1PBrg6fY2jyK9CqNbbQNk50KsBN/2PouDqZactH0tiMNP/JVb7bkOac4pweszO+M
n9nkBcKY/Su8Zo+m/PZ5o0E+Gra2Stwq72KaE2Fw6wlQ+D9mviL9uFSRJ2AwZ98O
0pY+9rYDiqjyH5H1hFpwtIWaTbYkXMnl6TkqY9XuWjN1m1/a/PDaDBHHRSh/w073
MXY+C4su+xmfSK7Fkly65vz+z5GpvKvNudQk63PXh3wvx7TEdGG5biICbNto8HGG
iVFuh/REynaIJNKoD6qdPaNDgRnc/wyMeCSIsM9XYHAjR0yToQCx/VUuIq6VCOPa
0r24oHNnk6RvpcyLR5FiTa/OMWhteioBYbqMDze2dqZNRGxXfMYHdl8AdL6Esvw3
tFiJNTU9qq8Yvmw6rvYfY25lw8c8X0+Mv6VtyuiJKAxuE9y2flI=
=9LwK
-----END PGP SIGNATURE-----

[Sven Semmler]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

On 3/29/19 2:34 PM, Sven Semmler wrote:
> What did I mess up?

user@tpl-deb-10:~$ sudo service qubes-updates-proxy status
● qubes-updates-proxy.service - Qubes updates proxy (tinyproxy)
Loaded: loaded (/lib/systemd/system/qubes-updates-proxy.service;
enabled; vendor preset: enabled)
Active: inactive (dead)
Condition: start condition failed at Fri 2019-03-29 19:22:56 CDT; 1s ago
├─
ConditionPathExists=|/var/run/qubes-service/qubes-yum-proxy was not met
└─
ConditionPathExists=|/var/run/qubes-service/qubes-updates-proxy was
not met


...hm. I'll go back to debian-9 and debian-9-minimal to see if it goes
away. Maybe something broke when upgrading to buster?

-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEE18ry22WNibwI1qeq2m4We49UH7YFAlyet6YACgkQ2m4We49U
H7Zfvg/6AyzivDu3JhizO0yg3KpblPJceBIOBaxR+wSwpCDHe/7N3y2v0QIqcvK8
ENGGkKP+LJ6ZCvl9M77dECGK12+d3CBCvVH7PviBAUq5lMwZ669jLRofYlI/ulgG
sQAhQjzvahe7tg+6bNTKiyUo11eF6zk6eqkNil6UOupi2DbzydRgB1vjZFcU7vMR
1/+tIw2fGqLUVqF/Iok+IVpaCOU0RSyeRn9clnGTfGIUpkR2Yj5rMCksVQ+dU+UG
nufrF3VOd/lUfhJ7HPb7/+BUkQTSKDX53ZWlGpeFsLDMy0toZ/k5pJbiXJNqLQen
i7WKjKQbCXnJSDS2rFSs+xjooosjUrT2neJ8tjxmp4/ZGj4/RvxCVhZ1Xj8ydIqI
iIutofkDiOG8oItFQ0x/0IFEiSm2wpO6xJWqJTTzsrhqGGobCOokkEcSZf3DLiyV
i4JXYcxwr91WjAFAiOuylw/jcMfONrU3HX6mcpUyNVWWQieB7F5uCcJ8ieC1Wr2g
+YlBr0RboctBS2IYN5Fe3mqbGixaddTO7Mf3obNfD4vaJDI6ZMbqqv6NygcCySEh
kKTkuiNPYFzhbHFbJpza42PAwQW7+ker3c13nuWN5Cr2qDvdIvV94gwFiUBwvbro
RtVV4hbKC8l1Sq+bro4DIBctu+1wrSfninRUbZ/JaY8OEzsI3HE=
=m8PK
-----END PGP SIGNATURE-----

[unman]

You need to enable the qubes-update-proxy service - this creates the
necessary file at /var/run/qubes-service/qubes-updates-proxy

There's another issue in that the service file refers to
/usr/sbin/tinyproxy but the exec is in /usr/bin
Fix this by editing /lib/systemd/system/qubes-updates-proxy.service to
refer to the correct path.

[Sven Semmler]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

On 3/29/19 8:58 PM, unman wrote:
> There's another issue in that the service file refers to
> /usr/sbin/tinyproxy but the exec is in /usr/bin Fix this by
> editing /lib/systemd/system/qubes-updates-proxy.service to refer to
> the correct path.

That was it! Thank you unman!

/Sven
-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEE18ry22WNibwI1qeq2m4We49UH7YFAlyfAxoACgkQ2m4We49U
H7ZSkg/+Iyoz+eoRcadcmi7dsutf6B5vg7sz2Knzjvy/Yd3Q9sSI6Ubm8cNVAdHf
bkwCd0iKZQoRQ6lmRl+J8QSZ2g7HqIRLMzdO+bhBWsSEMv0r5iIxhoUikTSFlDM1
WzPULpkfV68rHT0J+Y+t3mq6zCSqeTbh0QSqJSg58hdYYfjumXmz9eUKtzPZcSB7
2UFtXSfHkOCQsj1k5dkColJt3miZIoBM2W/f4TwTMC15UV3P1YepOt3IrxBZx8cD
pHONnaUTcV/sknEYRl7XP/BdqOZ1drl15S8n8eRHTFv2I7cIhiPzZ6+/ooS2WDaj
l/p9DUyj44uEevt4Y+VSYku/umkrPxyZj3O84A72P9LRpSdXyIrv3CeVr0v/2n8+
p/w/NJx1hYipT4JbjSFcnwaIkfs6GECyLLczJdLPnxIgwIkAUvH8V5l2F76zyXkf
4Y51tPzzj1tZgFrQohM79sIQtffLHm06C7MUq7hW1+UzB7aAcQFG/qokopUtTGJu
Apn0ZpyXsV9yrruOhta3zuOofP4R/z5Cu8i6+gFYwqQmf+S2oIxzlaNShN3WBg2D
uzOHIy3/NQ5B562rTdruZJ0xqcaNOfbxPZ6fGdV4pCJks2KxPA6dv/sLudNHMVRj
/CROESxtmUE73TG0FxnOcig4YbAEfVYjpoAMYSasmtKCDWiP1QA=
=QONy
-----END PGP SIGNATURE-----

[haaber]

> You need to enable the qubes-update-proxy service - this creates the
> necessary file at /var/run/qubes-service/qubes-updates-proxy
>
> There's another issue in that the service file refers to
> /usr/sbin/tinyproxy but the exec is in /usr/bin
> Fix this by editing /lib/systemd/system/qubes-updates-proxy.service to
> refer to the correct path.
>

Dear qubes-users, dear Unman, I tried to follow these instructions, but
I am stuck. There is an odd spelling issue, sometimes I read *updates*
(plural), sometimes *update* (singular). I presume the service name is
meant to be in plural: qubes-updates-proxy ?

I have actually tried both, singular and plural, but it won't work I
rebooted each time): the plural version generates the file
/var/run/qubes-service/qubes-updates-proxy but it has zero size. Is this
normal? And this file /lib/systemd/system/qubes-updates-proxy.service
you mention does simply not exist. Any hints?

[unman]

The service is the plural. I mumbled the singular.
Yes, it's normal to have a zero size file.
I dont know why you wouldnt have the service file - it comes with
qubes-core-agent-networking. You are looking in the qube, not in dom0?

[haaber]

I looked in the qube-template: dpkg -s qubes-core-agent-networking
reveals that the package was not installed on my debian-9-minimal
template :)) So I'll do that frist, then clone and buster it afterwards.
I guess that was all, so thanks once more, Unman.

Another remark / question: the tinyproxy path is also wrong in the
"full" debian-10 buster. Funnily that did not prevent upgrade from
stretch, nor 'manual' apt-get upgrades. I guess it is better to correct
that as well, rather than symlinking /usr/bin/tinyproxy to
/usr/sbin/tinyproxy ... cheers, Bernhard