Qubes-Whonix Development / Qubes Integration

Patrick · December 8, 2024, 11:23am

Migrated from testing to stable.

Patrick · December 14, 2024, 8:17pm

qubes-issues bot for warning and closing stale issues · Issue #7270 · QubesOS/qubes-issues · GitHub

Patrick · December 14, 2024, 8:18pm

github.com/QubesOS/updates-status

qubes-template-whonix-gateway-17 4.2.0-202412112157 (r4.2)

opened 09:57PM - 11 Dec 24 UTC

fepitre-bot

r4.2-testing

Template whonix-gateway-17 4.2.0-202412112157 for Qubes OS r4.2, see comments be…low for details and build status. If you're release manager, you can issue GPG-inline signed command (depending on template): * `Upload-template r4.2 whonix-gateway-17 4.2.0-202412112157 templates-itl` (available 5 days from now) * `Upload-template r4.2 whonix-gateway-17 4.2.0-202412112157 templates-community` (available 5 days from now) Above commands will work only if package in testing repository isn't superseded by newer version. For more information on how to test this update, please take a look at https://www.qubes-os.org/doc/testing/#updates.

github.com/QubesOS/updates-status

qubes-template-whonix-workstation-17 4.2.0-202412112157 (r4.2)

opened 10:23PM - 11 Dec 24 UTC

fepitre-bot

r4.2-testing

Template whonix-workstation-17 4.2.0-202412112157 for Qubes OS r4.2, see comment…s below for details and build status. If you're release manager, you can issue GPG-inline signed command (depending on template): * `Upload-template r4.2 whonix-workstation-17 4.2.0-202412112157 templates-itl` (available 5 days from now) * `Upload-template r4.2 whonix-workstation-17 4.2.0-202412112157 templates-community` (available 5 days from now) Above commands will work only if package in testing repository isn't superseded by newer version. For more information on how to test this update, please take a look at https://www.qubes-os.org/doc/testing/#updates.

Patrick · January 9, 2025, 12:11pm

Stop leaking dom0 timezone to Qubes-Whonix · Issue #8381 · QubesOS/qubes-issues · GitHub

Patrick · February 24, 2025, 12:04pm

github.com/QubesOS/qubes-issues

Warn user when trying to update without Internet connection

opened 04:45AM - 13 Feb 25 UTC

ArrayBolt3

ux P: default C: updates C: networking

### Qubes OS release Qubes OS 4.3, Qubes OS 4.2 ### Brief summary Qubes Updat…e doesn't check for network connectivity before allowing the user to attempt an update. A user can attempt to update Dom0 and all qubes without being connected to a network (which will obviously never work, and if you try the update attempt will just hang for a long time). ### Steps to reproduce 1. Ensure you are not connected to WiFi or any networks. 2. Open Qubes Update. 3. Attempt to update dom0 and all templates. ### Expected behavior User should be forbidden (or at least discouraged) from attempting an update until Internet connectivity is present. ### Actual behavior User can start the update without any indicator that it will never work. ### Additional information This is probably trickier to solve than it sounds since the concept of OS-wide network connectivity isn't really a thing under Qubes OS (in particular Dom0 and all the templates are actually isolated from the Internet and any network, and receive updates via a proxy instead). Querying sys-net's connectivity probably won't work since there may not *be* a single sys-net (someone with multiple network adapters might have multiple sys-net-like qubes). Perhaps whatever VM is responsible for providing updates to dom0 itself can be checked for connectivity, and if that comes back good it's assumed that the system is connected to the Internet? (Alternatively, every single template could be checked too, but that would probably be quite resource-intensive since you'd have to boot them all to do that.)

Patrick · March 4, 2025, 3:57pm

github.com/QubesOS/qubes-issues

xl console with replace escapes does not inform terminal apps that it is restricted

opened 02:06PM - 04 Mar 25 UTC

ben-grande

P: default

### Qubes OS release Qubes OS 4.2 ### Brief summary The patch [1009-tools-xen…console-replace-ESC-char-on-xenconsole-outp.patch](https://github.com/QubesOS/qubes-vmm-xen/blob/main/1009-tools-xenconsole-replace-ESC-char-on-xenconsole-outp.patch) is nice, but it doesn't inform applications the terminal is dumb. ### Steps to reproduce 1. sudo xl console QUBE 2. Try to use backspace, zsh command-line completion, zsh syntax highlighting ### Expected behavior Backspace works, colors are not applied. ### Actual behavior Backspace doesn't work, escape characters messes the screen, pain with Zsh completion and syntax highlighting. ### Additional information Now it is set to `TERM=vt220`, it would be better if it was set to `dumb` when replace escapes is used. I have accessed to terminals that inform they are vt220 and most of the escape sequences work there, so I cannot and should not disable capabilities because of that. `tty` is `/dev/hvc0`, although it seems super specific to a console, I believe it is best to use `TERM` to inform the correct capabilities of the terminal. https://invisible-island.net/ncurses/terminfo.src.html#tic-dumb When it is dumb, backspace works.

Patrick · March 4, 2025, 4:03pm

github.com/QubesOS/qubes-core-admin-linux

Comment by adrelanos - Update firmware packages from bookworm-backports on Debian 12

main ← marmarek:bookworm-firmware

I must caution against use of `/etc/apt/preferences.d/` / APT preferences / APT …pinning. Please consider the following. Quote https://www.kicksecure.com/wiki/Dev/APT_Pinning > Debian developers would literally hate this. Question: [Can a package pull a another package from another repository to be added?](https://lists.debian.org/debian-derivatives/2013/08/msg00004.html) Answers: * https://lists.debian.org/debian-derivatives/2013/08/msg00005.html * https://lists.debian.org/debian-derivatives/2013/08/msg00006.html > (And don't forget all the hate you will get from me and other deity@l.d.o inhabitants because your users end up reporting bugs about APT) I rarely got such as direct request

Patrick · March 10, 2025, 8:20am

github.com/QubesOS/updates-status

qubes-template-whonix-gateway-17 4.2.0-202412112157 (r4.2)

opened 09:57PM - 11 Dec 24 UTC

closed 08:19AM - 10 Mar 25 UTC

fepitre-bot

r4.2-testing

Template whonix-gateway-17 4.2.0-202412112157 for Qubes OS r4.2, see comments be…low for details and build status. If you're release manager, you can issue GPG-inline signed command (depending on template): * `Upload-template r4.2 whonix-gateway-17 4.2.0-202412112157 templates-itl` (available 5 days from now) * `Upload-template r4.2 whonix-gateway-17 4.2.0-202412112157 templates-community` (available 5 days from now) Above commands will work only if package in testing repository isn't superseded by newer version. For more information on how to test this update, please take a look at https://www.qubes-os.org/doc/testing/#updates.

github.com/QubesOS/updates-status

qubes-template-whonix-workstation-17 4.2.0-202412112157 (r4.2)

opened 10:23PM - 11 Dec 24 UTC

closed 08:19AM - 10 Mar 25 UTC

fepitre-bot

r4.2-testing

Template whonix-workstation-17 4.2.0-202412112157 for Qubes OS r4.2, see comment…s below for details and build status. If you're release manager, you can issue GPG-inline signed command (depending on template): * `Upload-template r4.2 whonix-workstation-17 4.2.0-202412112157 templates-itl` (available 5 days from now) * `Upload-template r4.2 whonix-workstation-17 4.2.0-202412112157 templates-community` (available 5 days from now) Above commands will work only if package in testing repository isn't superseded by newer version. For more information on how to test this update, please take a look at https://www.qubes-os.org/doc/testing/#updates.

Patrick · March 31, 2025, 9:58am

github.com/QubesOS/qubes-issues

qvm-console-dispvm - different or configurable default terminal emulator other than xterm

opened 09:57AM - 31 Mar 25 UTC

adrelanos

P: default

### The problem you're addressing (if any) qvm-console-dispvm currently uses xt…erm. Usability of xterm is bad. Fonts are small. ### The solution you'd like * Use a different default terminal emulator other than xterm. * Make the terminal emulator configurable. ### The value to a user and who that user might be * Better usability. ### Completion criteria checklist (This section is for developer use only. Please do not modify it.)

Patrick · May 1, 2025, 7:07am

github.com/QubesOS/qubes-issues

builder: longer timeouts and more retries for APT to avoid aborted builds due to network issues

opened 06:51AM - 01 May 25 UTC

adrelanos

P: default

### Qubes OS release R4.2 ### Brief summary Quote @marmarek in https://github….com/QubesOS/updates-status/issues/5605#issuecomment-2838483263 > Maybe there should be some (better) retry mechanism? Documentation suggests `Acquire::Retries` setting defaults to 3, and indeed I see 3 attempts in the log. But maybe it's not enough? Or maybe it fails due to the current tor circuit being broken and retry should use a different one to have a chance (not sure how to do that, or if that's even possible)? Or maybe when it fails on name resolution (log has `Something wicked happened resolving 'deb.qubes-os.org:https' (-4 - Non-recoverable failure in name resolution).`) it doesn't really retry? I'm quite confused here, because it stops working in the middle of template build, for example installing `qubes-core-agent-dom0-updates` some lines above worked. And also installing a lot of Debian and Whonix packages earlier worked too... ### Steps to reproduce Build a Debian based Qubes Template. ### Expected behavior Long timeouts and many retries. ### Actual behavior Bails out due to network issues. * https://github.com/QubesOS/updates-status/issues/5593 * https://github.com/QubesOS/updates-status/issues/5595 * https://github.com/QubesOS/updates-status/issues/5605 * https://github.com/QubesOS/updates-status/issues/5607 * (Corresponding gateway build also failed.)

Patrick · May 5, 2025, 6:27am

Patrick · May 18, 2025, 11:24am

github.com/QubesOS/updates-status

qubes-template-whonix-gateway-17 4.2.0-202505140948 (r4.2)

opened 09:48AM - 14 May 25 UTC

fepitre-bot

r4.2-testing

Template whonix-gateway-17 4.2.0-202505140948 for Qubes OS r4.2, see comments be…low for details and build status. If you're release manager, you can issue GPG-inline signed command (depending on template): * `Upload-template r4.2 whonix-gateway-17 4.2.0-202505140948 templates-itl` (available 5 days from now) * `Upload-template r4.2 whonix-gateway-17 4.2.0-202505140948 templates-community` (available 5 days from now) Above commands will work only if package in testing repository isn't superseded by newer version. For more information on how to test this update, please take a look at https://www.qubes-os.org/doc/testing/#updates.

github.com/QubesOS/updates-status

qubes-template-whonix-workstation-17 4.2.0-202505140948 (r4.2)

opened 10:15AM - 14 May 25 UTC

fepitre-bot

r4.2-testing

Template whonix-workstation-17 4.2.0-202505140948 for Qubes OS r4.2, see comment…s below for details and build status. If you're release manager, you can issue GPG-inline signed command (depending on template): * `Upload-template r4.2 whonix-workstation-17 4.2.0-202505140948 templates-itl` (available 5 days from now) * `Upload-template r4.2 whonix-workstation-17 4.2.0-202505140948 templates-community` (available 5 days from now) Above commands will work only if package in testing repository isn't superseded by newer version. For more information on how to test this update, please take a look at https://www.qubes-os.org/doc/testing/#updates.

Patrick · May 24, 2025, 5:34pm

Template whonix-gateway-17-4.2.0-202505140948 was uploaded to templates-community repository.

Template whonix-workstation-17-4.2.0-202505140948 was uploaded to templates-community repository.

Patrick · May 27, 2025, 4:07pm

github.com/QubesOS/qubes-issues

qubes-app-shutdown-idle incompatible with user-sysmaint-split (and/or without qubes-core-agent-passwordless-root package)

opened 04:06PM - 27 May 25 UTC

adrelanos

P: default

### Qubes OS release R4.2 ### Brief summary `qubes-app-shutdown-idle` does no…t shutdown Whonix (and Kicksecure?) VMs. ### Steps to reproduce Unknown. Probably "normal" use of `qubes-app-shutdown-idle`. Was reported by user: https://forum.qubes-os.org/t/quite-a-few-whonix-issues-after-recent-update/33957/24 ### Expected behavior `qubes-app-shutdown-idle` normal operation. (Shutting down all idle VMs.) ### Actual behavior `qubes-app-shutdown-idle` does not shutdown Whonix (and Kicksecure?) VMs. ### Additional information Not a big surprise. Quote https://github.com/QubesOS/qubes-app-shutdown-idle/blob/main/qubesidle/idleness_monitor.py#L118C1-L119C1 > `subprocess.call(['sudo', 'poweroff'])` It runs `sudo poweroff`. It suppose it is account `user` the effectively runs `sudo poweroff`. There are probably at least 2 ways to fix it: * A) simply drop `sudo`: `poweroff` works without `sudo`. * B) run the command as `root`, not as `user`

Patrick · July 2, 2025, 6:41pm

github.com/Whonix/qubes-whonix

block tinyproxy requests to 127.0.0.1, 10.137.255.254

master ← 3nprob:fix-tinyproxy-filter

opened 09:45PM - 22 Mar 25 UTC

3nprob

+3 -0

## Changes Migrates existing qubes-whonix-specific tinyproxy filter from qube…s-core-agent-linux to qubes-whonix. It seems that this belongs better here. Note that this is not a security measure as requests to other loopback addresses are still allowed. this filter is an accommodation for whonix torification detection. The filter file is renamed from `/etc/tinyproxy/updates-blacklist` to `/etc/tinyproxy/updates-blocklist` in order to ensure conflict-free upgrades with regards to package ownership of those files. - https://github.com/QubesOS/qubes-issues/issues/1482 - https://github.com/QubesOS/qubes-core-agent-linux/pull/565 ## Mandatory Checklist - [x] Legal agreements accepted. By contributing to this organisation, you acknowledge you have read, understood, and agree to be bound by these these agreements: [Terms of Service](https://www.whonix.org/wiki/Terms_of_Service), [Privacy Policy](https://www.whonix.org/wiki/Privacy_Policy), [Cookie Policy](https://www.whonix.org/wiki/Cookie_Policy), [E-Sign Consent](https://www.whonix.org/wiki/E-Sign_Consent), [DMCA](https://www.whonix.org/wiki/DMCA), [Imprint](https://www.whonix.org/wiki/Imprint) ## Optional Checklist The following items are optional but might be requested in certain cases. - [ ] I have tested it locally - [x] I have reviewed and updated any documentation if relevant - [ ] I am providing new code and test(s) for it

Patrick · July 2, 2025, 6:41pm

github.com/QubesOS/qubes-issues

replace tinyproxy with something more secure for better security

opened 03:22PM - 28 Jun 25 UTC

adrelanos

security P: default C: networking

### Qubes OS release Qubes R4.2 / any ### Brief summary Replace tinyproxy for… better security. ### Steps to reproduce n/a ### Expected behavior No tinyproxy installed by default. ### Actual behavior tinyproxy is installed by default. ### Additional information Is it (still) planned to port from tinyproxy to a custom solution made by Qubes? I am pretty sure I've seen Qubes developers considering this but I haven't found a dedicated ticket for this. Therefore a decision if this is planned or not would be useful. Tickets that would get obsoleted if this is planned: * https://github.com/QubesOS/qubes-issues/issues/3800 Why I am asking: * https://github.com/Whonix/qubes-whonix/pull/3#issuecomment-2994122947

Patrick · July 19, 2025, 6:28am

github.com/QubesOS/qubes-issues

StandaloneVMs can end up with the wrong NetVM and default DispVM set upon creation

opened 10:05PM - 18 Jul 25 UTC

ArrayBolt3

P: default

[How to file a helpful issue](https://www.qubes-os.org/doc/issue-tracking/) ###… Qubes OS release R4.3 ### Brief summary When creating a StandaloneVM based upon a Whonix-Workstation template, the default NetVM is `sys-firewall`, not `sys-whonix`. For some reason if I make an AppVM based on a Whonix-Workstation template though, the default NetVM is `sys-whonix`. The improperly set NetVM makes it so that a newly created Whonix-Workstation standalone is unable to access the network until it is manually reconfigured by the end user. I expect this is probably fixable, since Qubes OS is able to figure out the correct NetVM for AppVMs. ### Steps to reproduce 1. Open Qube Manager. 2. Click "New Qube". 3. Ensure "Application" is selected in the left-hand sidebar. 4. Set the qube name to `ws-appvm-test`. 5. Set the template to `whonix-workstation-17`. 6. Click "Create New Qube". 7. Click "OK" once the qube is created. 8. Click on the `ws-appvm-test` qube, and click "Settings". 9. Note down the "Net qube" that is set here. 10. Click "New Qube". 11. Click "Standalone" in the left-hand sidebar. 12. Set the qube name to `ws-standalone-test`. 13. Click "Template or standalone qube" as the clone source. 14. Select "whonix-workstation-17" as the source qube. 15. Click "Create new qube". 16. Click "OK" once the qube is created. 17. Click on the `ws-standalone-test` qube, and click "Settings". 18. Note down the "Net qube" that is set here. ### Expected behavior In steps 9 and 18, the set "Net qube" should be `sys-whonix` (i.e. both the AppVM and StandaloneVM should have the same NetVM). ### Actual behavior In step 9, the AppVM's net qube is `sys-whonix` (good), but in step 18, the StandaloneVM's net qube is `sys-firewall` (broken). ### Additional information (none)

github.com/QubesOS/qubes-core-admin-addon-whonix

Set NetVM and DispVM properly for StandaloneVMs

main ← ArrayBolt3:arraybolt3/standalone-netvm-fix

opened 12:09AM - 19 Jul 25 UTC

ArrayBolt3

+64 -31

Previously, when creating a Whonix-Workstation standalone, the NetVM would be sy…s-firewall by default, and the default DispVM would be default-dvm. Both of these are wrong for most Whonix-Workstation qubes, so now when a qube has the whonix-ws feature set on it, it will automtically have its NetVM and DispVM changed to appropriate values for a Whonix-Workstation machine. This makes standalone creation work as expected. Fixes https://github.com/QubesOS/qubes-issues/issues/10067.