That might be what is happening. Qubes packages are installed before Whonix packages, and that is good as is for many reasons and should probably not change.
2025-05-14 09:56:19.142882 +0000 build-templates-community: .[38;5;246m11:56:19 .[96m[qb.template.whonix-gateway-17.prep] .[38;5;246m python3.11 python3.11-minimal qubes-core-agent qubes-core-qrexec.[0m
2025-05-14 10:01:05.780655 +0000 build-templates-community: .[38;5;246m12:01:05 .[96m[qb.template.whonix-gateway-17.prep] .[38;5;246mSetting up whonix-gw-network-conf (3:5.5-1) …[0m
2025-05-14 10:01:05.807287 +0000 build-templates-community: .[38;5;246m12:01:05 .[96m[qb.template.whonix-gateway-17.prep] .[38;5;246mAdding ‘diversion of /etc/resolv.conf to /etc/resolv.conf.whonix-orig by whonix-gw-network-conf’.[0m
But does any Qubes code change symlinks of /etc/hosts file? Yes. sed -i can destroy symlinks. [1]
Would it be possible to move the Qubes postinst code related to protected files into Qubes systemd units? Then it would not be done during Template build. Only during boot.
This is because postinst runs unconditionally while systemd units should not be started during the build process.
Would it be sane for Qubes to avoid touching symlinks? Would it be a good idea to express in source code “if a protect-able file is a symlink, it’s probably user managed and we should not touch it”?
Currently.
if ! is_protected_file /etc/hosts ; then
sed -i "/^127\.0\.0\.1\s/,+0s/\(\s$hostname\)\+\(\s\|$\)/\2/g" /etc/hosts || true
fi
Proposed:
if ! is_protected_file /etc/hosts ; then
if ! test -L /etc/hosts; then
sed -i "/^127\.0\.0\.1\s/,+0s/\(\s$hostname\)\+\(\s\|$\)/\2/g" /etc/hosts || true
fi
fi
If acceptable, perhaps a shell function should test this instead. is_protected_file could check if it’s a symlink, and if it is, consider it protected.
I mean, who would use a symlink but still with automatic modifications?
[1] Here is a test script for developers.
#!/bin/bash
set -x
set -e
temp=$(mktemp --directory)
cd "$temp"
touch a
ln -s a b
echo "foo" > a
ls -la b
file b
sed -i 's/foo/bar/' b
ls -la b
file b
output:
+ set -e
++ mktemp --directory
+ temp=/tmp/user/1000/tmp.nZ1ROMG4Vy
+ cd /tmp/user/1000/tmp.nZ1ROMG4Vy
+ touch a
+ ln -s a b
+ echo foo
+ ls -la b
lrwxrwxrwx 1 user user 1 May 30 09:38 b -> a
+ file b
b: symbolic link to a
+ sed -i s/foo/bar/ b
+ ls -la b
-rw-r----- 1 user user 4 May 30 09:38 b
+ file b
b: ASCII text