Whonix 11 upgrade stalls

Qubes-Whonix
1

I’ve been trying to upgrade following the instructions here Upgrading Whonix 10 to Whonix 11, but each time I try the install stalls/hangs at

apt-get dist-upgrade || apt-get -f install || apt-get dist-upgrade

It runs for a few hours getting all the updates and stops at Updating Qubes Apps Menus I left the machine on overnight and awoke to the same message. After that, if I kill the terminal window I am no longer able to open the terminal or anything else in that TemplateVM. I have to restore a backup and start again. I have tried this 3 times with the same result.

2

Did you forget Release Upgrade - Whonix this?

3

No. I did the Sanity Tests and the Pre Fixup steps each time.

4

This is a known Qubes qrexec bug. (https://groups.google.com/d/msg/qubes-users/MoUqGfMpMu0/2tGlVYbiBwAJ) It should not happen due to the pre fixup. I don’t have an explanation.

Anyhow. Each time it hangs, use this.

sudo killall qubes-trigger-sync-appmenus.sh

Edit /usr/lib/qubes/qubes-trigger-sync-appmenus.sh with root rights. Write “exit 0” below “#!/bin/sh”. Undo that after the update/restart is done. Run “/usr/lib/qubes/qrexec-client-vm dom0 qubes.SyncAppMenus /bin/sh /etc/qubes-rpc/qubes.GetAppmenus” manually after update/restart.

5

Thanks. Those instructions helped me complete the install after the hang.

I screwed up one step that might force me to do this over again. When following the steps for the upgrade I mistakenly did this on the Workstation (where the instructions clearly say it’s for the Whonix-Gateway only)

Now the Gateway reports a bug on Whonixcheck. Is there any way I can restore this? (Sorry I’m a bit new to this)

6

Just do that on the gateway. Then reboot. (easiest) No need to undo. No need to redo all.

7

By killing this on the Workstation during the upgrade I think I removed the control port. Now the Gateway gives me this when I run Whonixcheck:

[b]ERROR[/b]: Control Port Filter Proxy Test Result: File /var/run/control-port-filter-python/pid does not exist. Please report this Whonix bug
So my Whonix NetVM can't connect to Tor. On my Workstation I get the following error on Whonixcheck:
[b]ERROR[/b]: Tor Bootstrap Result: Tor's Control Port could not be reached!

Troubleshooting:

  • Confirm that Whonix-Gateway is running.
  • Run whonixcheck on Whonix-Gateway and confirm success.
  • If you’re running multiple Whonix-Workstations simultaneously, confirm that separate IP addresses are configured (see Multiple Whonix-Workstation).
  • Rerun whonixcheck here.

(Technical information:)
(Code: 255)
(tor_bootstrap_timeout_type: none)
(tor_bootstrap_status: Socket error: [Errno 111] Connection refused)
(check_socks_port_open_test: 22)
(Tor Circuit: not established)

8
By killing this on the Workstation during the upgrade I think I removed the control port.
Most unlikely. That file being on the workstation is a bug anyhow. (control-port-filter-python.service doesn't run and isn't installed on the workstation) (Fixed in Whonix 12.)

On the gateway, run this:

sudo service control-port-filter-python status

Expected output:

● control-port-filter-python.service - Control Port Filter Proxy
   Loaded: loaded (/lib/systemd/system/control-port-filter-python.service; enabled)
   Active: active (running) since Thu 2015-09-03 12:10:31 UTC; 35min ago
 Main PID: 1107 (cpfpd)
   CGroup: /system.slice/control-port-filter-python.service
           └─1107 /usr/bin/python /usr/sbin/cpfpd start

Sep 03 12:10:31 host systemd[1]: Started Control Port Filter Proxy

If it says “Loaded: loaded (/etc something”, then get rid of that file as documented.

9

OK. I got the service control port fixed. However, now I can’t update the Gateway or Workstation. On the gateway running Whonixcheck I get:

WARNING: Debian Package Update Check Result: Could not check for software updates! (apt-get code: 100) Please manually check: (Open a terminal, Start menu -> Applications -> System -> Terminal.) sudo apt-get update && sudo apt-get dist-upgrade
sudo apt-get update on the Gateway gives me [code]Hit http://deb.qubes-os.org jessie-testing InRelease Hit http://security.debian.org jessie/updates InRelease Ign http://ftp.us.debian.org jessie InRelease Hit http://mirror.whonix.de jessie InRelease Hit http://deb.torproject.org jessie InRelease Ign http://deb.qubes-os.org jessie-testing-testing InRelease Hit http://ftp.us.debian.org jessie Release.gpg Hit http://ftp.us.debian.org jessie Release Hit http://deb.qubes-os.org jessie-testing/main Sources Hit http://security.debian.org jessie/updates/non-free amd64 Packages Hit http://mirror.whonix.de jessie/main amd64 Packages Hit http://deb.torproject.org jessie/main amd64 Packages Ign http://deb.qubes-os.org jessie-testing-testing Release.gpg Hit http://security.debian.org jessie/updates/non-free Translation-en Hit http://deb.qubes-os.org jessie-testing/main amd64 Packages Hit http://security.debian.org jessie/updates/main amd64 Packages Hit http://ftp.us.debian.org jessie/main amd64 Packages Hit http://security.debian.org jessie/updates/contrib amd64 Packages Ign http://deb.qubes-os.org jessie-testing-testing Release Hit http://ftp.us.debian.org jessie/contrib amd64 Packages Hit http://security.debian.org jessie/updates/contrib Translation-en Hit http://ftp.us.debian.org jessie/non-free amd64 Packages Ign http://mirror.whonix.de jessie/main Translation-en_US Hit http://security.debian.org jessie/updates/main Translation-en Ign http://deb.torproject.org jessie/main Translation-en_US Hit http://ftp.us.debian.org jessie/contrib Translation-en Ign http://mirror.whonix.de jessie/main Translation-en Hit http://ftp.us.debian.org jessie/main Translation-en Ign http://deb.torproject.org jessie/main Translation-en Hit http://ftp.us.debian.org jessie/non-free Translation-en Ign http://deb.qubes-os.org jessie-testing/main Translation-en_US Ign http://deb.qubes-os.org jessie-testing/main Translation-en Err http://deb.qubes-os.org jessie-testing-testing/main amd64 Packages 404 Not Found Ign http://deb.qubes-os.org jessie-testing-testing/main Translation-en_US Ign http://deb.qubes-os.org jessie-testing-testing/main Translation-en W: Failed to fetch http://deb.qubes-os.org/r3.0/vm/dists/jessie-testing-testing/main/binary-amd64/Packages 404 Not Found

E: Some index files failed to download. They have been ignored, or old ones used instead.[/code]
However, the Tor browser runs in the Workstation, so Tor is connected. Arm shows traffic. I just cant update.

10

Fix your /etc/apt/sources.list.d/qubes-r3.list.

->

11

Thanks for catching that. I’m not sure how that got in there as I only uncommented the line in the qubes-r3.list as per the instructions. But it was in both my Gateway and Workstation. Getting rid of that seems to have solved the remainder of my upgrade issues. I really appreciate your assistance with this!