whonix-ws-16 Template fails to update due to timing issue

[marmarek]

@Patrick

The ClockVM ticket might be the solution but also hard to implement. (https://phabricator.whonix.org/T387)

This doesn’t open for me:

Unhandled Exception ("RuntimeException")
strlen(): Passing null to parameter #1 ($string) of type string is deprecated

@Patrick

A wholly different approach would be commenting out fasttrack for Qubes by default as it isn’t very important for non-users of VirtualBox. (Fasttrack is primarily added to acquire VirtualBox Guest Additions which aren’t needed/useful/installed in Qubes(-Whonix).)

Wouldn’t then the issue still happen on VirtualBox? I’m not using this setup, so I don’t know. But if time randomization is used in VirtualBox too, I’d expect updates failing there similarly often.

@Patrick

Technically probably easy to implement. (+ or - sign is random. Easy to hardcode to “+” in Qubes Templates.)

As for privacy implications, not sure yet. Might not be ideal but perhaps a compromise we have to make.

BTW, we’ve seen the opposite issue too - signature made in the future was rejected by qubes builder. Not applicable to templates really, but may be worth considering when changing how time randomization works. Maybe a better solution would be to reduce the range to +/- few seconds (including random miliseconds offset) instead of few minutes?