Replace old HTTPS repo warning with APT vuln warning #790
Conversation
|
In the discussion thread, it was suggested that users use the GUI tools to update the templates installed from the ISO. However, I opted to instead advise users to install fresh templates, since this is what we advised as the safer route in the QSB. A user who reads a recommendation in the installation guide to use the GUI tool, then reads the QSB, will be under the impression that the installation guide is being sloppy with respect to security. |
installing/installation-guide.md
Outdated
| 7. Check for updates normally. | ||
| 8. Shut down the TemplateVM. | ||
| After installing Qubes 4.0.1, please install fresh APT-based (e.g., Debian and Whonix) TemplateVMs in order to be protected from the APT update mechanism vulnerability that was patched after the release of 4.0.1. | ||
| For instructions and further details, please see [QSB #46]. |
There was a problem hiding this comment.
Since just after installation templates are definitely installed using rpm (not for example upgraded from previous template version or cloned), there is an easier option to reinstall them:
sudo qubes-dom0-update --action=upgrade qubes-template-debian-9
(and similar for other templates)
Do you think it worth noting it here? The full procedure described in the QSB of course works too, but is more complex (to handle the cases where template wasn't installed directly with rpm).
There was a problem hiding this comment.
Sure, let's make it easier on users.
There was a problem hiding this comment.
Let me know what you think of the updated recommendation, @marmarek.
installing/installation-guide.md
Outdated
| For instructions and further details, please see [QSB #46]. | ||
| Immediately after installing Qubes 4.0.1, please upgrade all of your APT-based (e.g., Debian and Whonix) TemplateVMs by executing the following command in a dom0 terminal for each such TemplateVM: | ||
|
|
||
| $ sudo qubes-dom0-update --action=upgrade <template-package-name> |
There was a problem hiding this comment.
Should it also mention relevant --enablerepo option for Whonix templates?
There was a problem hiding this comment.
Updated. How about now?
My understanding is that the old HTTPS repo warning is no longer applicable to users who are installing Qubes 4.0.1. Meanwhile, @v6ak has suggested adding a warning about QSB 46.