Use hidden service repos for updates if updating over Tor

[andrewdavidwong]

Now that we have hidden service update repos (#2265 and #2266), the next step is to actually use them to download updates, if the user is downloading updates over Tor.

[andrewdavidwong]

If users want to manually start using the hidden service repos, is it enough simply to substitute every instance of yum.qubes-os.org with qubes-yum.kkkkkkkkkk63ava6.onion (and likewise for deb)?

Side question: If this is enough, then why is apt-transport-tor needed for Debian?

CC: @marmarek, @adrelanos

[andrewdavidwong]

If users want to manually start using the hidden service repos, is it enough simply to substitute every instance of yum.qubes-os.org with qubes-yum.kkkkkkkkkk63ava6.onion (and likewise for deb)?

Side question: If this is enough, then why is apt-transport-tor needed for Debian?

CC: @marmarek, @adrelanos

[marmarek]

Side question: If this is enough, then why is apt-transport-tor needed for Debian?

If you have Whonix Gateway or such in front of the template, it isn't needed in theory. In practice Debian stretch block (by default, changeable) .onion repositories without apt-transport-tor (see https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=754242 for reasoning). And apt-transport-tor will start local tor instance - so in our case it will be tor over tor.

For Fedora there isn't such problem, s/yum.qubes-os.org/qubes-yum.kkkkkkkkkk63ava6.onion/ is enough.

Somehow tricky part here is when onion mirror should be used. Some automatic detection? User configuration (manual substitute)? Alternative package with repositories definition (also installed by explicit user request)?

[marmarek]

Side question: If this is enough, then why is apt-transport-tor needed for Debian?

If you have Whonix Gateway or such in front of the template, it isn't needed in theory. In practice Debian stretch block (by default, changeable) .onion repositories without apt-transport-tor (see https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=754242 for reasoning). And apt-transport-tor will start local tor instance - so in our case it will be tor over tor.

For Fedora there isn't such problem, s/yum.qubes-os.org/qubes-yum.kkkkkkkkkk63ava6.onion/ is enough.

Somehow tricky part here is when onion mirror should be used. Some automatic detection? User configuration (manual substitute)? Alternative package with repositories definition (also installed by explicit user request)?

[andrewdavidwong]

Somehow tricky part here is when onion mirror should be used. Some automatic detection? User configuration (manual substitute)? Alternative package with repositories definition (also installed by explicit user request)?

One idea is to use the onion mirrors if the user opts to route all traffic through Tor at installation, but the problem is that the user might change his or her mind later and try to switch the TemplateVMs' NetVM from sys-whonix to sys-firewall, so this is indeed tricky.

[andrewdavidwong]

Somehow tricky part here is when onion mirror should be used. Some automatic detection? User configuration (manual substitute)? Alternative package with repositories definition (also installed by explicit user request)?

One idea is to use the onion mirrors if the user opts to route all traffic through Tor at installation, but the problem is that the user might change his or her mind later and try to switch the TemplateVMs' NetVM from sys-whonix to sys-firewall, so this is indeed tricky.

[andrewdavidwong]

For now, I've created some minimal documentation for this:

https://www.qubes-os.org/doc/hidden-service-repos/

[andrewdavidwong]

For now, I've created some minimal documentation for this:

https://www.qubes-os.org/doc/hidden-service-repos/

[marmarek]

The downside of such "manual" approach is the repository definitions are managed by some package, so if you modify it, you'll need to apply further updates also manually.

[marmarek]

The downside of such "manual" approach is the repository definitions are managed by some package, so if you modify it, you'll need to apply further updates also manually.

[adrelanos]

Side question: If this is enough, then why is apt-transport-tor needed for Debian?

Documentation on that question has just now been added here:
https://www.whonix.org/wiki/Advanced_Security_Guide#apt-transport-tor

[adrelanos]

Side question: If this is enough, then why is apt-transport-tor needed for Debian?

Documentation on that question has just now been added here:
https://www.whonix.org/wiki/Advanced_Security_Guide#apt-transport-tor

[andrewdavidwong]

Documentation on that question has just now been added here:
https://www.whonix.org/wiki/Advanced_Security_Guide#apt-transport-tor

Thanks, @adrelanos!

[andrewdavidwong]

Documentation on that question has just now been added here:
https://www.whonix.org/wiki/Advanced_Security_Guide#apt-transport-tor

Thanks, @adrelanos!

[fortasse]

There are also the slightly more "canonical" yum.qubesos4rrrrz6n4.onion, deb.qubesos4rrrrz6n4.onion and ftp.qubesos4rrrrz6n4.onion if you prefer to use those. Identical content, just under a different name.

[fortasse]

There are also the slightly more "canonical" yum.qubesos4rrrrz6n4.onion, deb.qubesos4rrrrz6n4.onion and ftp.qubesos4rrrrz6n4.onion if you prefer to use those. Identical content, just under a different name.

[andrewdavidwong]

Minimal documentation deleted per #2635.

[andrewdavidwong]

Minimal documentation deleted per #2635.

[andrewdavidwong]

@fortasse: Are the v3 onion repos also set up to serve updates, e.g., yum.sik5nlgfc5qylnnsr57qrbm64zbdx6t4lreyhpon3ychmxmiem7tioad.onion?

[andrewdavidwong]

@fortasse: Are the v3 onion repos also set up to serve updates, e.g., yum.sik5nlgfc5qylnnsr57qrbm64zbdx6t4lreyhpon3ychmxmiem7tioad.onion?

[fortasse]

@andrewdavidwong: Yes. All of the subdomains for qubesos4rrrrz6n4.onion should work on sik5nlgfc5qylnnsr57qrbm64zbdx6t4lreyhpon3ychmxmiem7tioad.onion. Let me know if that's not the case.

[fortasse]

@andrewdavidwong: Yes. All of the subdomains for qubesos4rrrrz6n4.onion should work on sik5nlgfc5qylnnsr57qrbm64zbdx6t4lreyhpon3ychmxmiem7tioad.onion. Let me know if that's not the case.