Implement improved Updater GUI

[marmarta]

Qubes OS release (if applicable)

r4.2

Brief summary

Implement a better updater GUI, as designed by me here: https://www.figma.com/file/iC1QiLzAedKoWGDuo95WkP/Updater?node-id=0%3A1&t=CjGopIbyDER2t1Mw-0

Some screenshots:

[andrewdavidwong]

Looks great! Some minor feedback:

• Seven days as a default seems far too long. It should be one day by default, IMHO.

• The "Update Check" description is a bit unclear. I suggest something like this: "Qubes OS periodically checks for updates in running qubes. When updates are found in a qube, Qubes OS notifies you that updates are available for the template on which that qube is based. If you haven't run any qubes for a particular template in a while, or if updates become available in between checks, then updates may be available even though Qubes OS hasn't notified you. You can always run the Qubes OS Updater to check for and install any available updates on-demand."

• In the last screenshot, "Update Check" is in title case, while "Restart after Update" is in mixed case. Recommend consistently using either sentence case or title case for all headings.

• I worry a bit that some users will still lose data to restarts even with all the warnings, but I see the value of the feature. We might want to consider an additional confirmation prompt (with a "never show this again" option for those who know what they're doing).

[marmarek]

• Seven days as a default seems far too long. It should be one day by default, IMHO.

This is a fallback case, for example if you don't run any online qube based on a template. Normal update check is performed more often (but it's also much cheaper, as it's using already running qubes). Anyway, it's a configurable value for a reason, if you feel you want to force-update all templates daily, you are free to do so.

• I worry a bit that some users will still lose data to restarts even with all the warnings, but I see the value of the feature. We might want to consider an additional confirmation prompt (with a "never show this again" option for those who know what they're doing).

The idea for this option is to have only sys-* qubes included by default. And allow user to include others on opt-in basis. In fact, the setting for this may need a different structure - have "include" instead of "exclude". Or maybe separate checkbox fox system qubes?

[GWeck]

The automatic restart should do no harm for templates that are selected because some AppVMs are based on them - these templates normally are not running anyhow. The danger of data loss is more relevant for standalone VMs. For AppVMs, an immediate restart might not be necessary if the corresponding template was updated, so their restart could be left at the user's discretion. But what would be a good strategy for restarting sys-* qubes?

[marmarta]

• The "Update Check" description is a bit unclear. I suggest something like this: "Qubes OS periodically checks for updates in running qubes. When updates are found in a qube, Qubes OS notifies you that updates are available for the template on which that qube is based. If you haven't run any qubes for a particular template in a while, or if updates become available in between checks, then updates may be available even though Qubes OS hasn't notified you. You can always run the Qubes OS Updater to check for and install any available updates on-demand."

That's a bit of a wall of text when put into the widget. What do you think about:
"Qubes OS checks for updates only for running qubes and their templates. Updates can become available when Qubes OS has no chance of checking for them, in case of halted or non-networked qubes.
Attempt to update qubes after [ X days ] without checking for updates"

[marmarta]

I propose following changes, according to @marmarek and @andrewdavidwong 's feedback:

[brendanhoar]

The suggested English-language (header+paragraph) change is closer but still seems somewhat contradictory in nature, as the statement "only for running qubes" is not true if this option is enabled...

Perhaps change the header/paragraph to indicate that this this config option is a supplementary forced update (forced update check?) if the standard method has not been triggered in n days?

Did I make sense?

B