Kicksecure Qubes Template Development - Qubes Integration

Patrick · November 23, 2025, 9:19am

github.com/QubesOS/qubes-video-companion

Add privleap support

main ← ArrayBolt3:arraybolt3/privleap

opened 01:52AM - 18 Nov 25 UTC

Under Kicksecure and Whonix 18, sudo is no longer executable by "normal" users, …and is only accessible when booting in a special "sysmaint mode". This prevents QVC from loading v4l2loopback. Kicksecure introduces a more limited escalation framework, privleap, which can be used by explicitly authorized normal users (including the `user` account present by default in most AppVMs). Add a privleap rule to QVC that allows users in the sudo, privleap, and qubes groups to load the v4l2loopback module on demand. If sudo is not executable or execution of sudo fails, try to use privleap instead. Fixes: https://github.com/QubesOS/qubes-issues/issues/10163

Patrick · November 23, 2025, 7:19pm

Qubes upstream issue, unspecific to Kicksecure:

Installing template 'kicksecure-18'...
kicksecure-18: Importing data
kicksecure-18: qubes.PostInstall service failed

Fix:

Patrick · November 29, 2025, 6:11am

github.com/QubesOS/qubes-issues

qubes-dist-upgrade broken when there is an HVM qube

opened 04:49PM - 28 Nov 25 UTC

Nurmagoz

P: default needs diagnosis affects-4.3

[How to file a helpful issue](https://www.qubes-os.org/doc/issue-tracking/) ###… Qubes OS release Tested on 4.3-rc3 ### Brief summary https://doc.qubes-os.org/en/latest/user/downloading-installing-upgrading/upgrade/4_3.html ### Steps to reproduce ``` user@dom0:~/Desktop$ sudo qubes-dom0-update -y qubes-dist-upgrade Using sys-firewall as UpdateVM for Dom0 Downloading packages. This may take a while... Updating and loading repositories: Fedora 41 - x86_64 ???% | 0.0 Bting) ???% | 0.0 B.0 B Fedora 41 - x86_64 ???% | 0.0 Bting) 100% | 2.8 KiB_[1A Fedora 41 - x86_64 ???% | 0.0 Bting) 100% | 2.8 KiB_[1A Fedora 41 - x86_64 100% | 8.4 KiBting) 100% | 2.8 KiB_[1A Fedora 41 - x86_64 - Updates ???% | 0.0 B | 2.8 KiB_[1A Fedora 41 - x86_64 100% | 8.4 KiB Fedora 41 - x86_64 - Updates ???% | 0.0 B | 2.8 KiB_[2A Fedora 41 - x86_64 100% | 8.4 KiB Fedora 41 - x86_64 - Updates ???% | 0.0 B | 2.8 KiB_[2A Fedora 41 - x86_64 100% | 8.4 KiB Qubes Host Repository (updates) ???% | 0.0 B 2.8 KiB_[2A Fedora 41 - x86_64 - Updates 100% | 7.4 KiB Fedora 41 - x86_64 100% | 8.4 KiB Qubes Host Repository (updates) ???% | 0.0 B 2.8 KiB_[3A Fedora 41 - x86_64 - Updates 100% | 7.4 KiB Fedora 41 - x86_64 100% | 8.4 KiB Qubes Host Repository (updates) ???% | 0.0 B 2.8 KiB_[3A Fedora 41 - x86_64 - Updates 100% | 7.4 KiB Fedora 41 - x86_64 100% | 8.4 KiB Qubes Host Repository (updates-testing) ???% | 0.0 BB_[3A Qubes Host Repository (updates) 100% | 2.7 KiB Fedora 41 - x86_64 - Updates 100% | 7.4 KiB Fedora 41 - x86_64 100% | 8.4 KiB Qubes Host Repository (updates-testing) ???% | 0.0 BB_[4A Qubes Host Repository (updates) 100% | 2.7 KiB Fedora 41 - x86_64 - Updates 100% | 7.4 KiB Fedora 41 - x86_64 100% | 8.4 KiB Qubes Host Repository (updates-testing) ???% | 0.0 BB_[4A Qubes Host Repository (updates) 100% | 2.7 KiB Fedora 41 - x86_64 - Updates 100% | 7.4 KiB Fedora 41 - x86_64 100% | 8.4 KiB Qubes Host Repository (security-testing) 100% | 2.8 KiB_[4A Qubes Host Repository (updates-testing) 100% | 2.8 KiB Qubes Host Repository (updates) 100% | 2.7 KiB Fedora 41 - x86_64 - Updates 100% | 7.4 KiB Fedora 41 - x86_64 100% | 8.4 KiB_[3A Qubes Host Repository (updates-testing) 100% | 2.8 KiB Qubes Host Repository (updates) 100% | 2.7 KiB Fedora 41 - x86_64 - Updates 100% | 7.4 KiB_[2A Qubes Host Repository (updates-testing) 100% | 2.8 KiB Qubes Host Repository (updates) 100% | 2.7 KiB_[1A Qubes Host Repository (updates-testing) 100% | 2.8 KiB _[?25hRepositories loaded. _[1mPackage _[0m _[1mArch _[0m _[1mVersion _[0m _[1mRepository _[0m _[1m Size_[0m Installing: _[32m qubes-dist-upgrade _[0m noarch 4.2.2-1.fc41 qubes-dom0-curr 53.4 KiB Installing dependencies: _[32m xinput _[0m x86_64 1.6.4-3.fc41 fedora 62.2 KiB Transaction Summary: Installing: 2 packages Total size of inbound packages is 58 KiB. Need to download 58 KiB. After this operation, 116 KiB extra will be used (install 116 KiB, remove 0 B). The operation will only download packages for the transaction. _[?25l[1/2] qubes-dist-upgrade-0:4.2.2-1.fc41.noarch 0% | 0.0 B [1/2] qubes-dist-upgrade-0:4.2.2-1.fc41.noarch 0% | 0.0 B [2/2] xinput-0:1.6.4-3.fc41.x86_64 0% | 0.0 B [1/2] qubes-dist-upgrade-0:4.2.2-1.fc41.noarch 0% | 0.0 B [2/2] xinput-0:1.6.4-3.fc41.x86_64 0% | 0.0 B [1/2] qubes-dist-upgrade-0:4.2.2-1.fc41.noarch 0% | 0.0 B [2/2] xinput-0:1.6.4-3.fc41.x86_64 0% | 0.0 B [1/2] qubes-dist-upgrade-0:4.2.2-1.fc41.noarch 0% | 0.0 B [2/2] xinput-0:1.6.4-3.fc41.x86_64 0% | 0.0 B [1/2] qubes-dist-upgrade-0:4.2.2-1.fc41.noarch 0% | 0.0 B [2/2] xinput-0:1.6.4-3.fc41.x86_64 0% | 0.0 B [1/2] qubes-dist-upgrade-0:4.2.2-1.fc41.noarch 0% | 0.0 B [2/2] xinput-0:1.6.4-3.fc41.x86_64 0% | 0.0 B [1/2] qubes-dist-upgrade-0:4.2.2-1.fc41.noarch 0% | 0.0 B [2/2] xinput-0:1.6.4-3.fc41.x86_64 31% | 11.7 KiB [1/2] qubes-dist-upgrade-0:4.2.2-1.fc41.noarch 100% | 21.6 KiB [2/2] xinput-0:1.6.4-3.fc41.x86_64 31% | 11.7 KiB [2/2] xinput-0:1.6.4-3.fc41.x86_64 64% | 23.7 KiB [2/2] xinput-0:1.6.4-3.fc41.x86_64 100% | 36.9 KiB [2/2] Total 100% | 58.5 KiB Complete! _[?25hUpdating and loading repositories: Qubes OS Repository for Dom0 100% | 154.0 KiB/s | 2.6 KiB | 00m00s Repositories loaded. Package Arch Version Repository Size Installing: qubes-dist-upgrade noarch 4.2.2-1.fc41 qubes-dom0-cach 53.4 KiB Installing dependencies: xinput x86_64 1.6.4-3.fc41 qubes-dom0-cach 62.2 KiB Transaction Summary: Installing: 2 packages Total size of inbound packages is 50 KiB. Need to download 50 KiB. After this operation, 116 KiB extra will be used (install 116 KiB, remove 0 B). [1/2] qubes-dist-upgrade-0:4.2.2-1.fc41 100% | 628.4 KiB/s | 17.0 KiB | 00m00s [2/2] xinput-0:1.6.4-3.fc41.x86_64 100% | 813.6 KiB/s | 33.4 KiB | 00m00s -------------------------------------------------------------------------------- [2/2] Total 100% | 1.2 MiB/s | 50.3 KiB | 00m00s Running transaction [1/4] Verify package files 100% | 1.0 KiB/s | 2.0 B | 00m00s [2/4] Prepare transaction 100% | 6.0 B/s | 2.0 B | 00m00s [3/4] Installing xinput-0:1.6.4-3.fc41. 100% | 2.0 KiB/s | 100.0 B | 00m00s [4/4] Installing qubes-dist-upgrade-0:4 100% | 153.0 B/s | 100.0 B | 00m01s Complete!####################################################################### user@dom0:~/Desktop$ sudo qubes-dist-upgrade --releasever=4.3 --template-standalone-upgrade INFO: Please wait while running pre-checks... INFO: Found sys-usb providing input devices. It will be kept running. INFO: Found sys-usb providing input devices. It will be kept running. INFO: Found sys-usb providing input devices. It will be kept running. INFO: Found sys-usb providing input devices. It will be kept running. INFO: Found sys-usb providing input devices. It will be kept running. WARNING: /!\ MAKE SURE YOU HAVE MADE A BACKUP OF ALL YOUR VMs AND dom0 DATA /!\ -> Launch upgrade process? [y/N] y ---> Allow shutdown of unnecessary VM (use --keep-running to exclude some): debian-personal? [y/N] y ---> (STAGE 4) Upgrade templates and standalone VMs to R4.3 repository... ----> Upgrading debian-13-minimal... + [[ 0 -ne 0 ]] + enable_current_testing= + '[' '' = --enable-current-testing ']' + '[' -e /etc/fedora-release ']' + '[' -e /etc/debian_version ']' ++ awk -F. '{print $1}' /etc/debian_version + releasever=13 + '[' 13 -lt 12 ']' + cp /etc/apt/sources.list.d/qubes-r4.list /etc/apt/sources.list.d/qubes-r4.list.bak + sed -i s/r4.2/r4.3/g /etc/apt/sources.list.d/qubes-r4.list + sed -i 's/\[arch=amd64$ signed-by=.*$\?\]/[arch=amd64\ signed-by=\/usr\/share\/keyrings\/qubes-archive-keyring-4.3.gpg]/g' /etc/apt/sources.list.d/qubes-r4.list + export DEBIAN_FRONTEND=noninteractive + DEBIAN_FRONTEND=noninteractive + '[' '' ']' + apt-get clean + apt-get update -o Dpkg::Options::=--force-confdef Hit:1 https://deb.debian.org/debian trixie InRelease Get:2 https://deb.debian.org/debian trixie-updates InRelease [47.3 kB] Hit:3 https://updates.signal.org/desktop/apt xenial InRelease Get:4 https://deb.debian.org/debian-security trixie-security InRelease [43.4 kB] Get:5 https://deb.debian.org/debian trixie-backports InRelease [54.0 kB] Get:6 https://deb.debian.org/debian-security trixie-security/main amd64 Packages [75.6 kB] Get:7 https://deb.debian.org/debian-security trixie-security/main Translation-en [48.9 kB] Get:8 https://deb.debian.org/debian trixie-backports/main amd64 Packages.diff/Index [63.3 kB] Hit:9 https://deb.qubes-os.org/r4.3/vm trixie InRelease Get:10 https://deb.debian.org/debian trixie-backports/main amd64 Packages T-2025-11-27-2004.59-F-2025-11-27-2004.59.pdiff [1,529 B] Get:10 https://deb.debian.org/debian trixie-backports/main amd64 Packages T-2025-11-27-2004.59-F-2025-11-27-2004.59.pdiff [1,529 B] Fetched 334 kB in 1s (490 kB/s) Reading package lists... + apt-get dist-upgrade -y --no-install-recommends -o Dpkg::Options::=--force-confdef Reading package lists... Building dependency tree... Reading state information... Calculating upgrade... 0 upgraded, 0 newly installed, 0 to remove and 0 not upgraded. + '[' '' ']' ----> Upgrading debian-13-xfce... + [[ 0 -ne 0 ]] + enable_current_testing= + '[' '' = --enable-current-testing ']' + '[' -e /etc/fedora-release ']' + '[' -e /etc/debian_version ']' ++ awk -F. '{print $1}' /etc/debian_version + releasever=13 + '[' 13 -lt 12 ']' + cp /etc/apt/sources.list.d/qubes-r4.list /etc/apt/sources.list.d/qubes-r4.list.bak + sed -i s/r4.2/r4.3/g /etc/apt/sources.list.d/qubes-r4.list + sed -i 's/\[arch=amd64$ signed-by=.*$\?\]/[arch=amd64\ signed-by=\/usr\/share\/keyrings\/qubes-archive-keyring-4.3.gpg]/g' /etc/apt/sources.list.d/qubes-r4.list + export DEBIAN_FRONTEND=noninteractive + DEBIAN_FRONTEND=noninteractive + '[' '' ']' + apt-get clean + apt-get update -o Dpkg::Options::=--force-confdef Hit:1 https://deb.debian.org/debian trixie InRelease Get:2 https://deb.debian.org/debian trixie-updates InRelease [47.3 kB] Get:3 https://deb.debian.org/debian-security trixie-security InRelease [43.4 kB] Get:4 https://deb.debian.org/debian trixie-backports InRelease [54.0 kB] Get:5 https://deb.debian.org/debian-security trixie-security/main amd64 Packages [75.6 kB] Get:6 https://deb.debian.org/debian-security trixie-security/main Translation-en [48.9 kB] Get:7 https://deb.debian.org/debian trixie-backports/main amd64 Packages.diff/Index [63.3 kB] Get:8 https://deb.debian.org/debian trixie-backports/main Translation-en.diff/Index [63.3 kB] Get:9 https://deb.debian.org/debian trixie-backports/non-free-firmware amd64 Packages.diff/Index [3,854 B] Get:10 https://deb.debian.org/debian trixie-backports/main amd64 Packages T-2025-11-27-2004.59-F-2025-11-18-0216.31.pdiff [37.0 kB] Get:11 https://deb.debian.org/debian trixie-backports/main Translation-en T-2025-11-26-0204.33-F-2025-11-18-0216.31.pdiff [12.9 kB] Get:11 https://deb.debian.org/debian trixie-backports/main Translation-en T-2025-11-26-0204.33-F-2025-11-18-0216.31.pdiff [12.9 kB] Get:10 https://deb.debian.org/debian trixie-backports/main amd64 Packages T-2025-11-27-2004.59-F-2025-11-18-0216.31.pdiff [37.0 kB] Get:12 https://deb.qubes-os.org/r4.3/vm trixie InRelease [4,735 B] Get:13 https://deb.debian.org/debian trixie-backports/non-free-firmware amd64 Packages T-2025-11-26-0204.33-F-2025-11-26-0204.33.pdiff [2,276 B] Get:13 https://deb.debian.org/debian trixie-backports/non-free-firmware amd64 Packages T-2025-11-26-0204.33-F-2025-11-26-0204.33.pdiff [2,276 B] Get:14 https://deb.qubes-os.org/r4.3/vm trixie/main amd64 Packages [38.6 kB] Fetched 495 kB in 1s (546 kB/s) Reading package lists... + apt-get dist-upgrade -y --no-install-recommends -o Dpkg::Options::=--force-confdef Reading package lists... Building dependency tree... Reading state information... Calculating upgrade... The following packages will be upgraded: qubes-input-proxy-sender salt-common salt-ssh 3 upgraded, 0 newly installed, 0 to remove and 0 not upgraded. Need to get 3,830 kB of archives. After this operation, 75.8 kB of additional disk space will be used. Get:1 https://deb.qubes-os.org/r4.3/vm trixie/main amd64 qubes-input-proxy-sender amd64 1.0.45-1+deb13u1 [12.4 kB] Get:2 https://deb.qubes-os.org/r4.3/vm trixie/main amd64 salt-ssh all 3007.8-1+deb13u1 [21.5 kB] Get:3 https://deb.qubes-os.org/r4.3/vm trixie/main amd64 salt-common all 3007.8-1+deb13u1 [3,796 kB] Fetched 3,830 kB in 3s (1,468 kB/s) (Reading database ... 139519 files and directories currently installed.) Preparing to unpack .../qubes-input-proxy-sender_1.0.45-1+deb13u1_amd64.deb ... Unpacking qubes-input-proxy-sender (1.0.45-1+deb13u1) over (1.0.43-1+deb13u1) ... Preparing to unpack .../salt-ssh_3007.8-1+deb13u1_all.deb ... Unpacking salt-ssh (3007.8-1+deb13u1) over (3007.6-2+deb13u1) ... Preparing to unpack .../salt-common_3007.8-1+deb13u1_all.deb ... Unpacking salt-common (3007.8-1+deb13u1) over (3007.6-2+deb13u1) ... Setting up salt-common (3007.8-1+deb13u1) ... Setting up salt-ssh (3007.8-1+deb13u1) ... Setting up qubes-input-proxy-sender (1.0.45-1+deb13u1) ... Processing triggers for man-db (2.13.1-1) ... Reading package lists... Building dependency tree... Reading state information... Calculating upgrade... 0 upgraded, 0 newly installed, 0 to remove and 0 not upgraded. + '[' '' ']' ----> Upgrading fedora-42-minimal... + [[ 0 -ne 0 ]] + enable_current_testing= + '[' '' = --enable-current-testing ']' + '[' -e /etc/fedora-release ']' ++ awk '{print $3}' /etc/fedora-release + releasever=42 + '[' 42 -lt 41 ']' + cp /etc/yum.repos.d/qubes-r4.repo /etc/yum.repos.d/qubes-r4.repo.bak + sed -i s/r4.2/r4.3/g /etc/yum.repos.d/qubes-r4.repo + sed -i 's/4\.2-primary/4.3-primary/g' /etc/yum.repos.d/qubes-r4.repo + dnf_opts=() + '[' '' ']' + dnf clean all Removed 0 files, 0 directories (total of 0 B). 0 errors occurred. + dnf distro-sync -y --best --allowerasing Updating and loading repositories: Qubes OS Repository for VM (updates) 100% | 35.8 KiB/s | 108.4 KiB | 00m03s Fedora 42 openh264 (From Cisco) - x86_ 100% | 1.0 KiB/s | 5.8 KiB | 00m06s Fedora 42 - x86_64 - Updates 100% | 1.7 MiB/s | 10.9 MiB | 00m06s Fedora 42 - x86_64 100% | 1.4 MiB/s | 15.8 MiB | 00m11s Repositories loaded. Nothing to do. ----> Upgrading fedora-42-xfce... + [[ 0 -ne 0 ]] + enable_current_testing= + '[' '' = --enable-current-testing ']' + '[' -e /etc/fedora-release ']' ++ awk '{print $3}' /etc/fedora-release + releasever=42 + '[' 42 -lt 41 ']' + cp /etc/yum.repos.d/qubes-r4.repo /etc/yum.repos.d/qubes-r4.repo.bak + sed -i s/r4.2/r4.3/g /etc/yum.repos.d/qubes-r4.repo + sed -i 's/4\.2-primary/4.3-primary/g' /etc/yum.repos.d/qubes-r4.repo + dnf_opts=() + '[' '' ']' + dnf clean all Removed 0 files, 0 directories (total of 0 B). 0 errors occurred. + dnf distro-sync -y --best --allowerasing Updating and loading repositories: Fedora 42 - x86_64 - Updates 100% | 1.1 MiB/s | 7.1 MiB | 00m07s Fedora 42 openh264 (From Cisco) - x86_ 100% | 982.0 B/s | 5.8 KiB | 00m06s Qubes OS Repository for VM (updates) 100% | 41.2 KiB/s | 188.4 KiB | 00m05s Fedora 42 - x86_64 100% | 2.0 MiB/s | 15.5 MiB | 00m08s Repositories loaded. Nothing to do. ----> Upgrading whonix-gateway-18... bash: /home/user/QubesIncoming/dom0/qubes-dist-upgrade-r4.3-vm.sh: No such file or directory ERROR: A general error occurred while upgrading whonix-gateway-18 (exit code 127). -> Continue? [y/N] y ----> Upgrading whonix-workstation-18... bash: /home/user/QubesIncoming/dom0/qubes-dist-upgrade-r4.3-vm.sh: No such file or directory ERROR: A general error occurred while upgrading whonix-workstation-18 (exit code 127). -> Continue? [y/N] y ----> Upgrading Debian-Lxqt... 2025-11-28 12:16:06.133 qrexec-client[50683]: qrexec-daemon-common.c:263:connect_unix_socket: connect /var/run/qubes/qrexec.Debian-Lxqt: No such file or directory 2025-11-28 12:16:06.133 qrexec-client[50683]: qrexec-daemon-common.c:31:negotiate_connection_params: write daemon: Bad file descriptor EOF user@dom0:~/Desktop$ ``` ### Additional information Debian-Lxqt is an HVM.

Patrick · November 29, 2025, 6:13am

github.com/QubesOS/qubes-issues

Qube Manager crashes when attempting to view settings for a qube containing PCI devices that no longer exist

opened 12:54AM - 17 Nov 25 UTC

ArrayBolt3

C: Qubes GUI tools P: default needs diagnosis affects-4.3

[How to file a helpful issue](https://www.qubes-os.org/doc/issue-tracking/) ###… Qubes OS release R4.3 ### Brief summary Yesterday, I ended up moving my testing Qubes OS installation from a fairly recent Intel-based system (13th gen CPU) to a somewhat older one (11th gen CPU). The USB controller in this system is different than the one in the previous system, and so sys-usb would not start since it couldn't pass through a non-existent PCI device. To resolve this, I assumed I'd be able to open Qube Manager, select sys-usb, click Settings, then go to the Devices tab and remove the non-existent device. Unfortunately, upon clicking the "Settings" button, Qube Manager crashed. ### Steps to reproduce 1. Install Qubes OS R4.3 on a machine with a particular generation of Intel CPU (I assume AMD CPUs will show the same problems). 2. Boot the installed system once, verify sys-usb and sys-net start, then shut the system down properly. 3. Move the drive from the system where you installed it to some other system with a different generation of Intel CPU. 4. Boot the installed system. sys-usb should not start. 5. Attempt to start sys-usb. You should see an error about a PCI device not being available. 6. In dom0, open xfce4-terminal, and run `qubes-qube-manager`. 7. Click on sys-usb. 8. Click the Settings button. ### Expected behavior VM settings window appears. ### Actual behavior Qube Manager crashes, and a Python exception is printed in the terminal. ### Additional information I was able to recover from this state by running `sudo qvm-pci unassign sys-usb`. After this, the settings window would open normally for sys-usb.

Patrick · November 29, 2025, 12:31pm

github.com/QubesOS/updates-status

qubes-template-kicksecure-18 4.3.0-202511271158 (r4.3)

opened 11:58AM - 27 Nov 25 UTC

fepitre-bot

r4.3-testing

Template kicksecure-18 4.3.0-202511271158 for Qubes OS r4.3, see comments below …for details and build status. If you're release manager, you can issue GPG-inline signed command (depending on template): * `Upload-template r4.3 kicksecure-18 4.3.0-202511271158 templates-itl` (available 5 days from now) * `Upload-template r4.3 kicksecure-18 4.3.0-202511271158 templates-community` (available 5 days from now) Above commands will work only if package in testing repository isn't superseded by newer version. For more information on how to test this update, please take a look at https://www.qubes-os.org/doc/testing/#updates.

Patrick · December 1, 2025, 2:55pm

github.com/QubesOS/qubes-issues

Broken Kicksecure StandaloneVM if upgraded to Kicksecure 18 (debain 13)

opened 10:58AM - 01 Dec 25 UTC

Nurmagoz

P: default

[How to file a helpful issue](https://www.qubes-os.org/doc/issue-tracking/) ###… Qubes OS release 4.3rc3 ### Brief summary User with StandaloneVM based on debian 12 morphed into KS 17 cant upgrade to KS 18. ### Steps to reproduce - Install debian 12 - Add KS repository - Install `kicksecure-cli` and `kicksecure-qubes-cli` packages (not gui/lxqt/xfce/full) - Install `user-sysmaint-split` package - After that, disable/comment out KS repo - Change debian repos from bookworm to trixie, and qubes from 4.2 bookworm to 4.3 trixie (if not done already) - Update the repos and Upgrade with this command `apt --no-install-recommends full-upgrade` to avoid extra not meant to be installed software/firmware, everything will go ok even if using `apt autoremove "--purge" && apt autoclean` - Enable KS repo and switch it to trixie - Update the repos `apt update` - run `release-upgrade` - If after that `apt autoremove "--purge" && apt autoclean` will be used, it will lead to unusable/broken KS (clearly seen after reboot). ### Logs - Upgrading KS with `release-upgrade` log: [upgradelog.txt](https://github.com/user-attachments/files/23851720/upgradelog.txt) - Using `apt autoremove "--purge" && apt autoclean` ``` [root ~]# apt update && apt full-upgrade && apt autoremove --purge && apt autoclean Hit:1 https://deb.kicksecure.com trixie-testers InRelease Get:2 https://deb.qubes-os.org/r4.3/vm trixie InRelease [4,735 B] Hit:3 tor+https://fasttrack.debian.net/debian-fasttrack trixie-fasttrack InRelease Hit:4 tor+https://deb.debian.org/debian trixie InRelease Hit:5 tor+https://fasttrack.debian.net/debian-fasttrack trixie-backports-staging InRelease Hit:6 tor+https://deb.debian.org/debian trixie-updates InRelease Hit:7 tor+https://deb.debian.org/debian trixie-backports InRelease Hit:8 tor+https://deb.debian.org/debian-security trixie-security InRelease Fetched 4,735 B in 1s (3,167 B/s) All packages are up to date. The following packages were automatically installed and are no longer required: anon-apt-sources-list net-tools apparmor-profile-hexchat openvpn apparmor-profile-thunderbird p7zip-full apparmor-profile-torbrowser pcmciautils apparmor-profiles-kicksecure policyrcd-script-zg2 base58 pwgen bind9-dnsutils python3-autobahn bind9-host python3-automat bind9-libs python3-base58 boot-info-script python3-constantly check-dfsg-status python3-ecdsa codecrypt python3-flatbuffers damngpl python3-geoip debsums python3-hamcrest desktop-config-dist python3-humanize diceware python3-hyperlink dist-base-files python3-incremental dmeventd python3-iterable-io extrepo python3-legacycrypt extrepo-offline-data python3-lz4 fasttrack-archive-keyring python3-mnemonic geoip-database python3-msgpack grub2-common python3-nacl initializer-dist python3-passlib iotop python3-png jitterentropy-rngd python3-pyasn1 kicksecure-base-files python3-pyasn1-modules kicksecure-cli python3-pyqrcode kicksecure-default-applications-cli python3-service-identity kicksecure-dependencies-cli python3-snappy kicksecure-recommended-cli python3-sortedcontainers libblockdev-crypto2 python3-spake2 libblockdev-utils2 python3-trie libbytes-random-secure-perl python3-twisted libcommon-sense-perl python3-txaio libcrypt-passwdmd5-perl python3-txtorcon libcrypt-random-seed-perl python3-u-msgpack libcrypto++8t64 python3-ubjson libcryptx-perl python3-ujson libdevmapper-event1.02.1 python3-wsaccel libfile-find-rule-perl python3-zipstream-ng libfile-fnmatch-perl python3-zope.interface libfstrm0 qubes-input-proxy-sender libgeoip1t64 qubes-kernel-vm-support libjemalloc2 qubes-usb-proxy libjpeg-turbo-progs repository-dist libjson-perl signify-openbsd libjson-xs-perl spectre-meltdown-checker liblvm2cmd2.03 sysfsutils libmath-random-isaac-perl systemcheck libmaxminddb0 tb-default-browser libnumber-compare-perl traceroute libpam-tmpdir usability-misc libpkcs11-helper1t64 usbutils libprotobuf-c1 usrmerge libsysfs2 vim libtext-glob-perl vim-common libturbojpeg0 vim-runtime libtypes-serialiser-perl vrms liburcu8t64 wmctrl libyaml-libyaml-perl xscreensaver-data lvm2 zsh magic-wormhole zsh-autosuggestions makepasswd zsh-common most zsh-syntax-highlighting Use 'apt autoremove' to remove them. Summary: Upgrading: 0, Installing: 0, Removing: 0, Not Upgrading: 0 REMOVING: anon-apt-sources-list* net-tools* apparmor-profile-hexchat* openvpn* apparmor-profile-thunderbird* p7zip-full* apparmor-profile-torbrowser* pcmciautils* apparmor-profiles-kicksecure* policyrcd-script-zg2* base58* pwgen* bind9-dnsutils* python3-autobahn* bind9-host* python3-automat* bind9-libs* python3-base58* boot-info-script* python3-constantly* check-dfsg-status* python3-ecdsa* codecrypt* python3-flatbuffers* damngpl* python3-geoip* debsums* python3-hamcrest* desktop-config-dist* python3-humanize* diceware* python3-hyperlink* dist-base-files* python3-incremental* dmeventd* python3-iterable-io* extrepo* python3-legacycrypt* extrepo-offline-data* python3-lz4* fasttrack-archive-keyring* python3-mnemonic* geoip-database* python3-msgpack* grub2-common* python3-nacl* initializer-dist* python3-passlib* iotop* python3-png* jitterentropy-rngd* python3-pyasn1* kicksecure-base-files* python3-pyasn1-modules* kicksecure-cli* python3-pyqrcode* kicksecure-default-applications-cli* python3-service-identity* kicksecure-dependencies-cli* python3-snappy* kicksecure-recommended-cli* python3-sortedcontainers* libblockdev-crypto2* python3-spake2* libblockdev-utils2* python3-trie* libbytes-random-secure-perl* python3-twisted* libcommon-sense-perl* python3-txaio* libcrypt-passwdmd5-perl* python3-txtorcon* libcrypt-random-seed-perl* python3-u-msgpack* libcrypto++8t64* python3-ubjson* libcryptx-perl* python3-ujson* libdevmapper-event1.02.1* python3-wsaccel* libfile-find-rule-perl* python3-zipstream-ng* libfile-fnmatch-perl* python3-zope.interface* libfstrm0* qubes-input-proxy-sender* libgeoip1t64* qubes-kernel-vm-support* libjemalloc2* qubes-usb-proxy* libjpeg-turbo-progs* repository-dist* libjson-perl* signify-openbsd* libjson-xs-perl* spectre-meltdown-checker* liblvm2cmd2.03* sysfsutils* libmath-random-isaac-perl* systemcheck* libmaxminddb0* tb-default-browser* libnumber-compare-perl* traceroute* libpam-tmpdir* usability-misc* libpkcs11-helper1t64* usbutils* libprotobuf-c1* usrmerge* libsysfs2* vim* libtext-glob-perl* vim-common* libturbojpeg0* vim-runtime* libtypes-serialiser-perl* vrms* liburcu8t64* wmctrl* libyaml-libyaml-perl* xscreensaver-data* lvm2* zsh* magic-wormhole* zsh-autosuggestions* makepasswd* zsh-common* most* zsh-syntax-highlighting* Summary: Upgrading: 0, Installing: 0, Removing: 130, Not Upgrading: 0 Freed space: 149 MB Continue? [Y/n] y (Reading database ... 92078 files and directories currently installed.) Removing kicksecure-cli (3:32.3-1) ... Removing anon-apt-sources-list (3:7.5-1) ... Removing kicksecure-recommended-cli (3:32.3-1) ... Removing apparmor-profiles-kicksecure (3:35.4-1) ... Removing apparmor-profile-hexchat (3:5.5-1) ... Removing apparmor-profile-thunderbird (3:6.1-1) ... Removing apparmor-profile-torbrowser (3:9.7-1) ... Removing base58 (1.0.3-2) ... Removing bind9-dnsutils (1:9.20.15-1~deb13u1) ... Removing bind9-host (1:9.20.15-1~deb13u1) ... Removing bind9-libs:amd64 (1:9.20.15-1~deb13u1) ... Removing boot-info-script (0.78-4) ... Removing systemcheck (3:47.2-1) ... Removing vrms (1.34) ... Removing check-dfsg-status (1.34) ... Removing kicksecure-default-applications-cli (3:32.3-1) ... Removing codecrypt (1.8-1+b2) ... Removing kicksecure-dependencies-cli (3:32.3-1) ... Removing initializer-dist (3:8.2-1) ... Removing usability-misc (3:33.8-1) ... Removing 'diversion of /usr/bin/flameshot to /usr/bin/flameshot.dist-orig by usa bility-misc' Removing 'diversion of /etc/zsh/zprofile to /etc/zsh/zprofile.dist-orig by usabi lity-misc' Removing 'diversion of /etc/zsh/zshrc to /etc/zsh/zshrc.dist-orig by usability-m isc' Removing damngpl (3:4.6-1) ... Removing debsums (3.0.2.3) ... Removing desktop-config-dist (3:16.3-1) ... Removing 'diversion of /usr/share/applications/lxqt-config-brightness.desktop to /usr/share/desktop-config-dist/usr++share++applications++lxqt-config-brightness .desktop by desktop-config-dist' Not removing diversion of /etc/greetd/wlgreet.toml by desktop-config-dist Not removing diversion of /etc/greetd/config.toml by desktop-config-dist Removing 'diversion of /usr/share/backgrounds/xfce/xfce-shapes.svg to /usr/share /desktop-config-dist/usr++share++backgrounds++xfce++xfce-shapes.svg by desktop-c onfig-dist' Removing diceware (1.0.1-1) ... Removing dist-base-files (3:15.4-1) ... Removing 'diversion of /etc/grub.d/10_linux to /usr/share/dist-base-files/etc++g rub.d++10+-+linux by dist-base-files' Removing lvm2 (2.03.31-2) ... Removing extrepo (0.14) ... Removing extrepo-offline-data (1.0.4) ... Removing fasttrack-archive-keyring (2025.02.16) ... Removing magic-wormhole (0.18.0-1) ... Removing python3-txtorcon (24.8.0-1.1) ... Removing python3-geoip:amd64 (1.3.2-6+b9) ... Removing geoip-database (20250401-1) ... Removing qubes-kernel-vm-support (4.3.13+deb13u1) ... Removing grub2-common (2.12-9) ... Removing iotop (0.6-42-ga14256a-0.3+b1) ... Removing jitterentropy-rngd (1.2.8-3) ... Removing kicksecure-base-files (3:10.2-1) ... Removing 'diversion of /etc/xdg/waybar/style.css to /etc/xdg/waybar/style.css.ki cksecure-orig by kicksecure-base-files' Removing 'diversion of /etc/xdg/waybar/config.jsonc to /etc/xdg/waybar/config.js onc.kicksecure-orig by kicksecure-base-files' Removing 'diversion of /etc/motd to /etc/motd.kicksecure-orig by kicksecure-base -files' Removing 'diversion of /etc/issue to /etc/issue.kicksecure-orig by kicksecure-ba se-files' Removing libblockdev-crypto2:amd64 (2.28-2+deb12u1) ... Removing libblockdev-utils2:amd64 (2.28-2+deb12u1) ... Removing makepasswd (1.10-14) ... Removing libbytes-random-secure-perl (0.29-3) ... Removing libjson-xs-perl (4.040-1~deb13u1) ... Removing libtypes-serialiser-perl (1.01-1) ... Removing libcommon-sense-perl:amd64 (3.75-3+b5) ... Removing libcrypt-passwdmd5-perl (1.42-2) ... Removing libcrypt-random-seed-perl (0.03-3) ... Removing libcrypto++8t64:amd64 (8.9.0-2) ... Removing libcryptx-perl (0.085-1) ... Removing usrmerge (39+nmu2) ... Removing libfile-find-rule-perl (0.34-4) ... Removing libfile-fnmatch-perl (0.02-3+b4) ... Removing libfstrm0:amd64 (0.6.1-1+b3) ... Removing libgeoip1t64:amd64 (1.6.12-11.1+b1) ... Removing libjemalloc2:amd64 (5.3.0-3) ... Removing libjpeg-turbo-progs (1:2.1.5-4) ... Removing libjson-perl (4.10000-1) ... Removing libmath-random-isaac-perl (1.004-2) ... Removing libmaxminddb0:amd64 (1.12.2-1) ... Removing libnumber-compare-perl (0.03-3) ... Removing libpam-tmpdir (0.11) ... Removing openvpn (2.6.14-1) ... Removing libpkcs11-helper1t64:amd64 (1.30.0-1+b1) ... Removing libprotobuf-c1:amd64 (1.5.1-1) ... Removing sysfsutils (2.1.1-7) ... Removing libsysfs2:amd64 (2.1.1-7) ... Removing libtext-glob-perl (0.11-3) ... Removing libturbojpeg0:amd64 (1:2.1.5-4) ... Removing liburcu8t64:amd64 (0.15.2-2) ... Removing libyaml-libyaml-perl (0.903.0+ds-1) ... Removing most (5.2.0-1.1) ... Removing net-tools (2.10-1.3) ... Removing p7zip-full (16.02+transitional.1) ... Removing pcmciautils (018-18) ... Removing policyrcd-script-zg2 (0.1-3.1) ... Removing pwgen (2.08-2) ... Removing python3-autobahn (23.1.2+dfsg1-2) ... Removing python3-txaio (23.1.1-4) ... Removing python3-twisted (24.11.0-1) ... Removing python3-automat (25.4.16-1) ... Removing python3-base58 (1.0.3-2) ... Removing python3-constantly (23.10.4-2) ... Removing python3-ecdsa (0.19.1-1) ... Removing python3-flatbuffers (23.5.26+dfsg-4) ... Removing python3-hamcrest (2.1.0-1) ... Removing python3-humanize (4.12.1-1) ... Removing python3-hyperlink (21.0.0-6) ... Removing python3-incremental (24.7.2-3) ... Removing python3-iterable-io (1.0.0-3) ... Removing python3-passlib (1.7.4-6) ... Removing python3-legacycrypt (0.3-2) ... Removing python3-lz4 (4.4.0+dfsg-2) ... Removing python3-mnemonic (0.21-2) ... Removing python3-msgpack (1.0.3-3+b4) ... Removing python3-nacl (1.5.0-7) ... Removing python3-png (0.20231004.0-4) ... Removing python3-service-identity (24.2.0-1) ... Removing python3-pyasn1-modules (0.4.1-2) ... Removing python3-pyasn1 (0.6.1-1) ... Removing python3-pyqrcode (1.2.1-4) ... Removing python3-snappy (0.5.3-1.2+b5) ... Removing python3-trie (0.4.0+ds-1) ... Removing python3-sortedcontainers (2.4.0-2) ... Removing python3-spake2 (0.9-1) ... Removing python3-u-msgpack (2.8.0-2) ... Removing python3-ubjson (0.16.1-4+b4) ... Removing python3-ujson:amd64 (5.10.0-1+b4) ... Removing python3-wsaccel (0.6.3-5+b1) ... Removing python3-zipstream-ng (1.8.0-1) ... Removing python3-zope.interface (7.2-1+b1) ... Removing qubes-input-proxy-sender (1.0.45-1+deb13u1) ... Removing qubes-usb-proxy (4.3.2+deb13u1) ... Removing repository-dist (3:13.1-1) ... Removing signify-openbsd (32-1.1) ... Removing spectre-meltdown-checker (0.46-1) ... Removing tb-default-browser (3:7.8-1) ... Removing traceroute (1:2.1.6-1) ... Removing usbutils (1:018-2) ... Removing vim (2:9.1.1230-2) ... Removing vim-common (2:9.1.1230-2) ... Removing vim-runtime (2:9.1.1230-2) ... Removing 'diversion of /usr/share/vim/vim91/doc/help.txt to /usr/share/vim/vim91 /doc/help.txt.vim-tiny by vim-runtime' Removing 'diversion of /usr/share/vim/vim91/doc/tags to /usr/share/vim/vim91/doc /tags.vim-tiny by vim-runtime' Removing wmctrl (1.07+git20240228.1105759-1) ... Removing xscreensaver-data (6.09+dfsg1-1) ... Removing zsh-syntax-highlighting (0.8.0-2) ... Removing zsh-autosuggestions (0.7.1-1) ... Removing zsh (5.9-8+b14) ... Removing zsh-common (5.9-8) ... Removing dmeventd (2:1.02.205-2) ... Removing liblvm2cmd2.03:amd64 (2.03.31-2) ... Removing libdevmapper-event1.02.1:amd64 (2:1.02.205-2) ... Processing triggers for initramfs-tools (0.148.3) ... Processing triggers for hicolor-icon-theme (0.18-2) ... Processing triggers for libc-bin (2.41-12) ... Processing triggers for man-db (2.13.1-1) ... Processing triggers for libglib2.0-0t64:amd64 (2.84.4-3~deb13u1) ... Processing triggers for security-misc-shared (3:50.3-1) ... INFO: triggered security-misc-shared: 'security-misc-shared' security-misc-share d DPKG_MAINTSCRIPT_NAME: 'postinst' $\*: 'triggered /usr' 2: '/usr' /usr/libexec/security-misc/mmap-rnd-bits: INFO: No Linux config file detected in folder /boot/ (starting with 'config-'). Therefore using built-in defaults. /usr/libexec/security-misc/mmap-rnd-bits: INFO: Successfully written ASLR map co nfig file: /etc/sysctl.d/30_security-misc_aslr-mmap.conf Running SUID Disabler and Permission Hardener... See also: https://www.kicksecure.com/wiki/SUID_Disabler_and_Permission_Hardener /var/lib/dpkg/info/security-misc-shared.postinst: INFO: running: permission-hard ener enable permission-hardener: [NOTICE]: Executing: dpkg-statoverride --add --update root root 777 /etc/issue.kicksecure permission-hardener: [NOTICE]: Executing: dpkg-statoverride --admindir /var/lib/ permission-hardener-v2/new_mode --add root root 777 /etc/issue.kicksecure permission-hardener: [NOTICE]: Executing: dpkg-statoverride --add --update root root 777 /etc/motd.kicksecure permission-hardener: [NOTICE]: Executing: dpkg-statoverride --admindir /var/lib/ permission-hardener-v2/new_mode --add root root 777 /etc/motd.kicksecure permission-hardener: [NOTICE]: To compare the current and previous permission mo des, install 'meld' (or preferred diff tool) for comparison of file mode changes : sudo apt install --no-install-recommends meld meld /var/lib/permission-hardener-v2/existing_mode/statoverride /var/lib/per mission-hardener-v2/new_mode/statoverride /var/lib/dpkg/info/security-misc-shared.postinst: INFO: Permission hardening suc cess. Processing triggers for qubes-core-agent (4.3.35-1+deb13u1) ... /efi: 199.7 MiB (209436672 bytes) trimmed on /dev/xvda1 /rw: 1.9 GiB (2034069504 bytes) trimmed on /dev/xvdb /: 4.2 GiB (4522979328 bytes) trimmed on /dev/mapper/dmroot Processing triggers for debianutils (5.23.2) ... Processing triggers for menu (2.1.51) ... Processing triggers for mailcap (3.74) ... Processing triggers for desktop-file-utils (0.28-1) ... (Reading database ... 83177 files and directories currently installed.) Purging configuration files for vrms (1.34) ... Purging configuration files for xscreensaver-data (6.09+dfsg1-1) ... Purging configuration files for usability-misc (3:33.8-1) ... dpkg: warning: while removing usability-misc, directory '/usr/share/usability-mi sc/xdg-override/applications' not empty so not removed dpkg: warning: while removing usability-misc, directory '/etc/dkms' not empty so not removed Purging configuration files for openvpn (2.6.14-1) ... Purging configuration files for sysfsutils (2.1.1-7) ... Purging configuration files for zsh-common (5.9-8) ... rmdir: failed to remove '/usr/local/share/zsh/site-functions': No such file or d irectory Purging configuration files for grub2-common (2.12-9) ... Purging configuration files for apparmor-profile-torbrowser (3:9.7-1) ... Purging configuration files for dist-base-files (3:15.4-1) ... Purging configuration files for p7zip-full (16.02+transitional.1) ... Purging configuration files for apparmor-profile-thunderbird (3:6.1-1) ... Purging configuration files for lvm2 (2.03.31-2) ... Purging configuration files for repository-dist (3:13.1-1) ... Purging configuration files for fasttrack-archive-keyring (2025.02.16) ... Purging configuration files for qubes-usb-proxy (4.3.2+deb13u1) ... Purging configuration files for kicksecure-base-files (3:10.2-1) ... dpkg: warning: while removing kicksecure-base-files, directory '/boot/grub/theme s/kicksecure' not empty so not removed Purging configuration files for systemcheck (3:47.2-1) ... Purging configuration files for vim-common (2:9.1.1230-2) ... Purging configuration files for jitterentropy-rngd (1.2.8-3) ... Purging configuration files for python3-twisted (24.11.0-1) ... Purging configuration files for usrmerge (39+nmu2) ... Purging configuration files for desktop-config-dist (3:16.3-1) ... dpkg: warning: while removing desktop-config-dist, directory '/etc/greetd' not e mpty so not removed Purging configuration files for qubes-kernel-vm-support (4.3.13+deb13u1) ... Purging configuration files for apparmor-profile-hexchat (3:5.5-1) ... Purging configuration files for pcmciautils (018-18) ... Purging configuration files for dmeventd (2:1.02.205-2) ... Purging configuration files for anon-apt-sources-list (3:7.5-1) ... Purging configuration files for check-dfsg-status (1.34) ... Purging configuration files for debsums (3.0.2.3) ... Purging configuration files for zsh (5.9-8+b14) ... Purging configuration files for qubes-input-proxy-sender (1.0.45-1+deb13u1) ... Purging configuration files for vim-runtime (2:9.1.1230-2) ... Purging configuration files for tb-default-browser (3:7.8-1) ... Purging configuration files for extrepo (0.14) ... Processing triggers for security-misc-shared (3:50.3-1) ... INFO: triggered security-misc-shared: 'security-misc-shared' security-misc-share d DPKG_MAINTSCRIPT_NAME: 'postinst' $\*: 'triggered /usr' 2: '/usr' /usr/libexec/security-misc/mmap-rnd-bits: INFO: No Linux config file detected in folder /boot/ (starting with 'config-'). Therefore using built-in defaults. /usr/libexec/security-misc/mmap-rnd-bits: INFO: Successfully written ASLR map co nfig file: /etc/sysctl.d/30_security-misc_aslr-mmap.conf Running SUID Disabler and Permission Hardener... See also: https://www.kicksecure.com/wiki/SUID_Disabler_and_Permission_Hardener /var/lib/dpkg/info/security-misc-shared.postinst: INFO: running: permission-hard ener enable permission-hardener: [NOTICE]: To compare the current and previous permission mo des, install 'meld' (or preferred diff tool) for comparison of file mode changes : sudo apt install --no-install-recommends meld meld /var/lib/permission-hardener-v2/existing_mode/statoverride /var/lib/per mission-hardener-v2/new_mode/statoverride /var/lib/dpkg/info/security-misc-shared.postinst: INFO: Permission hardening suc cess. Processing triggers for qubes-core-agent (4.3.35-1+deb13u1) ... /efi: 199.7 MiB (209436672 bytes) trimmed on /dev/xvda1 /rw: 0 B (0 bytes) trimmed on /dev/xvdb /: 1.8 GiB (1882087424 bytes) trimmed on /dev/mapper/dmroot Processing triggers for menu (2.1.51) ... Processing triggers for privleap (3:4.6-1) ... Reading package lists... Building dependency tree... Reading state information... Calculating upgrade... 0 upgraded, 0 newly installed, 0 to remove and 0 not upgraded. Del libxcb-cursor0 0.1.5-1 [17.1 kB] Del firmware-mediatek 20250410-2 [19.6 MB] Del systemd-repart 257.9-1~deb13u1 [178 kB] Del libayatana-ido3-0.4-0 0.10.4-1 [56.0 kB] Del yad 0.40.0-1.1 [168 kB] Del libts0t64 1.22-1.1+b1 [61.7 kB] Del libqt6waylandclient6 6.8.2-4 [275 kB] Del firmware-intel-misc 20250410-2 [1,868 kB] Del libqt6gui6 6.8.2+dfsg-9+deb13u1 [3,153 kB] Del libteamdctl0 1.31-1+b2 [11.8 kB] Del firmware-realtek 20250410-2 [2,860 kB] Del wpasupplicant 2:2.10-24 [1,426 kB] Del libdbusmenu-glib4 18.10.20180917~bzr492+repack1-4 [40.6 kB] Del libmm-glib0 1.24.0-1+deb13u1 [245 kB] Del libnma-common 1.10.6-5 [136 kB] Del libb2-1 0.98.1-1.1+b2 [41.7 kB] Del atmel-firmware 1.3-7.1 [147 kB] Del libnm0 1.52.1-1 [459 kB] Del firmware-iwlwifi 20250410-2 [16.7 MB] Del libqt6xdg4 4.1.0-1+b1 [115 kB] Del libnma0 1.10.6-5 [91.8 kB] Del libqt6svg6 6.8.2-3 [184 kB] Del libqt6xml6 6.8.2+dfsg-9+deb13u1 [85.6 kB] Del libkf6windowsystem-data 6.13.0-2 [13.7 kB] Del firmware-linux-free 20241210-2 [17.8 kB] Del libxss1 1:1.2.3-1+b3 [17.0 kB] Del libayatana-appindicator3-1 0.5.94-1 [25.2 kB] Del libqt6dbus6 6.8.2+dfsg-9+deb13u1 [265 kB] Del libdbusmenu-gtk3-4 18.10.20180917~bzr492+repack1-4 [27.2 kB] Del libqt6core6t64 6.8.2+dfsg-9+deb13u1 [1,844 kB] Del firmware-atheros 20250410-2 [29.5 MB] Del firmware-misc-nonfree 20250410-2 [4,331 kB] Del firmware-ipw2x00 20250410-2 [302 kB] Del libayatana-indicator3-7 0.9.4-1+b1 [32.4 kB] Del lxqt-notificationd 2.1.1-1 [72.2 kB] Del network-manager-applet 1.36.0-3+b1 [82.3 kB] Del firmware-zd1211 1:1.5-13 [13.5 kB] Del network-manager 1.52.1-1 [2,247 kB] Del firmware-ath9k-htc 1.4.0-110-ge888634+dfsg1-0.1 [45.0 kB] Del libkf6windowsystem6 6.13.0-2 [195 kB] Del libqt6widgets6 6.8.2+dfsg-9+deb13u1 [2,640 kB] Del libqt6xdgiconloader4 4.1.0-1+b1 [46.0 kB] Del firmware-ti-connectivity 20250410-2 [1,467 kB] Del liblayershellqtinterface6 6.3.4-1 [29.6 kB] Del nm-connection-editor 1.36.0-3+b1 [816 kB] Del liblxqt2 2.1.0-3 [115 kB] Del network-manager-gnome 1.36.0-3+b1 [10.8 kB] Del libxcb-res0 1.17.0-2+b1 [106 kB] Del libndp0 1.9-1+b1 [12.8 kB] Del libopengl0 1.7.0-1+b2 [30.9 kB] Del firmware-libertas 20250410-2 [3,623 kB] Del libbluetooth3 5.82-1.1 [102 kB] Del firmware-brcm80211 20250410-2 [5,379 kB] [root ~]# ``` - Broken VM ``` # apt update Get:1 https://deb.qubes-os.org/r4.3/vm trixie InRelease [4,735 B] Hit:2 https://deb.kicksecure.com trixie-testers InRelease Err:2 https://deb.kicksecure.com trixie-testers InRelease Sub-process /usr/bin/sqv returned an error code (1), error message is: Error: Failed to parse keyring "/usr/share/keyrings/derivative.asc" Caused by: 0: Reading "/usr/share/keyrings/derivative.asc": No such file or directory (os error 2) 1: No such file or directory (os error 2) Fetched 4,735 B in 1s (5,174 B/s) Warning: An error occurred during the signature verification. The repository is not updated and the previous index files will be used. OpenPGP signature verification failed: https://deb.kicksecure.com trixie-testers InRelease: Sub-process /usr/bin/sqv returned an error code (1), error message is: Error: Failed to parse keyring "/usr/share/keyrings/derivative.asc" Caused by: 0: Reading "/usr/share/keyrings/derivative.asc": No such file or directory (os error 2) 1: No such file or directory (os error 2) Error: Failed to fetch https://deb.kicksecure.com/dists/trixie-testers/InRelease Sub-process /usr/bin/sqv returned an error code (1), error message is: Error: Failed to parse keyring "/usr/share/keyrings/derivative.asc" Caused by: 0: Reading "/usr/share/keyrings/derivative.asc": No such file or directory (os error 2) 1: No such file or directory (os error 2) Error: Some index files failed to download. They have been ignored, or old ones used instead. # ```

Patrick · December 5, 2025, 3:53pm

github.com/QubesOS/qubes-issues

Dom0 (internal) tool to copy a file into specific place in a VM

opened 01:17PM - 05 Dec 25 UTC

marmarek

P: default

> > While at this... Would it be possible to use a different path other than `/h…ome` please? Because that may introduce a risk in context of user-sysmaint-split (and maybe also in context of home noexec). > > This is the path where qvm-copy puts the file, and copy source (intentionally) has no influence on the directory. While dom0 could use a different mechanism to send the file (even naive `qvm-run ... 'cat > ...'`), that would likely lead to other issues. > > If there was a dom0 wrapper... > > qvm-copy-to-path dest_vmname dom0-source-file-or-folder vm-destination-file-or-folder > > Then `qubes-dist-upgrade` could conveniently use it to install the file to a more appropriate location such as in `/usr/bin`. That would be easier to read than the `qvm-run ... 'cat > ...'` syntax. > > A dom0 tool `qvm-copy-to-path` would be nice to have anyhow for all sorts of system administration tasks. Or at least as an internal tool if not user facing. _Originally posted by @adrelanos in [#10437](https://github.com/QubesOS/qubes-issues/issues/10437#issuecomment-3616561841)_

Patrick · December 5, 2025, 4:06pm

github.com/QubesOS/qubes-issues

`pipewire.socket` unexpectedly runs in `minimal-netvm` and `minimal-usbvm` but should not

opened 04:05PM - 05 Dec 25 UTC

adrelanos

P: default

### Qubes OS release R4.3rc3 ### Brief summary `pipewire.socket` should not b…e activated in `minimal-netvm` and `minimal-usbvm`. This is already the case for `pipewire.service`. But this is not yet done for `pipewire.socket` but probably should be. ### Steps to reproduce It's a Kicksecure 18 VM but I don't see why this wouldn't happen with a Debian (13) based VM either. `systemctl --user is-system-running` ``` degraded zsh: exit 1 systemctl --user is-system-running ``` `systemctl --user status pipewire.socket` ``` × pipewire.socket - PipeWire Multimedia System Sockets Loaded: loaded (/usr/lib/systemd/user/pipewire.socket; enabled; preset: enabled) Active: failed (Result: trigger-limit-hit) since Duration: 182ms Invocation: 2b6371b2762f419fbf8144db13f51c15 Triggers: ● pipewire.service Listen: /run/user/1000/pipewire-0 (Stream) /run/user/1000/pipewire-0-manager (Stream) sys-net systemd[1212]: Listening on pipewire.socket - PipeWire Multimedia System Sockets. sys-net systemd[1212]: pipewire.socket: Trigger limit hit, refusing further activation. sys-net systemd[1212]: pipewire.socket: Failed with result 'trigger-limit-hit'. zsh: exit 3 systemctl --user status pipewire.socket ``` `systemctl --no-pager --user status pipewire.service` ``` ○ pipewire.service - PipeWire Multimedia Service Loaded: loaded (/usr/lib/systemd/user/pipewire.service; enabled; preset: enabled) Drop-In: /usr/lib/systemd/user/pipewire.service.d └─30_qubes.conf, 40_minimal.conf Active: inactive (dead) TriggeredBy: × pipewire.socket Condition: start condition unmet at └─ ConditionPathExists=!/var/run/qubes-service/minimal-netvm was not met sys-net systemd[1212]: pipewire.service - PipeWire Multimedia Service was skipped because of an unmet condition check (ConditionPathExists=!/var/run/qubes-ser…minimal-netvm). Hint: Some lines were ellipsized, use -l to show in full. zsh: exit 3 systemctl --no-pager --user status pipewire.service ``` ### Expected behavior No such errors. ### Actual behavior Above errors. ### Additional information `/usr/lib/systemd/user/pipewire.service.d/40_minimal.conf` exists. And makes sense. That's for `pipewire.service`. Should the same file be placed in `/usr/lib/systemd/user/pipewire.socket.d/40_minimal.conf` for `pipewire.socket`? (And maybe equivalent for `/usr/lib/systemd/user/pipewire.service.d/30_qubes.conf`) ---- [1] `cat /usr/lib/systemd/user/pipewire.service.d/40_minimal.conf` ``` [Unit] ConditionPathExists=!/var/run/qubes-service/minimal-netvm ConditionPathExists=!/var/run/qubes-service/minimal-usbvm ``` `cat /usr/lib/systemd/user/pipewire.service.d/30_qubes.conf` ``` [Unit] # Avoid pipewire in root's session to not steal user's connection to the audiovm ConditionUser=!root ``` ---- This is also an issue because a new version of `systemcheck` in Kicksecure will report this issue. ``` [WARNING] [systemcheck] systemd 'user' units check result: One or more units failed to load. A possible system issue was detected. There is no need to panic. This is not a serious security problem. However, it may impact other system checks. Some systemd 'user' units may be stuck in a failed, activating, or deactivating state. Output of 'systemctl --user --no-pager --no-block --state=failed,activating,deactivating list-units':: ######################################## UNIT LOAD ACTIVE SUB DESCRIPTION * pipewire.socket loaded failed failed PipeWire Multimedia System Sockets Legend: LOAD -> Reflects whether the unit definition was properly loaded. ACTIVE -> The high-level unit activation state, i.e. generalization of SUB. SUB -> The low-level unit activation state, values depend on unit type. 1 loaded units listed. ######################################## To check manually: 1. Open a terminal. (dom0 -> Start Menu -> ServiceVM: sys-net -> Terminal) 2. Run: systemctl --user --no-pager --no-block --state=failed,activating,deactivating list-units If you know what you are doing, feel free to disable this check. Create a file /etc/systemcheck.d/50_user.conf and add: systemcheck_skip_functions+=" check_services_do " ``` ---- `systemctl --user is-system-running` outputting `degraded` might cause issues elsewhere in Qubes (guess). `/etc/qubes-rpc/qubes.WaitForSession` does `systemctl --user --wait --quiet is-system-running`. Related: * https://github.com/QubesOS/qubes-issues/issues/10384 ---- The solution might be as simple as the equivalent of: ``` sudo mkdir /usr/lib/systemd/user/pipewire.socket.d/ sudo cp /usr/lib/systemd/user/pipewire.service.d/* /usr/lib/systemd/user/pipewire.socket.d/ ```

Patrick · December 8, 2025, 2:08pm

github.com/QubesOS/updates-status

qubes-template-kicksecure-18 4.3.0-202512071252 (r4.3)

opened 12:52PM - 07 Dec 25 UTC

fepitre-bot

r4.3-testing

Template kicksecure-18 4.3.0-202512071252 for Qubes OS r4.3, see comments below …for details and build status. If you're release manager, you can issue GPG-inline signed command (depending on template): * `Upload-template r4.3 kicksecure-18 4.3.0-202512071252 templates-itl` (available 5 days from now) * `Upload-template r4.3 kicksecure-18 4.3.0-202512071252 templates-community` (available 5 days from now) Above commands will work only if package in testing repository isn't superseded by newer version. For more information on how to test this update, please take a look at https://www.qubes-os.org/doc/testing/#updates.