From 5a769860460bf11ac6f32761b42a1577d683c42c Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Marek=20Marczykowski-G=C3=B3recki?= Date: Wed, 29 Oct 2025 13:00:49 +0100 Subject: [PATCH 1/2] Revert "Use socks5 proxy on Whonix Gateway to fix onion urls resolution" Adding the options was moved to the uwt wrapper: https://github.com/Whonix/uwt/commit/43e07edb6fe8849efe121d77ea09c42bf80018e3 It isn't needed here anymore. This reverts commit 2e68781a195f05ffe0e6245544c01a8544d25fa5. --- package-managers/qubes-download-dom0-updates.sh | 8 -------- qubes-rpc/qvm-template-repo-query | 8 -------- 2 files changed, 16 deletions(-) diff --git a/package-managers/qubes-download-dom0-updates.sh b/package-managers/qubes-download-dom0-updates.sh index d5c5b930..079f6355 100755 --- a/package-managers/qubes-download-dom0-updates.sh +++ b/package-managers/qubes-download-dom0-updates.sh @@ -64,14 +64,6 @@ while [ -n "$1" ]; do shift done -if [ -e /run/qubes-service/whonix-gateway ]; then - # DNF (or rather curl) refuses to resolve onion addresses directly, use - # socks proxy to avoid the issue - OPTS+=( --setopt=proxy=socks5h://127.0.0.1:9050/ ) - # for stream isolation - OPTS+=( --setopt=proxy_username=dom0updates --setopt=proxy_password=dom0updates ) -fi - if [ -z "$UPDATE_ACTION" ]; then UPDATE_ACTION=upgrade fi diff --git a/qubes-rpc/qvm-template-repo-query b/qubes-rpc/qvm-template-repo-query index 45293fe8..e1447ece 100644 --- a/qubes-rpc/qvm-template-repo-query +++ b/qubes-rpc/qvm-template-repo-query @@ -57,14 +57,6 @@ fi OPTS+=(-y "--setopt=reposdir=${repodir}" --quiet) -if [ -e /run/qubes-service/whonix-gateway ]; then - # DNF (or rather curl) refuses to resolve onion addresses directly, use - # socks proxy to avoid the issue - OPTS+=( --setopt=proxy=socks5h://127.0.0.1:9050/ ) - # for stream isolation - OPTS+=( --setopt=proxy_username=dom0updates --setopt=proxy_password=dom0updates ) -fi - if ! $DNF5; then # use vendored 'downloadurl' dnf-plugin (fork of 'download' plugin), to print # all mirrors From 3ade52f4dfa5851a94d0196aeb6e1bba01e6c02a Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Marek=20Marczykowski-G=C3=B3recki?= Date: Mon, 3 Nov 2025 01:00:38 +0100 Subject: [PATCH 2/2] dom0-updates: specify DNF cache in a writable directory Depending on DNF version, it chooses cachedir either inside --installroot, or in plain /var/cache. The latter is not writable by a normal user, and due to fakeroot usage, DNF gets confused. This manifests in a message like this: Failed to expire repository cache in path "/var/cache/libdnf5/updates-79babcf8637033ce": cannot open file: (13) - Permission denied [/var/cache/libdnf5/updates-79babcf8637033ce/attrs/expired] Specify cache dir explicitly. --- package-managers/qubes-download-dom0-updates.sh | 1 + 1 file changed, 1 insertion(+) diff --git a/package-managers/qubes-download-dom0-updates.sh b/package-managers/qubes-download-dom0-updates.sh index 079f6355..d843c188 100755 --- a/package-managers/qubes-download-dom0-updates.sh +++ b/package-managers/qubes-download-dom0-updates.sh @@ -13,6 +13,7 @@ elif [ -f "$DOM0_UPDATES_DIR/etc/yum.conf" ]; then fi # DNF uses /etc/yum.repos.d, even when --installroot is specified OPTS+=("--setopt=reposdir=$DOM0_UPDATES_DIR/etc/yum.repos.d") +OPTS+=("--setopt=cachedir=$DOM0_UPDATES_DIR/var/cache/dnf") CLEAN_OPTS=("${OPTS[@]}") # DNF verifies signatures implicitly, but yumdownloader does not. SIGNATURE_REGEX=""