version 3.1.20

Fixes QubesOS/qubes-issues#2472 from commit
3f600d03fa

(cherry picked from commit 0d243250f2)

.coveragerc

@@ -1,3 +0,0 @@
-[run]
-source = qubesagent
-omit = qubesagent/test*

.gitignore

@@ -4,6 +4,3 @@ deb/*
 *.pyo
 *~
 *.o
-.coverage
-*.egg-info
-__pycache__

.travis.yml

@@ -1,35 +0,0 @@
-sudo: required
-dist: trusty
-language: python
-python: '3.5'
-install: git clone https://github.com/QubesOS/qubes-builder ~/qubes-builder
-script: ~/qubes-builder/scripts/travis-build
-env:
- - DISTS_VM=fc26 USE_QUBES_REPO_VERSION=4.0 USE_QUBES_REPO_TESTING=1
- - DISTS_VM=fc27 USE_QUBES_REPO_VERSION=4.0 USE_QUBES_REPO_TESTING=1
- - DISTS_VM=fc28 USE_QUBES_REPO_VERSION=4.0 USE_QUBES_REPO_TESTING=1
- - DISTS_VM=fc29 USE_QUBES_REPO_VERSION=4.0 USE_QUBES_REPO_TESTING=1
- - DISTS_VM=jessie USE_QUBES_REPO_VERSION=4.0 USE_QUBES_REPO_TESTING=1
- - DISTS_VM=stretch USE_QUBES_REPO_VERSION=4.0 USE_QUBES_REPO_TESTING=1
- - DISTS_VM=buster USE_QUBES_REPO_VERSION=4.0 USE_QUBES_REPO_TESTING=1
- - DISTS_VM=centos7 USE_QUBES_REPO_VERSION=4.0 USE_QUBES_REPO_TESTING=1
-
-jobs:
-  include:
-    - python: '3.5'
-      install: pip install --quiet -r ci/requirements.txt
-      env: TESTS_ONLY=1
-      script:
-       - ./run-tests
-       - shellcheck  $(grep -l '^#!/bin/\(ba\)\?sh' $(git ls-files))
-      after_success:
-       - codecov
-    - stage: deploy
-      python: '3.5'
-      env: DIST_DOM0=fc25 TESTS_ONLY=
-      script: ~/qubes-builder/scripts/travis-deploy
-
-
-branches:
-  except:
-    - /.*_.*/

Makefile

@@ -4,17 +4,14 @@ VERSION := $(shell cat version)
 
 DIST ?= fc18
 KDESERVICEDIR ?= /usr/share/kde4/services
-KDE5SERVICEDIR ?= /usr/share/kservices5/ServiceMenus/
-APPLICATIONSDIR ?= /usr/share/applications
 SBINDIR ?= /usr/sbin
-BINDIR ?= /usr/bin
 LIBDIR ?= /usr/lib
 SYSLIBDIR ?= /lib
 
-PYTHON ?= /usr/bin/python2
+PYTHON = /usr/bin/python2
-PYTHON_SITEARCH = $(shell python2 -c 'import distutils.sysconfig; print distutils.sysconfig.get_python_lib(1)')
+PYTHON_SITEARCH = `python2 -c 'import distutils.sysconfig; print distutils.sysconfig.get_python_lib(1)'`
-PYTHON2_SITELIB = $(shell python2 -c 'import distutils.sysconfig; print distutils.sysconfig.get_python_lib()')
+PYTHON2_SITELIB = `python2 -c 'import distutils.sysconfig; print distutils.sysconfig.get_python_lib()'`
-PYTHON3_SITELIB = $(shell python3 -c 'import distutils.sysconfig; print(distutils.sysconfig.get_python_lib())')
+PYTHON3_SITELIB = `python3 -c 'import distutils.sysconfig; print(distutils.sysconfig.get_python_lib())'`
 
 # This makefile uses some bash-isms, make uses /bin/sh by default.
 SHELL = /bin/bash
@@ -24,19 +21,13 @@ help:
 	@echo "make rpms-vm               -- generate binary rpm packages for VM"
 	@echo "make clean                 -- cleanup"
 	@echo "make install-vm            -- install VM related files"
-	@echo ""
-	@echo "You must have lsb_release, rpm-sign and pandoc installed."
 
 rpms: rpms-vm
 
 rpms-vm:
-	[ "$$BACKEND_VMM" != "" ] || { echo "error: you must define variable BACKEND_VMM" >&2 ; exit 1 ; }
-	lsb_release >/dev/null 2>&1 || { echo "error: you need lsb_release (package lsb) installed" >&2 ; exit 1 ; }
-	type pandoc >/dev/null 2>&1 || { echo "error: you need pandoc installed" >&2 ; exit 1 ; }
-	type rpmsign >/dev/null 2>&1 || { echo "error: you need rpm-sign installed" >&2 ; exit 1 ; }
 	rpmbuild --define "_rpmdir $(RPMS_DIR)" -bb rpm_spec/core-vm.spec
 	rpmbuild --define "_rpmdir $(RPMS_DIR)" -bb rpm_spec/core-vm-doc.spec
-	[ "$$SKIP_SIGNING" != "" ] || rpm --addsign \
+	rpm --addsign \
 		$(RPMS_DIR)/x86_64/qubes-core-vm-*$(VERSION)*.rpm \
 		$(RPMS_DIR)/x86_64/qubes-core-vm-doc-*$(VERSION)*.rpm
 
@@ -47,12 +38,6 @@ clean:
 	make -C misc clean
 	make -C qrexec clean
 	make -C qubes-rpc clean
-	make -C doc clean
-	rm -rf qubesagent/*.pyc qubesagent/__pycache__
-	rm -rf test-packages/__pycache__
-	rm -rf test-packages/qubesagent.egg-info
-	rm -rf __pycache__
-	rm -f .coverage
 
 all:
 	make -C misc
@@ -60,38 +45,22 @@ all:
 	make -C qubes-rpc
 
 # Dropin Directory
-SYSTEM_DROPIN_DIR ?= "lib/systemd/system"
+DROPIN_DIR ?= "lib/systemd"
-USER_DROPIN_DIR ?= "usr/lib/systemd/user"
 
-SYSTEM_DROPINS := chronyd.service crond.service
+SYSTEM_DROPINS := chronyd.service crond.service cups.service cups.path cups.socket ModemManager.service
-SYSTEM_DROPINS += cups.service cups-browsed.service cups.path cups.socket ModemManager.service
+SYSTEM_DROPINS += NetworkManager.service NetworkManager-wait-online.service ntpd.service getty@tty.service
-SYSTEM_DROPINS += getty@tty.service
+SYSTEM_DROPINS += tinyproxy.service
 SYSTEM_DROPINS += tmp.mount
 SYSTEM_DROPINS += org.cups.cupsd.service org.cups.cupsd.path org.cups.cupsd.socket
-SYSTEM_DROPINS += systemd-random-seed.service
 SYSTEM_DROPINS += tor.service tor@default.service
-SYSTEM_DROPINS += systemd-timesyncd.service
-
-SYSTEM_DROPINS_NETWORKING := NetworkManager.service NetworkManager-wait-online.service
-SYSTEM_DROPINS_NETWORKING += tinyproxy.service
 
 USER_DROPINS := pulseaudio.service pulseaudio.socket
 
-# Ubuntu Dropins
-ifeq ($(shell lsb_release -is), Ubuntu)
-
-    # 'crond.service' is named 'cron.service in Debian
-    SYSTEM_DROPINS := $(strip $(patsubst crond.service, cron.service, $(SYSTEM_DROPINS)))
-    SYSTEM_DROPINS += anacron.service
-    SYSTEM_DROPINS += anacron-resume.service
-    SYSTEM_DROPINS += netfilter-persistent.service
-    SYSTEM_DROPINS += exim4.service
-    SYSTEM_DROPINS += avahi-daemon.service
-
-endif
-
 # Debian Dropins
 ifeq ($(shell lsb_release -is), Debian)
+    # Don't have 'ntpd' in Debian
+    SYSTEM_DROPINS := $(filter-out ntpd.service, $(SYSTEM_DROPINS))
+
     # 'crond.service' is named 'cron.service in Debian
     SYSTEM_DROPINS := $(strip $(patsubst crond.service, cron.service, $(SYSTEM_DROPINS)))
 
@@ -101,68 +70,52 @@ ifeq ($(shell lsb_release -is), Debian)
 
     # handled by qubes-iptables service now
     SYSTEM_DROPINS += netfilter-persistent.service
-
-    SYSTEM_DROPINS += anacron.service
-    SYSTEM_DROPINS += anacron-resume.service
-    SYSTEM_DROPINS += exim4.service
-    SYSTEM_DROPINS += avahi-daemon.service
 endif
 
 install-systemd-dropins:
 	# Install system dropins
 	@for dropin in $(SYSTEM_DROPINS); do \
-	    install -d $(DESTDIR)/$(SYSTEM_DROPIN_DIR)/$${dropin}.d ;\
+	    install -d $(DESTDIR)/$(DROPIN_DIR)/system/$${dropin}.d ;\
-	    install -m 0644 vm-systemd/$${dropin}.d/*.conf $(DESTDIR)/$(SYSTEM_DROPIN_DIR)/$${dropin}.d/ ;\
+	    install -m 0644 vm-systemd/$${dropin}.d/*.conf $(DESTDIR)/$(DROPIN_DIR)/system/$${dropin}.d/ ;\
 	done
 
 	# Install user dropins
 	@for dropin in $(USER_DROPINS); do \
-	    install -d $(DESTDIR)/$(USER_DROPIN_DIR)/$${dropin}.d ;\
+	    install -d $(DESTDIR)/$(DROPIN_DIR)/user/$${dropin}.d ;\
-	    install -m 0644 vm-systemd/user/$${dropin}.d/*.conf $(DESTDIR)/$(USER_DROPIN_DIR)/$${dropin}.d/ ;\
+	    install -m 0644 vm-systemd/user/$${dropin}.d/*.conf $(DESTDIR)/$(DROPIN_DIR)/user/$${dropin}.d/ ;\
 	done
 
-install-systemd-networking-dropins:
+install-systemd:
-	# Install system dropins
-	@for dropin in $(SYSTEM_DROPINS_NETWORKING); do \
-	    install -d $(DESTDIR)/$(SYSTEM_DROPIN_DIR)/$${dropin}.d ;\
-	    install -m 0644 vm-systemd/$${dropin}.d/*.conf $(DESTDIR)/$(SYSTEM_DROPIN_DIR)/$${dropin}.d/ ;\
-	done
-
-install-init:
-	install -d $(DESTDIR)$(LIBDIR)/qubes/init
-	# FIXME: do a source code move vm-systemd/*.sh to init/
-	# since those scripts are shared between sysvinit and systemd.
-	install -m 0755 init/*.sh vm-systemd/*.sh $(DESTDIR)$(LIBDIR)/qubes/init/
-	install -m 0644 init/functions $(DESTDIR)$(LIBDIR)/qubes/init/
-
-# Systemd service files
-SYSTEMD_ALL_SERVICES := $(wildcard vm-systemd/qubes-*.service)
-SYSTEMD_NETWORK_SERVICES := vm-systemd/qubes-firewall.service vm-systemd/qubes-iptables.service vm-systemd/qubes-updates-proxy.service
-SYSTEMD_CORE_SERVICES := $(filter-out $(SYSTEMD_NETWORK_SERVICES), $(SYSTEMD_ALL_SERVICES))
-
-install-systemd: install-init
 	install -d $(DESTDIR)$(SYSLIBDIR)/systemd/system{,-preset} $(DESTDIR)$(LIBDIR)/qubes/init $(DESTDIR)$(SYSLIBDIR)/modules-load.d
-	install -m 0644 $(SYSTEMD_CORE_SERVICES) $(DESTDIR)$(SYSLIBDIR)/systemd/system/
+	install -m 0755 vm-systemd/*.sh $(DESTDIR)$(LIBDIR)/qubes/init/
+	install -m 0644 vm-systemd/qubes-*.service $(DESTDIR)$(SYSLIBDIR)/systemd/system/
 	install -m 0644 vm-systemd/qubes-*.timer $(DESTDIR)$(SYSLIBDIR)/systemd/system/
 	install -m 0644 vm-systemd/75-qubes-vm.preset $(DESTDIR)$(SYSLIBDIR)/systemd/system-preset/
 	install -m 0644 vm-systemd/qubes-core.conf $(DESTDIR)$(SYSLIBDIR)/modules-load.d/
+	install -m 0644 vm-systemd/qubes-misc.conf $(DESTDIR)$(SYSLIBDIR)/modules-load.d/
+	install -m 0755 network/qubes-iptables $(DESTDIR)$(LIBDIR)/qubes/init/
+	install -D -m 0644 vm-systemd/qubes-core-agent-linux.tmpfiles \
+		$(DESTDIR)/usr/lib/tmpfiles.d/qubes-core-agent-linux.conf
 
-install-sysvinit: install-init
+install-sysvinit:
 	install -d $(DESTDIR)/etc/init.d
-	install vm-init.d/qubes-sysinit $(DESTDIR)/etc/init.d/
-	install vm-init.d/qubes-core-early $(DESTDIR)/etc/init.d/
 	install vm-init.d/qubes-core $(DESTDIR)/etc/init.d/
+	install vm-init.d/qubes-core-appvm $(DESTDIR)/etc/init.d/
 	install vm-init.d/qubes-core-netvm $(DESTDIR)/etc/init.d/
 	install vm-init.d/qubes-firewall $(DESTDIR)/etc/init.d/
+	install vm-init.d/qubes-netwatcher $(DESTDIR)/etc/init.d/
 	install vm-init.d/qubes-qrexec-agent $(DESTDIR)/etc/init.d/
 	install vm-init.d/qubes-updates-proxy $(DESTDIR)/etc/init.d/
-	install vm-init.d/qubes-updates-proxy-forwarder $(DESTDIR)/etc/init.d/
 	install -D vm-init.d/qubes-core.modules $(DESTDIR)/etc/sysconfig/modules/qubes-core.modules
+	install -D vm-init.d/qubes-misc.modules $(DESTDIR)/etc/sysconfig/modules/qubes-misc.modules
 	install network/qubes-iptables $(DESTDIR)/etc/init.d/
 
 install-rh: install-systemd install-systemd-dropins install-sysvinit
-	install -D -m 0644 misc/qubes-r4.repo.in $(DESTDIR)/etc/yum.repos.d/qubes-r4.repo
+	install -D -m 0644 misc/qubes-r3.repo $(DESTDIR)/etc/yum.repos.d/qubes-r3.repo
-	DIST='$(DIST)'; sed -i "s/@DIST@/$${DIST%%[0-9]*}/g" $(DESTDIR)/etc/yum.repos.d/qubes-r4.repo
+	install -d $(DESTDIR)/usr/share/glib-2.0/schemas/
+	install -m 0644 misc/org.gnome.settings-daemon.plugins.updates.gschema.override $(DESTDIR)/usr/share/glib-2.0/schemas/
+	install -m 0644 misc/org.gnome.nautilus.gschema.override $(DESTDIR)/usr/share/glib-2.0/schemas/
+	install -m 0644 misc/org.mate.NotificationDaemon.gschema.override $(DESTDIR)/usr/share/glib-2.0/schemas/
 	install -d $(DESTDIR)$(LIBDIR)/yum-plugins/
 	install -m 0644 misc/yum-qubes-hooks.py* $(DESTDIR)$(LIBDIR)/yum-plugins/
 	install -D -m 0644 misc/yum-qubes-hooks.conf $(DESTDIR)/etc/yum/pluginconf.d/yum-qubes-hooks.conf
@@ -173,7 +126,8 @@ install-rh: install-systemd install-systemd-dropins install-sysvinit
 	install -d $(DESTDIR)/etc/yum.conf.d
 	touch $(DESTDIR)/etc/yum.conf.d/qubes-proxy.conf
 
-	install -D -m 0644 misc/grub.qubes $(DESTDIR)/etc/default/grub.qubes
+	install -D -m 0644 misc/qubes-trigger-sync-appmenus.action $(DESTDIR)/etc/yum/post-actions/qubes-trigger-sync-appmenus.action
+
 	install -D -m 0644 misc/serial.conf $(DESTDIR)/usr/share/qubes/serial.conf
 	install -D misc/qubes-serial-login $(DESTDIR)/$(SBINDIR)/qubes-serial-login
 	install -D -m 0644 misc/dracut-qubes.conf \
@@ -185,204 +139,131 @@ install-rh: install-systemd install-systemd-dropins install-sysvinit
 		$(DESTDIR)$(PYTHON3_SITELIB)/dnf-plugins/qubes-hooks.py
 	install -D -m 0644 misc/dnf-qubes-hooks.conf $(DESTDIR)/etc/dnf/plugins/qubes-hooks.conf
 
-install-doc:
-	$(MAKE) -C doc install
 
-install-common: install-doc
+install-common:
 	$(MAKE) -C autostart-dropins install
 	install -m 0644 -D misc/fstab $(DESTDIR)/etc/fstab
 
-	# force /usr/bin before /bin to have /usr/bin/python instead of /bin/python
-	PATH="/usr/bin:$(PATH)" $(PYTHON) setup.py install $(PYTHON_PREFIX_ARG) -O1 --root $(DESTDIR)
-	mkdir -p $(DESTDIR)$(SBINDIR)
-
-	install -d -m 0750 $(DESTDIR)/etc/sudoers.d/
 	install -D -m 0440 misc/qubes.sudoers $(DESTDIR)/etc/sudoers.d/qubes
 	install -D -m 0440 misc/sudoers.d_qt_x11_no_mitshm $(DESTDIR)/etc/sudoers.d/qt_x11_no_mitshm
 	install -D -m 0644 misc/20_tcp_timestamps.conf $(DESTDIR)/etc/sysctl.d/20_tcp_timestamps.conf
 
 	install -d $(DESTDIR)/var/lib/qubes
 
-	install -D misc/xenstore-watch $(DESTDIR)$(BINDIR)/xenstore-watch-qubes
+	install -D misc/xenstore-watch $(DESTDIR)/usr/bin/xenstore-watch-qubes
 	install -d $(DESTDIR)/etc/udev/rules.d
 	install -m 0644 misc/udev-qubes-misc.rules $(DESTDIR)/etc/udev/rules.d/50-qubes-misc.rules
 	install -d $(DESTDIR)$(LIBDIR)/qubes/
+	install misc/vusb-ctl.py $(DESTDIR)$(LIBDIR)/qubes/
 	install misc/qubes-trigger-sync-appmenus.sh $(DESTDIR)$(LIBDIR)/qubes/
-	install -d -m 0750 $(DESTDIR)/etc/polkit-1/rules.d
 	install -D -m 0644 misc/polkit-1-qubes-allow-all.pkla $(DESTDIR)/etc/polkit-1/localauthority/50-local.d/qubes-allow-all.pkla
 	install -D -m 0644 misc/polkit-1-qubes-allow-all.rules $(DESTDIR)/etc/polkit-1/rules.d/00-qubes-allow-all.rules
 	install -D -m 0644 misc/mime-globs $(DESTDIR)/usr/share/qubes/mime-override/globs
 	install misc/qubes-download-dom0-updates.sh $(DESTDIR)$(LIBDIR)/qubes/
-	install -d $(DESTDIR)/usr/share/glib-2.0/schemas/
+	install -g user -m 2775 -d $(DESTDIR)/var/lib/qubes/dom0-updates
-	install -m 0644 \
-		misc/20_org.gnome.settings-daemon.plugins.updates.qubes.gschema.override \
-		misc/20_org.gnome.nautilus.qubes.gschema.override \
-		misc/20_org.mate.NotificationDaemon.qubes.gschema.override \
-		misc/20_org.gnome.desktop.wm.preferences.qubes.gschema.override \
-		$(DESTDIR)/usr/share/glib-2.0/schemas/
-	install -m 2775 -d $(DESTDIR)/var/lib/qubes/dom0-updates
-	install -D -m 0644 misc/qubes-master-key.asc $(DESTDIR)/usr/share/qubes/qubes-master-key.asc
-	install misc/resize-rootfs $(DESTDIR)$(LIBDIR)/qubes/
 
+	if [ -r misc/dispvm-dotfiles.$(DIST).tbz ] ; \
+	then \
+		install misc/dispvm-dotfiles.$(DIST).tbz $(DESTDIR)/etc/dispvm-dotfiles.tbz ; \
+	else \
+		install misc/dispvm-dotfiles.tbz $(DESTDIR)/etc/dispvm-dotfiles.tbz ; \
+	fi;
+
+	install misc/dispvm-prerun.sh $(DESTDIR)$(LIBDIR)/qubes/dispvm-prerun.sh
 	install misc/close-window $(DESTDIR)$(LIBDIR)/qubes/close-window
 
 	install misc/upgrades-installed-check $(DESTDIR)$(LIBDIR)/qubes/upgrades-installed-check
 	install misc/upgrades-status-notify $(DESTDIR)$(LIBDIR)/qubes/upgrades-status-notify
 
 	install -m 0644 network/udev-qubes-network.rules $(DESTDIR)/etc/udev/rules.d/99-qubes-network.rules
+	install network/qubes-setup-dnat-to-ns $(DESTDIR)$(LIBDIR)/qubes
+	install network/qubes-fix-nm-conf.sh $(DESTDIR)$(LIBDIR)/qubes
+	install network/setup-ip $(DESTDIR)$(LIBDIR)/qubes/
+	install network/network-manager-prepare-conf-dir $(DESTDIR)$(LIBDIR)/qubes/
+	install -d $(DESTDIR)/etc/dhclient.d
+	ln -s /usr/lib/qubes/qubes-setup-dnat-to-ns $(DESTDIR)/etc/dhclient.d/qubes-setup-dnat-to-ns.sh
+	install -d $(DESTDIR)/etc/NetworkManager/dispatcher.d/
+	install network/{qubes-nmhook,30-qubes-external-ip} $(DESTDIR)/etc/NetworkManager/dispatcher.d/
+	install -D network/vif-route-qubes $(DESTDIR)/etc/xen/scripts/vif-route-qubes
+	install -m 0644 -D network/tinyproxy-updates.conf $(DESTDIR)/etc/tinyproxy/tinyproxy-updates.conf
+	install -m 0644 -D network/updates-blacklist $(DESTDIR)/etc/tinyproxy/updates-blacklist
+	install -m 0755 -D network/iptables-updates-proxy $(DESTDIR)$(LIBDIR)/qubes/iptables-updates-proxy
+	install -d $(DESTDIR)/etc/xdg/autostart
+	install -m 0755 network/show-hide-nm-applet.sh $(DESTDIR)$(LIBDIR)/qubes/show-hide-nm-applet.sh
+	install -m 0644 network/show-hide-nm-applet.desktop $(DESTDIR)/etc/xdg/autostart/00-qubes-show-hide-nm-applet.desktop
+	install -m 0400 -D network/iptables $(DESTDIR)/etc/qubes/iptables.rules
+	install -m 0400 -D network/ip6tables $(DESTDIR)/etc/qubes/ip6tables.rules
 	install -m 0755 network/update-proxy-configs $(DESTDIR)$(LIBDIR)/qubes/
 
-	install -d $(DESTDIR)$(BINDIR)
+
-	install -m 0755 misc/qubes-session-autostart $(DESTDIR)$(BINDIR)/qubes-session-autostart
+	install -d $(DESTDIR)/$(SBINDIR)
-	install -m 0755 misc/qvm-features-request $(DESTDIR)$(BINDIR)/qvm-features-request
+	install network/qubes-firewall $(DESTDIR)/$(SBINDIR)/
-	install -m 0755 misc/qubes-run-terminal $(DESTDIR)/$(BINDIR)
+	install network/qubes-netwatcher $(DESTDIR)/$(SBINDIR)/
-	install -D -m 0644 misc/qubes-run-terminal.desktop $(DESTDIR)/$(APPLICATIONSDIR)/qubes-run-terminal.desktop
+
-	install -m 0755 qubes-rpc/qvm-sync-clock $(DESTDIR)$(BINDIR)/qvm-sync-clock
+	install -d $(DESTDIR)/usr/bin
-	install qubes-rpc/{qvm-open-in-dvm,qvm-open-in-vm,qvm-copy-to-vm,qvm-run-vm} $(DESTDIR)/usr/bin
+	install -m 0755 misc/qubes-session-autostart $(DESTDIR)/usr/bin/qubes-session-autostart
-	install qubes-rpc/qvm-copy $(DESTDIR)/usr/bin
+
+	install qubes-rpc/{qvm-open-in-dvm,qvm-open-in-vm,qvm-copy-to-vm,qvm-run,qvm-mru-entry} $(DESTDIR)/usr/bin
 	ln -s qvm-copy-to-vm $(DESTDIR)/usr/bin/qvm-move-to-vm
-	ln -s qvm-copy $(DESTDIR)/usr/bin/qvm-move
+	install qubes-rpc/wrap-in-html-if-url.sh $(DESTDIR)$(LIBDIR)/qubes
+	install qubes-rpc/qvm-copy-to-vm.kde $(DESTDIR)$(LIBDIR)/qubes
 	install qubes-rpc/qvm-copy-to-vm.gnome $(DESTDIR)$(LIBDIR)/qubes
-	ln -s qvm-copy-to-vm.gnome $(DESTDIR)$(LIBDIR)/qubes/qvm-move-to-vm.gnome
+	install qubes-rpc/qvm-move-to-vm.kde $(DESTDIR)$(LIBDIR)/qubes
-	ln -s qvm-copy-to-vm.gnome $(DESTDIR)$(LIBDIR)/qubes/qvm-copy-to-vm.kde
+	install qubes-rpc/qvm-move-to-vm.gnome $(DESTDIR)$(LIBDIR)/qubes
-	ln -s qvm-copy-to-vm.gnome $(DESTDIR)$(LIBDIR)/qubes/qvm-move-to-vm.kde
-	install qubes-rpc/qvm-actions.sh $(DESTDIR)$(LIBDIR)/qubes
-	install -m 0644 misc/uca_qubes.xml $(DESTDIR)$(LIBDIR)/qubes
-	mkdir -p $(DESTDIR)/etc/xdg/xfce4/xfconf/xfce-perchannel-xml
-	install -m 0644 misc/thunar.xml $(DESTDIR)/etc/xdg/xfce4/xfconf/xfce-perchannel-xml
 	install qubes-rpc/xdg-icon $(DESTDIR)$(LIBDIR)/qubes
 	install qubes-rpc/{vm-file-editor,qfile-agent,qopen-in-vm} $(DESTDIR)$(LIBDIR)/qubes
-	install qubes-rpc/qubes-open $(DESTDIR)$(BINDIR)
+	install qubes-rpc/qubes-open $(DESTDIR)/usr/bin
 	install qubes-rpc/tar2qfile $(DESTDIR)$(LIBDIR)/qubes
 	# Install qfile-unpacker as SUID - because it will fail to receive files from other vm
 	install -m 4755  qubes-rpc/qfile-unpacker $(DESTDIR)$(LIBDIR)/qubes
 	install qubes-rpc/qrun-in-vm $(DESTDIR)$(LIBDIR)/qubes
+	install qubes-rpc/sync-ntp-clock $(DESTDIR)$(LIBDIR)/qubes
 	install qubes-rpc/prepare-suspend $(DESTDIR)$(LIBDIR)/qubes
-	install qubes-rpc/qubes-sync-clock $(DESTDIR)$(LIBDIR)/qubes
 	install -m 0644 misc/qubes-suspend-module-blacklist $(DESTDIR)/etc/qubes-suspend-module-blacklist
 	install -d $(DESTDIR)/$(KDESERVICEDIR)
 	install -m 0644 qubes-rpc/{qvm-copy.desktop,qvm-move.desktop,qvm-dvm.desktop} $(DESTDIR)/$(KDESERVICEDIR)
-	install -d $(DESTDIR)/$(KDE5SERVICEDIR)
-	install -m 0644 qubes-rpc/{qvm-copy.desktop,qvm-move.desktop,qvm-dvm.desktop} $(DESTDIR)/$(KDE5SERVICEDIR)
 	install -d $(DESTDIR)/etc/qubes-rpc
-	install -m 0755 qubes-rpc/{qubes.Filecopy,qubes.OpenInVM,qubes.VMShell} $(DESTDIR)/etc/qubes-rpc
+	install -m 0644 qubes-rpc/{qubes.Filecopy,qubes.OpenInVM,qubes.VMShell,qubes.SyncNtpClock} $(DESTDIR)/etc/qubes-rpc
-	install -m 0755 qubes-rpc/qubes.VMRootShell $(DESTDIR)/etc/qubes-rpc
+	install -m 0644 qubes-rpc/{qubes.SuspendPre,qubes.SuspendPost,qubes.GetAppmenus} $(DESTDIR)/etc/qubes-rpc
-	install -m 0755 qubes-rpc/qubes.OpenURL $(DESTDIR)/etc/qubes-rpc
-	install -m 0755 qubes-rpc/{qubes.SuspendPre,qubes.SuspendPost,qubes.GetAppmenus} $(DESTDIR)/etc/qubes-rpc
 	install -m 0755 qubes-rpc/qubes.SuspendPreAll $(DESTDIR)/etc/qubes-rpc
 	install -m 0755 qubes-rpc/qubes.SuspendPostAll $(DESTDIR)/etc/qubes-rpc
-	install -m 0755 qubes-rpc/qubes.WaitForSession $(DESTDIR)/etc/qubes-rpc
+	install -m 0644 qubes-rpc/qubes.WaitForSession $(DESTDIR)/etc/qubes-rpc
-	install -m 0755 qubes-rpc/qubes.DetachPciDevice $(DESTDIR)/etc/qubes-rpc
+	install -m 0644 qubes-rpc/qubes.DetachPciDevice $(DESTDIR)/etc/qubes-rpc
-	install -m 0755 qubes-rpc/qubes.{Backup,Restore} $(DESTDIR)/etc/qubes-rpc
+	install -m 0644 qubes-rpc/qubes.{Backup,Restore} $(DESTDIR)/etc/qubes-rpc
-	install -m 0755 qubes-rpc/qubes.Select{File,Directory} $(DESTDIR)/etc/qubes-rpc
+	install -m 0644 qubes-rpc/qubes.Select{File,Directory} $(DESTDIR)/etc/qubes-rpc
-	install -m 0755 qubes-rpc/qubes.GetImageRGBA $(DESTDIR)/etc/qubes-rpc
+	install -m 0644 qubes-rpc/qubes.GetImageRGBA $(DESTDIR)/etc/qubes-rpc
-	install -m 0755 qubes-rpc/qubes.SetDateTime $(DESTDIR)/etc/qubes-rpc
+	install -m 0644 qubes-rpc/qubes.SetDateTime $(DESTDIR)/etc/qubes-rpc
 	install -m 0755 qubes-rpc/qubes.InstallUpdatesGUI $(DESTDIR)/etc/qubes-rpc
-	install -m 0755 qubes-rpc/qubes.ResizeDisk $(DESTDIR)/etc/qubes-rpc
-	install -m 0755 qubes-rpc/qubes.StartApp $(DESTDIR)/etc/qubes-rpc
-	install -m 0755 qubes-rpc/qubes.PostInstall $(DESTDIR)/etc/qubes-rpc
-	install -m 0755 qubes-rpc/qubes.GetDate $(DESTDIR)/etc/qubes-rpc
-
-	install -d $(DESTDIR)/etc/qubes/rpc-config
-	install -m 0644 qubes-rpc/rpc-config.README $(DESTDIR)/etc/qubes/rpc-config/README
-	for config in qubes-rpc/*.config; do \
-		install -m 0644 $$config $(DESTDIR)/etc/qubes/rpc-config/`basename $$config .config`; \
-	done
 
 	install -d $(DESTDIR)/etc/qubes/suspend-pre.d
 	install -m 0644 qubes-rpc/suspend-pre.README $(DESTDIR)/etc/qubes/suspend-pre.d/README
 	install -d $(DESTDIR)/etc/qubes/suspend-post.d
 	install -m 0644 qubes-rpc/suspend-post.README $(DESTDIR)/etc/qubes/suspend-post.d/README
-	install -m 0755 qubes-rpc/suspend-post-qvm-sync-clock.sh \
+
-		$(DESTDIR)/etc/qubes/suspend-post.d/qvm-sync-clock.sh
-	install -d $(DESTDIR)/etc/qubes/post-install.d
-	install -m 0644 post-install.d/README $(DESTDIR)/etc/qubes/post-install.d/
-	install -m 0755 post-install.d/*.sh $(DESTDIR)/etc/qubes/post-install.d/
 	install -d $(DESTDIR)/usr/share/nautilus-python/extensions
 	install -m 0644 qubes-rpc/*_nautilus.py $(DESTDIR)/usr/share/nautilus-python/extensions
 
-	install -D -m 0644 misc/dconf-db-local-dpi $(DESTDIR)/etc/dconf/db/local.d/dpi
+	install -D -m 0755 misc/qubes-desktop-run $(DESTDIR)/usr/bin/qubes-desktop-run
 
-	install -D -m 0755 misc/qubes-desktop-run $(DESTDIR)$(BINDIR)/qubes-desktop-run
+	mkdir -p $(DESTDIR)/$(PYTHON_SITEARCH)/qubes/
+
+ifeq ($(shell lsb_release -is), Debian)
+	install -m 0644 misc/xdg.py $(DESTDIR)/$(PYTHON_SITEARCH)/qubes/
+else
+	install -m 0644 misc/py2/xdg.py* $(DESTDIR)/$(PYTHON_SITEARCH)/qubes/
+endif
 
 	install -d $(DESTDIR)/mnt/removable
 
 	install -D -m 0644 misc/xorg-preload-apps.conf $(DESTDIR)/etc/X11/xorg-preload-apps.conf
 
-	install -d $(DESTDIR)/usr/lib/qubes-bind-dirs.d
-	install -D -m 0644 misc/30_cron.conf $(DESTDIR)/usr/lib/qubes-bind-dirs.d/30_cron.conf
-
-
 	install -d $(DESTDIR)/var/run/qubes
+	install -d $(DESTDIR)/home_volatile/user
 	install -d $(DESTDIR)/rw
 
-# Networking install target includes:
+install-deb: install-common install-systemd install-systemd-dropins
-# * basic network functionality (setting IP address, DNS, default gateway)
-# * package update proxy client
-install-networking:
-	install -d $(DESTDIR)$(SYSLIBDIR)/systemd/system
-	install -m 0644 vm-systemd/qubes-*.socket $(DESTDIR)$(SYSLIBDIR)/systemd/system/
-
-	install -d $(DESTDIR)$(LIBDIR)/qubes/
-	install network/setup-ip $(DESTDIR)$(LIBDIR)/qubes/
-
-# Netvm install target includes:
-# * qubes-firewall service (FirewallVM)
-# * DNS redirection setup
-# * proxy service used by TemplateVMs to download updates
-install-netvm:
-	install -D -m 0644 $(SYSTEMD_NETWORK_SERVICES) $(DESTDIR)$(SYSLIBDIR)/systemd/system/
-
-	install -D -m 0755 network/qubes-iptables $(DESTDIR)$(LIBDIR)/qubes/init/qubes-iptables
-
-	install -D -m 0644 vm-systemd/qubes-core-agent-linux.tmpfiles \
-		$(DESTDIR)/usr/lib/tmpfiles.d/qubes-core-agent-linux.conf
-
-	mkdir -p $(DESTDIR)$(SBINDIR)
-
-ifneq ($(SBINDIR),/usr/bin)
-	mv $(DESTDIR)/usr/bin/qubes-firewall $(DESTDIR)$(SBINDIR)/qubes-firewall
-endif
-
-	install -D network/qubes-setup-dnat-to-ns $(DESTDIR)$(LIBDIR)/qubes/qubes-setup-dnat-to-ns
-
-	install -d $(DESTDIR)/etc/dhclient.d
-	ln -s /usr/lib/qubes/qubes-setup-dnat-to-ns $(DESTDIR)/etc/dhclient.d/qubes-setup-dnat-to-ns.sh
-
-	install -D network/vif-route-qubes $(DESTDIR)/etc/xen/scripts/vif-route-qubes
-	install -D network/vif-qubes-nat.sh $(DESTDIR)/etc/xen/scripts/vif-qubes-nat.sh
-	install -m 0644 -D network/tinyproxy-updates.conf $(DESTDIR)/etc/tinyproxy/tinyproxy-updates.conf
-	install -m 0644 -D network/updates-blacklist $(DESTDIR)/etc/tinyproxy/updates-blacklist
-	install -m 0755 -D network/iptables-updates-proxy $(DESTDIR)$(LIBDIR)/qubes/iptables-updates-proxy
-
-	install -m 0400 -D network/iptables $(DESTDIR)/etc/qubes/iptables.rules
-	install -m 0400 -D network/ip6tables $(DESTDIR)/etc/qubes/ip6tables.rules
-	install -m 0400 -D network/ip6tables-enabled $(DESTDIR)/etc/qubes/ip6tables-enabled.rules
-
-	install -m 0755 -D qubes-rpc/qubes.UpdatesProxy $(DESTDIR)/etc/qubes-rpc/qubes.UpdatesProxy
-
-# networkmanager install target allow integration of NetworkManager for Qubes VM:
-# * make connections config persistent
-# * adjust DNS redirections when needed
-# * show/hide NetworkManager applet icon
-install-networkmanager:
-	install -d $(DESTDIR)$(LIBDIR)/qubes/
-	install network/qubes-fix-nm-conf.sh $(DESTDIR)$(LIBDIR)/qubes/
-	install network/network-manager-prepare-conf-dir $(DESTDIR)$(LIBDIR)/qubes/
-
-	install -d $(DESTDIR)/etc/NetworkManager/dispatcher.d/
-	install network/{qubes-nmhook,30-qubes-external-ip} $(DESTDIR)/etc/NetworkManager/dispatcher.d/
-
-	install -d $(DESTDIR)/usr/lib/NetworkManager/conf.d
-	install -m 0644 network/nm-30-qubes.conf $(DESTDIR)/usr/lib/NetworkManager/conf.d/30-qubes.conf
-
-	install -d $(DESTDIR)/etc/xdg/autostart
-	install -m 0755 network/show-hide-nm-applet.sh $(DESTDIR)$(LIBDIR)/qubes/
-	install -m 0644 network/show-hide-nm-applet.desktop $(DESTDIR)/etc/xdg/autostart/00-qubes-show-hide-nm-applet.desktop
-
-install-deb: install-common install-systemd install-systemd-dropins install-systemd-networking-dropins install-networking install-networkmanager install-netvm
 	mkdir -p $(DESTDIR)/etc/apt/sources.list.d
-	sed -e "s/@DIST@/`lsb_release -cs`/" misc/qubes-r4.list.in > $(DESTDIR)/etc/apt/sources.list.d/qubes-r4.list
+	sed -e "s/@DIST@/`lsb_release -cs`/" misc/qubes-r3.list.in > $(DESTDIR)/etc/apt/sources.list.d/qubes-r3.list
 	install -D -m 644 misc/qubes-archive-keyring.gpg $(DESTDIR)/etc/apt/trusted.gpg.d/qubes-archive-keyring.gpg
 	install -D -m 644 network/00notify-hook $(DESTDIR)/etc/apt/apt.conf.d/00notify-hook
 	install -d $(DESTDIR)/etc/sysctl.d
@@ -393,14 +274,6 @@ install-deb: install-common install-systemd install-systemd-dropins install-syst
 	install -m 0644 misc/pam.d_su.qubes $(DESTDIR)/etc/pam.d/su.qubes
 	install -d $(DESTDIR)/etc/needrestart/conf.d
 	install -D -m 0644 misc/50_qubes.conf $(DESTDIR)/etc/needrestart/conf.d/50_qubes.conf
-	install -D -m 0644 misc/grub.qubes $(DESTDIR)/etc/default/grub.d/30-qubes.cfg
-	install -D -m 0644 misc/apt-conf-70no-unattended $(DESTDIR)/etc/apt/apt.conf.d/70no-unattended
 
-	mkdir -p $(DESTDIR)/etc/systemd/system/
-	install -m 0644 vm-systemd/haveged.service  $(DESTDIR)/etc/systemd/system/
 
-install-corevm: install-rh install-common install-systemd install-sysvinit install-systemd-dropins install-networking
+install-vm: install-rh install-common
-
-install-netvm: install-systemd-networking-dropins install-networkmanager
-
-install-vm: install-corevm install-netvm

Makefile.builder

@@ -1,5 +1,10 @@
 ifeq ($(PACKAGE_SET),vm)
-  RPM_SPEC_FILES := rpm_spec/core-agent.spec
+  ifeq ($(UPGRADE_PKG_ONLY),yes)
+    RPM_SPEC_FILES := rpm_spec/upgrade-vm.spec
+  else
+  RPM_SPEC_FILES := rpm_spec/core-vm.spec \
+  rpm_spec/core-vm-doc.spec
+  endif
 
   ifneq ($(filter $(DISTRIBUTION), debian qubuntu),)
     DEBIAN_BUILD_DIRS := debian
@@ -12,9 +17,7 @@ endif
 source-debian-quilt-copy-in: VERSION = $(shell cat $(ORIG_SRC)/version)
 source-debian-quilt-copy-in: ORIG_FILE = "$(CHROOT_DIR)/$(DIST_SRC)/../qubes-core-agent_$(VERSION).orig.tar.gz"
 source-debian-quilt-copy-in:
-	if [ $(DIST) == bionic ] ; then \
-		sed -i /initscripts/d $(CHROOT_DIR)/$(DIST_SRC)/debian/control ;\
-	fi
 	-$(shell $(ORIG_SRC)/debian-quilt $(ORIG_SRC)/series-debian-vm.conf $(CHROOT_DIR)/$(DIST_SRC)/debian/patches)
+	tar cfz $(ORIG_FILE) --exclude-vcs --exclude=rpm --exclude=pkgs --exclude=deb --exclude=debian -C $(CHROOT_DIR)/$(DIST_SRC) .
 
 # vim: filetype=make

archlinux/PKGBUILD

@@ -1,153 +1,115 @@
-#!/bin/bash
+# This is an example PKGBUILD file. Use this as a start to creating your own,
+# and remove these comments. For more information, see 'man PKGBUILD'.
+# NOTE: Please fill out the license field for your package! If it is unknown,
+# then please put 'unknown'.
+
 # Maintainer: Olivier Medoc <o_medoc@yahoo.fr>
-# shellcheck disable=SC2034
+pkgname=qubes-vm-core
-pkgname=(qubes-vm-core qubes-vm-networking qubes-vm-keyring)
+pkgver=`cat version`
-pkgver=$(cat version)
+pkgrel=9
-pkgrel=15
 epoch=
 pkgdesc="The Qubes core files for installation inside a Qubes VM."
 arch=("x86_64")
 url="http://qubes-os.org/"
 license=('GPL')
 groups=()
-makedepends=(gcc make pkg-config "qubes-vm-utils>=3.1.3" qubes-libvchan qubes-db-vm qubes-vm-xen libx11 python2 python3 lsb-release pandoc)
+depends=("qubes-vm-utils>=3.1.3" python2 python3 python2-xdg ethtool ntp net-tools gnome-packagekit imagemagick fakeroot notification-daemon dconf pygtk zenity qubes-libvchan qubes-db-vm haveged python2-gobject python2-dbus xdg-utils notification-daemon)
+makedepends=(gcc make pkg-config "qubes-vm-utils>=3.1.3" qubes-libvchan qubes-db-vm qubes-vm-xen libx11 python2 python3)
 checkdepends=()
+optdepends=(gnome-keyring gnome-settings-daemon networkmanager iptables tinyproxy python2-nautilus gpk-update-viewer)
 provides=()
 conflicts=()
 replaces=()
 backup=()
 options=()
+install=PKGBUILD.install
 changelog=
 
-source=(
+source=(	PKGBUILD.qubes-ensure-lib-modules.service PKGBUILD.qubes-update-desktop-icons.hook
-    PKGBUILD.qubes-ensure-lib-modules.service PKGBUILD.qubes-update-desktop-icons.hook
+		PKGBUILD-qubes-noupgrade.conf
-    PKGBUILD-qubes-pacman-options.conf
+		PKGBUILD-qubes-repo-3.1.conf
-    PKGBUILD-qubes-repo-3.2.conf
+		PKGBUILD-qubes-repo-3.2.conf
-    PKGBUILD-qubes-repo-4.0.conf
+		)
-    PKGBUILD-keyring-keys
-    PKGBUILD-keyring-trusted
-    PKGBUILD-keyring-revoked
-)
 
 noextract=()
-md5sums=(SKIP)
+md5sums=( '88f4b3d5b156888a9d38f5bc28702ab8' 'bbfb946d6d2787e5abf8e2236502a3d4'
+          'c1c1b86eed48cc0f943f21b9a1df8b8e'
+	  '36bf82df048e81250e7ba80b3224bddc'
+	  'd5898def7bad7fd92ea60f0bf48174e3'
+          )
 
 build() {
-    for source in autostart-dropins qubes-rpc qrexec misc Makefile vm-init.d vm-systemd network init version doc setup.py qubesagent post-install.d; do
-        # shellcheck disable=SC2154
-        (ln -s "$srcdir/../$source" "$srcdir/$source")
-    done
 
-    # Fix for network tools paths
+for source in autostart-dropins qubes-rpc qrexec misc Makefile vm-init.d vm-systemd network ; do
-    sed 's:/sbin/ifconfig:ifconfig:g' -i network/*
+  (ln -s $srcdir/../$source $srcdir/$source)
-    sed 's:/sbin/route:route:g' -i network/*
+done
-    sed 's:/sbin/ethtool:ethtool:g' -i network/*
-    sed 's:/sbin/ip:ip:g' -i network/*
-    sed 's:/bin/grep:grep:g' -i network/*
 
-    # Force running all scripts with python2
+# Fix for network tools paths
-    sed 's:^#!/usr/bin/python.*:#!/usr/bin/python2:' -i misc/*
+sed 's:/sbin/ifconfig:ifconfig:g' -i network/*
-    sed 's:^#!/usr/bin/env python.*:#!/usr/bin/env python2:' -i misc/*
+sed 's:/sbin/route:route:g' -i network/*
-    sed 's:^#!/usr/bin/python.*:#!/usr/bin/python2:' -i qubes-rpc/*
+sed 's:/sbin/ethtool:ethtool:g' -i network/*
-    sed 's:^#!/usr/bin/env python.*:#!/usr/bin/env python2:' -i qubes-rpc/*
+sed 's:/sbin/ip:ip:g' -i network/*
+sed 's:/bin/grep:grep:g' -i network/*
 
-    # Fix for archlinux sbindir
+# Force running all scripts with python2
-    sed 's:/usr/sbin/ntpdate:/usr/bin/ntpdate:g' -i qubes-rpc/sync-ntp-clock
+sed 's:#!/usr/bin/python:#!/usr/bin/python2:' -i misc/*
-    sed 's:/usr/sbin/qubes-firewall:/usr/bin/qubes-firewall:g' -i vm-systemd/qubes-firewall.service
+sed 's:#!/usr/bin/env python:#!/usr/bin/env python2:' -i misc/*
+sed 's:#!/usr/bin/python:#!/usr/bin/python2:' -i qubes-rpc/*
+sed 's:#!/usr/bin/env python:#!/usr/bin/env python2:' -i qubes-rpc/*
+
+
+# Fix for archlinux sbindir
+sed 's:/usr/sbin/ntpdate:/usr/bin/ntpdate:g' -i qubes-rpc/sync-ntp-clock
+sed 's:/usr/sbin/qubes-netwatcher:/usr/bin/qubes-netwatcher:g' -i vm-systemd/qubes-netwatcher.service
+sed 's:/usr/sbin/qubes-firewall:/usr/bin/qubes-firewall:g' -i vm-systemd/qubes-firewall.service
+
+for dir in qubes-rpc qrexec misc; do
+  (cd $dir; make)
+done
 
-    for dir in qubes-rpc qrexec misc; do
-        make -C "$dir"
-    done
 }
 
-#This package provides:
+package() {
-# * qrexec agent
+  # Note: Archlinux removed use of directory such as /sbin /bin /usr/sbin (https://mailman.archlinux.org/pipermail/arch-dev-public/2012-March/022625.html)
-# * qubes rpc scripts
-# * core linux tools and scripts
-# * core systemd services and drop-ins
-# * basic network functionality (setting IP address, DNS, default gateway)
-package_qubes-vm-core() {
-    depends=("qubes-vm-utils>=3.1.3" python2 python2-xdg ethtool ntp net-tools
-             gnome-packagekit imagemagick fakeroot notification-daemon dconf
-             zenity qubes-libvchan "qubes-db-vm>=3.2.1" haveged python2-gobject
-             python2-dbus xdg-utils notification-daemon gawk sed procps-ng librsvg
-             socat
-             )
-    optdepends=(gnome-keyring gnome-settings-daemon python2-nautilus gpk-update-viewer qubes-vm-networking qubes-vm-keyring)
-    install=PKGBUILD.install
 
-    # Note: Archlinux removed use of directory such as /sbin /bin /usr/sbin (https://mailman.archlinux.org/pipermail/arch-dev-public/2012-March/022625.html)
+  (cd qrexec; make install DESTDIR=$pkgdir SBINDIR=/usr/bin LIBDIR=/usr/lib SYSLIBDIR=/usr/lib)
-    # shellcheck disable=SC2154
-    make -C qrexec install DESTDIR="$pkgdir" SBINDIR=/usr/bin LIBDIR=/usr/lib SYSLIBDIR=/usr/lib
 
-    PYTHON=python2 make install-corevm DESTDIR="$pkgdir" SBINDIR=/usr/bin LIBDIR=/usr/lib SYSLIBDIR=/usr/lib SYSTEM_DROPIN_DIR=/usr/lib/systemd/system USER_DROPIN_DIR=/usr/lib/systemd/user DIST=archlinux
+  make install-vm DESTDIR=$pkgdir SBINDIR=/usr/bin LIBDIR=/usr/lib SYSLIBDIR=/usr/lib DROPIN_DIR=usr/lib/systemd DIST=archlinux
 
-    # Remove things non wanted in archlinux
+  # Remove things non wanted in archlinux
-    rm -r "$pkgdir/etc/yum"*
+  rm -r $pkgdir/etc/yum*
-    rm -r "$pkgdir/etc/dnf"*
+  rm -r $pkgdir/etc/init.d
-    rm -r "$pkgdir/etc/init.d"
+  # Remove fedora specific scripts
-    # Remove fedora specific scripts
+  rm $pkgdir/etc/fstab
-    rm "$pkgdir/etc/fstab"
 
-    # Install systemd script allowing to automount /lib/modules
+  # Install systemd script allowing to automount /lib/modules
-    install -m 644 "$srcdir/PKGBUILD.qubes-ensure-lib-modules.service" "${pkgdir}/usr/lib/systemd/system/qubes-ensure-lib-modules.service"
+  install -m 644 $srcdir/PKGBUILD.qubes-ensure-lib-modules.service ${pkgdir}/usr/lib/systemd/system/qubes-ensure-lib-modules.service
 
-    # Install pacman hook to update desktop icons
+  # Install pacman hook to update desktop icons
-    mkdir -p "${pkgdir}/usr/share/libalpm/hooks/"
+  mkdir -p ${pkgdir}/usr/share/libalpm/hooks/
-    install -m 644 "$srcdir/PKGBUILD.qubes-update-desktop-icons.hook" "${pkgdir}/usr/share/libalpm/hooks/qubes-update-desktop-icons.hook"
+  install -m 644 $srcdir/PKGBUILD.qubes-update-desktop-icons.hook ${pkgdir}/usr/share/libalpm/hooks/qubes-update-desktop-icons.hook
 
-    # Install pacman.d drop-ins (at least 1 drop-in must be installed or pacman will fail)
+  # Install pacman.d drop-ins (at least 1 drop-in must be installed or pacman will fail)
-    mkdir -p "${pkgdir}/etc/pacman.d"
+  mkdir -p ${pkgdir}/etc/pacman.d
-    install -m 644 "$srcdir/PKGBUILD-qubes-pacman-options.conf" "${pkgdir}/etc/pacman.d/10-qubes-options.conf"
+  install -m 644 $srcdir/PKGBUILD-qubes-noupgrade.conf ${pkgdir}/etc/pacman.d/10-qubes-noupgrade.conf
 
-    # Install pacman repository
+  # Install pacman repository
-    release=$(echo "$pkgver" | cut -d '.' -f 1,2)
+  release=`echo $pkgver | cut -d '.' -f 1,2`
-    echo "Installing repository for release ${release}"
+  echo "Installing repository for release ${release}"
-    install -m 644 "$srcdir/PKGBUILD-qubes-repo-${release}.conf" "${pkgdir}/etc/pacman.d/99-qubes-repository-${release}.conf.disabled"
+  install -m 644 $srcdir/PKGBUILD-qubes-repo-${release}.conf ${pkgdir}/etc/pacman.d/99-qubes-repository-${release}.conf
 
-    # Archlinux specific: enable autologin on tty1
+  # Archlinux specific: enable autologin on tty1
-    mkdir -p "$pkgdir/etc/systemd/system/getty@tty1.service.d/"
+  mkdir -p $pkgdir/etc/systemd/system/getty@tty1.service.d/
-    cat <<EOF > "$pkgdir/etc/systemd/system/getty@tty1.service.d/autologin.conf"
+  cat <<EOF > $pkgdir/etc/systemd/system/getty@tty1.service.d/autologin.conf
 [Service]
 ExecStart=
 ExecStart=-/usr/bin/agetty --autologin user --noclear %I 38400 linux
 EOF
 
-    # Archlinux packaging guidelines: /var/run is a symlink to a tmpfs. Don't create it
+  # Archlinux packaging guidelines: /var/run is a symlink to a tmpfs. Don't create it
-    rm -r "$pkgdir/var/run"
+  rm -r $pkgdir/var/run
-}
-
-#This package provides:
-# * proxy service used by TemplateVMs to download updates
-# * qubes-firewall service (FirewallVM)
-#
-#Integration of NetworkManager for Qubes VM:
-# * make connections config persistent
-# * adjust DNS redirections when needed
-# * show/hide NetworkManager applet icon
-#
-package_qubes-vm-networking() {
-    pkgdesc="Qubes OS tools allowing to use a Qubes VM as a NetVM/ProxyVM"
-    depends=(qubes-vm-core "qubes-vm-utils>=3.1.3" python2 ethtool net-tools
-             "qubes-db-vm>=3.2.1" networkmanager iptables tinyproxy nftables
-             )
-    install=PKGBUILD-networking.install
-
-    # shellcheck disable=SC2154
-    PYTHON=python2 make install-netvm DESTDIR="$pkgdir" SBINDIR=/usr/bin LIBDIR=/usr/lib SYSLIBDIR=/usr/lib SYSTEM_DROPIN_DIR=/usr/lib/systemd/system USER_DROPIN_DIR=/usr/lib/systemd/user DIST=archlinux
-
-}
-
-package_qubes-vm-keyring() {
-    pkgdesc="Qubes OS Binary Repository Activation package and Keyring"
-    install=PKGBUILD-keyring.install
-
-    # Install keyring (will be activated through the .install file)
-    install -dm755 "${pkgdir}/usr/share/pacman/keyrings/"
-    install -m0644 PKGBUILD-keyring-keys "${pkgdir}/usr/share/pacman/keyrings/qubesos-vm.gpg"
-    install -m0644 PKGBUILD-keyring-trusted "${pkgdir}/usr/share/pacman/keyrings/qubesos-vm-trusted"
-    install -m0644 PKGBUILD-keyring-revoked "${pkgdir}/usr/share/pacman/keyrings/qubesos-vm-revoked"
 
 }
 
 # vim:set ts=2 sw=2 et:
+

archlinux/PKGBUILD-keyring-keys

@@ -1,30 +0,0 @@
------BEGIN PGP PUBLIC KEY BLOCK-----
-
-mQENBFM0TnYBCADNyamUtA9e0/oUu4AeAgt1JYDtq3zCQSX7pHpY1zkGtulppSOe
-gkCgW2db+FlKeUNHQ+JX0uv8Ny0SjQBZO0yNxDLfPuqJzM/VjUIdLTJS0FEpxzT1
-Oiz0WRdcbeHtQ8SmEfmRStaB9PTNZ97FogFFONvQ6r/ICNldqfe+Qq72D/p6FqNM
-mW16dZokQEOgJpOb/L7dHNrta1ye8CurrEbXIt7B+4NnUpvzFmnQ+OxsC3AUbvI5
-PbaQyu8ivhoofnpgj66PojlFYMaL8mUaScL2VM5Ljx72zVA5+MUmk8O02O2X8Rdc
-+5boRi2h7oyCASBYK3x+WayaDTNWx3o8+sSdABEBAAG0N09saXZpZXIgTUVET0Mg
-KFF1YmVzLU9TIHNpZ25pbmcga2V5KSA8b19tZWRvY0B5YWhvby5mcj6JAT4EEwEC
-ACgCGwMGCwkIBwMCBhUIAgkKCwQWAgMBAh4BAheABQJW+jhsBQkHiFDrAAoJECBD
-56zBgzucHCwH/RLCCM1PJ50jEMJg7ZBrwkv5cvKePD1iGhPFOZ1gBtMTYfl7zJO7
-gOuOgQ+TKjfIFM/ijQBFMRmByrQ0ZkGNIqY7JB3shZ5EsCeb7cgyw7hEyj4S3O6e
-K+CVVy4CBAyXILVr/En8xU41K1qQpEiHkvqk0E05sEkYcN4Ggvw5JUNWpZO7fl6I
-tLvTBf5aPqiLqWN08fjdmVJ/5l+LCdMyJxUdsQV0pkzcv9l8ouB/0ig8HikoC+dW
-HuWbk9uj1CU0c4C8tTbOszjKAbEZ5msZ2NUxPM1vqKaac8IbWkSJBqlYFcb3PSMk
-LmFtXN/0hAcf8KbziODQgKcyuEBi3b5d6wy5AQ0EUzROdgEIAOG22xrDqJkCrEx8
-QFnZYSwxV2lI9fDyCT/kaHPa/5YOV/Xa01RLM27UPbV/UKkKN+M6+mFj26e+E25p
-2R/e1Wk9HDrbu7NDXozGcKDlTIAmQ4yjNVb/G1850/SO1vuPDfNzMD81F18XzYCa
-eyUV88HjXTbJSeJAbjWNvTkoMK4wY6PlHfyT0G0i4svfL/mZCGM8KagNouGHuG8s
-5JKwlC1BZnmfDuB4exP7cSNEDWwnBn98rx13DMLkGJu1xGnLqdGJw6WpP4a1IG7A
-9NDE2VetAS/ElMbMqfyuqiAxhtnuGdxstDaU7gW4VMTjAOMtO9LLY20EipsSBUrg
-7U1ync0AEQEAAYkBJQQYAQIADwIbDAUCVvo4nQUJB4hRJAAKCRAgQ+eswYM7nLWy
-CAC6enhJbXKGchqgfh+CeKsvWg97JG8yjW4W/9RL9Vto8ppgNzIKbA7AKgqOiy5l
-TToLaxK+Z1JE72lsWUnALmz1Oa7M7M9J1ptfD8TMj1/D3cj2Lnrg7qTaEEL5Nw+t
-FRNXeUjsuWt+iW7eYiGtI+eSWBokH945Ig32vf88n0t3F8whDRzv5fy1yF35aMRS
-HS5gDJv5t2BnPtehMhr5EOHbUH3UFevA79Hf4bUlOOo7eTTmSPMDcWFUA9MMKoE5
-pkHwoimXiNJy3e8TZ4uSTBH8XcXA/5mYSXbWKBX4Y5JznOBTtkjGsbL7dua3zDbF
-BGNH5RhiY1/bJ+m4zxU8bDWq
-=ofdo
------END PGP PUBLIC KEY BLOCK-----

archlinux/PKGBUILD-keyring-trusted

@@ -1 +0,0 @@
-D85EE12F967851CCF433515A2043E7ACC1833B9C:4:

archlinux/PKGBUILD-keyring.install

@@ -1,18 +0,0 @@
-post_upgrade() {
-	if usr/bin/pacman-key -l >/dev/null 2>&1; then
-		usr/bin/pacman-key --populate qubesos-vm
-	fi
-	release=$(echo "$1" | cut -d '.' -f 1,2)
-
-	if ! [ -h /etc/pacman.d/99-qubes-repository-${release}.conf ] ; then
-            ln -s /etc/pacman.d/99-qubes-repository-${release}.conf.disabled /etc/pacman.d/99-qubes-repository-${release}.conf 
-        fi
-
-}
-
-post_install() {
-	if [ -x usr/bin/pacman-key ]; then
-		post_upgrade "$1"
-	fi
-}
-

archlinux/PKGBUILD-networking.install

@@ -1,41 +0,0 @@
-#!/bin/bash
-
-## arg 1:  the new package version
-post_install() {
-    # Create NetworkManager configuration if we do not have it
-    if ! [ -e /etc/NetworkManager/NetworkManager.conf ]; then
-    echo '[main]' > /etc/NetworkManager/NetworkManager.conf
-    echo 'plugins = keyfile' >> /etc/NetworkManager/NetworkManager.conf
-    echo '[keyfile]' >> /etc/NetworkManager/NetworkManager.conf
-    fi
-
-    # Remove ip_forward setting from sysctl, so NM will not reset it
-    # Archlinux now use sysctl.d/ instead of sysctl.conf
-    #sed 's/^net.ipv4.ip_forward.*/#\0/'  -i /etc/sysctl.conf
-
-    /usr/lib/qubes/qubes-fix-nm-conf.sh
-
-    # Yum proxy configuration is fedora specific
-    #if ! grep -q '/etc/yum\.conf\.d/qubes-proxy\.conf' /etc/yum.conf; then
-    #  echo >> /etc/yum.conf
-    #  echo '# Yum does not support inclusion of config dir...' >> /etc/yum.conf
-    #  echo 'include=file:///etc/yum.conf.d/qubes-proxy.conf' >> /etc/yum.conf
-    #fi
-
-    for srv in qubes-firewall.service qubes-iptables.service qubes-network.service qubes-updates-proxy.service ; do
-        systemctl enable $srv
-    done
-}
-
-## arg 1:  the new package version
-## arg 2:  the old package version
-post_upgrade() {
-    post_install
-}
-
-## arg 1:  the old package version
-post_remove() {
-    for srv in qubes-firewall.service qubes-iptables.service qubes-network.service qubes-updates-proxy.service ; do
-        systemctl disable $srv
-    done
-}

archlinux/PKGBUILD-qubes-noupgrade.conf

@@ -0,0 +1,2 @@
+NoUpgrade = etc/pam.d/su
+NoUpgrade = etc/pam.d/su-l

archlinux/PKGBUILD-qubes-pacman-options.conf

@@ -1,2 +0,0 @@
-[options]
-NoUpgrade = etc/pam.d/su-l

archlinux/PKGBUILD-qubes-repo-3.1.conf

@@ -0,0 +1,2 @@
+[qubes-r3.1]
+Server = http://olivier.medoc.free.fr/archlinux/$repo

archlinux/PKGBUILD-qubes-repo-3.2.conf

@@ -1,2 +1,2 @@
 [qubes-r3.2]
-Server = http://olivier.medoc.free.fr/archlinux/current/
+Server = http://olivier.medoc.free.fr/archlinux/$repo

archlinux/PKGBUILD-qubes-repo-4.0.conf

@@ -1,2 +0,0 @@
-[qubes-r4.0]
-Server = http://olivier.medoc.free.fr/archlinux/current

archlinux/PKGBUILD.install

@@ -1,52 +1,53 @@
-#!/bin/bash
-qubes_preset_file="75-qubes-vm.preset"
 
 ###########################
 ## Pre-Install functions ##
 ###########################
 
 update_default_user() {
-    # Make sure there is a qubes group
-    groupadd --force --system --gid 98 qubes
 
-    # Archlinux bash version has a 'bug' when running su -c, /etc/profile is not loaded because bash consider there is no interactive pty when running 'su - user -c' or something like this.
+	# Make sure there is a qubes group
-    # See https://bugs.archlinux.org/task/31831
+	groupadd --force --system --gid 98 qubes
-    id -u 'user' >/dev/null 2>&1 || {
+
-        useradd --user-group --create-home --shell /bin/bash user
+	# Archlinux bash version has a 'bug' when running su -c, /etc/profile is not loaded because bash consider there is no interactive pty when running 'su - user -c' or something like this.
-    }
+	# See https://bugs.archlinux.org/task/31831
-    usermod -a --groups qubes user
+	id -u 'user' >/dev/null 2>&1 || {
+	  useradd --user-group --create-home --shell /bin/zsh user
+	}
+	usermod -a --groups qubes user
+
 }
 
 ## arg 1:  the new package version
 pre_install() {
-    echo "Pre install..."
+	echo "Pre install..."
 
-    update_default_user
+	update_default_user
 
-    # do this whole %pre thing only when updating for the first time...
+	# do this whole %pre thing only when updating for the first time...
 
-    mkdir -p /var/lib/qubes
+	mkdir -p /var/lib/qubes
 
-    # Backup fstab / But use archlinux defaults (cp instead of mv)
+	# Backup fstab / But use archlinux defaults (cp instead of mv)
-    if [ -e /etc/fstab ] ; then
+	if [ -e /etc/fstab ] ; then
-        cp /etc/fstab /var/lib/qubes/fstab.orig
+		cp /etc/fstab /var/lib/qubes/fstab.orig
-    fi
+	fi
 
-    # Add qubes core related fstab entries
+	# Add qubes core related fstab entries
-    echo "xen	/proc/xen	xenfs	defaults	0 0" >> /etc/fstab
+	echo "xen	/proc/xen	xenfs	defaults	0 0" >> /etc/fstab
 
-    usermod -p '' root
+	usermod -p '' root
-    usermod -L user
+	usermod -L user
 }
 
 
 ## arg 1:  the new package version
 ## arg 2:  the old package version
 pre_upgrade() {
-    # do something here
+	# do something here
-    echo "Pre upgrade..."
+	echo "Pre upgrade..."
+
+	update_default_user
 
-    update_default_user
 }
 
 ###################
@@ -56,17 +57,19 @@ pre_upgrade() {
 
 configure_notification-daemon() {
     # Enable autostart of notification-daemon when installed
-    if [ ! -L /etc/xdg/autostart/notification-daemon.desktop ]; then
+    if [ ! -e /etc/xdg/autostart/notification-daemon.desktop ]; then
         ln -s /usr/share/applications/notification-daemon.desktop /etc/xdg/autostart/
     fi
 }
 
 configure_selinux() {
-    # SELinux is not enabled on archlinux
+
-    #echo "--> Disabling SELinux..."
+	# SELinux is not enabled on archlinux
-    echo "SELINUX not enabled on archlinux. skipped."
+	#echo "--> Disabling SELinux..."
-    # sed -e s/^SELINUX=.*$/SELINUX=disabled/ -i /etc/selinux/config
+	echo "SELINUX not enabled on archlinux. skipped."
-    # setenforce 0 2>/dev/null
+	# sed -e s/^SELINUX=.*$/SELINUX=disabled/ -i /etc/selinux/config
+	# setenforce 0 2>/dev/null
+
 }
 
 ############################
@@ -74,320 +77,257 @@ configure_selinux() {
 ############################
 
 update_qubesconfig() {
-    # Remove old firmware updates link
-    if [ -L /lib/firmware/updates ]; then
-      rm -f /lib/firmware/updates
-    fi
 
-    # convert /usr/local symlink to a mount point
+	# Create NetworkManager configuration if we do not have it
-    if [ -L /usr/local ]; then
+	if ! [ -e /etc/NetworkManager/NetworkManager.conf ]; then
-        rm -f /usr/local
+	echo '[main]' > /etc/NetworkManager/NetworkManager.conf
-        mkdir /usr/local
+	echo 'plugins = keyfile' >> /etc/NetworkManager/NetworkManager.conf
-        mount /usr/local || :
+	echo '[keyfile]' >> /etc/NetworkManager/NetworkManager.conf
-    fi
+	fi
+	/usr/lib/qubes/qubes-fix-nm-conf.sh
 
-    # Fix fstab update to core-agent-linux 4.0.33
+	# Remove ip_forward setting from sysctl, so NM will not reset it
-    grep -F -q "/rw/usrlocal" /etc/fstab || sed "/\/rw\/home/a\/rw\/usrlocal    \/usr\/local  none    noauto,bind,defaults 0 0" -i /etc/fstab
+	# Archlinux now use sysctl.d/ instead of sysctl.conf
+	#sed 's/^net.ipv4.ip_forward.*/#\0/'  -i /etc/sysctl.conf
 
-    #/usr/lib/qubes/update-proxy-configs
+	# Remove old firmware updates link
-    # Archlinux pacman configuration is handled in update_finalize
+	if [ -L /lib/firmware/updates ]; then
+	  rm -f /lib/firmware/updates
+	fi
 
-    if ! [ -r /etc/dconf/profile/user ]; then
+	# Yum proxy configuration is fedora specific
-        mkdir -p /etc/dconf/profile
+	#if ! grep -q '/etc/yum\.conf\.d/qubes-proxy\.conf' /etc/yum.conf; then
-        echo "user-db:user" >> /etc/dconf/profile/user
+	#  echo >> /etc/yum.conf
-        echo "system-db:local" >> /etc/dconf/profile/user
+	#  echo '# Yum does not support inclusion of config dir...' >> /etc/yum.conf
-    fi
+	#  echo 'include=file:///etc/yum.conf.d/qubes-proxy.conf' >> /etc/yum.conf
+	#fi
 
-    dconf update &> /dev/null || :
+	# Location of files which contains list of protected files
+	mkdir -p /etc/qubes/protected-files.d
+	PROTECTED_FILE_LIST='/etc/qubes/protected-files.d'
 
-    # Location of files which contains list of protected files
+	# qubes-core-vm has been broken for some time - it overrides /etc/hosts; restore original content
-    mkdir -p /etc/qubes/protected-files.d
+	if ! grep -rq "^/etc/hosts$" "${PROTECTED_FILE_LIST}" 2>/dev/null; then
-    # shellcheck source=init/functions
+	    if ! grep -q localhost /etc/hosts; then
-    . /usr/lib/qubes/init/functions
+	      cat <<EOF > /etc/hosts
-
+	127.0.0.1   localhost localhost.localdomain localhost4 localhost4.localdomain4 `hostname`
-    # qubes-core-vm has been broken for some time - it overrides /etc/hosts; restore original content
+	::1         localhost localhost.localdomain localhost6 localhost6.localdomain6
-    if ! is_protected_file /etc/hosts ; then
-        if ! grep -q localhost /etc/hosts; then
-
-          cat <<EOF > /etc/hosts
-127.0.0.1   localhost localhost.localdomain localhost4 localhost4.localdomain4 $(hostname)
-::1         localhost localhost.localdomain localhost6 localhost6.localdomain6
 EOF
+	    fi
+	fi
 
-        fi
+	# ensure that hostname resolves to 127.0.0.1 resp. ::1 and that /etc/hosts is
-    fi
+	# in the form expected by qubes-sysinit.sh
+	if ! grep -rq "^/etc/hostname$" "${PROTECTED_FILE_LIST}" 2>/dev/null; then
+	    for ip in '127\.0\.0\.1' '::1'; do
+	        if grep -q "^${ip}\(\s\|$\)" /etc/hosts; then
+	            sed -i "/^${ip}\s/,+0s/\(\s`hostname`\)\+\(\s\|$\)/\2/g" /etc/hosts
+	            sed -i "s/^${ip}\(\s\|$\).*$/\0 `hostname`/" /etc/hosts
+	        else
+	            echo "${ip} `hostname`" >> /etc/hosts
+	        fi
+	    done
+	fi
 
-    # ensure that hostname resolves to 127.0.0.1 resp. ::1 and that /etc/hosts is
+	# Make sure there is a default locale set so gnome-terminal will start
-    # in the form expected by qubes-sysinit.sh
+	if [ ! -e /etc/locale.conf ] || ! grep -q LANG /etc/locale.conf; then
-    if ! is_protected_file /etc/hostname ; then
+	    touch /etc/locale.conf
-        for ip in '127\.0\.0\.1' '::1'; do
+	    echo "LANG=en_US.UTF-8" >> /etc/locale.conf
-            if grep -q "^${ip}\(\s\|$\)" /etc/hosts; then
+	fi
-                sed -i "/^${ip}\s/,+0s/\(\s$(hostname)\)\+\(\s\|$\)/\2/g" /etc/hosts
+	# ... and make sure it is really generated
-                sed -i "s/^${ip}\(\s\|$\).*$/\0 $(hostname)/" /etc/hosts
+	# This line is buggy as LANG can be set to LANG="en_US.UTF-8". The Quotes must be stripped
-            else
+	current_locale=`grep LANG /etc/locale.conf|cut -f 2 -d = | tr -d '"'`
-                echo "${ip} $(hostname)" >> /etc/hosts
+	if [ -n "$current_locale" ] && ! locale -a | grep -q "$current_locale"; then
-            fi
+	    base=`echo "$current_locale" | cut -f 1 -d .`
-        done
+	    charmap=`echo "$current_locale.UTF-8" | cut -f 2 -d .`
-    fi
+	    [ -n "$charmap" ] && charmap="-f $charmap"
+	    localedef -i $base $charmap $current_locale
+	fi
 
 }
 
-############################
-## Service Management Functions ##
-############################
-is_static() {
-    [ -f "/usr/lib/systemd/system/$1" ] && ! grep -q '^[[].nstall]' "/usr/lib/systemd/system/$1"
-}
-
-is_masked() {
-    if [ ! -L /etc/systemd/system/"$1" ]
-    then
-        return 1
-    fi
-    target=$(readlink /etc/systemd/system/"$1" 2>/dev/null) || :
-    if [ "$target" = "/dev/null" ]
-    then
-        return 0
-    fi
-    return 1
-}
-
-mask() {
-    ln -sf /dev/null /etc/systemd/system/"$1"
-}
-
-unmask() {
-    if ! is_masked "$1"
-    then
-        return 0
-    fi
-    rm -f /etc/systemd/system/"$1"
-}
-
-preset_units() {
-    local represet=
-    while read -r action unit_name
-    do
-        if [ "$action" = "#" ] && [ "$unit_name" = "Units below this line will be re-preset on package upgrade" ]
-        then
-            represet=1
-            continue
-        fi
-        echo "$action $unit_name" | grep -q '^[[:space:]]*[^#;]' || continue
-        [[ -n "$action" && -n "$unit_name" ]] || continue
-        if [ "$2" = "initial" ] || [ "$represet" = "1" ]
-        then
-            if [ "$action" = "disable" ] && is_static "$unit_name"
-            then
-                if ! is_masked "$unit_name"
-                then
-                    # We must effectively mask these units, even if they are static.
-                    mask "$unit_name"
-                fi
-            elif [ "$action" = "enable" ] && is_static "$unit_name"
-            then
-                if is_masked "$unit_name"
-                then
-                    # We masked this static unit before, now we unmask it.
-                    unmask "$unit_name"
-                fi
-                systemctl --no-reload preset "$unit_name" >/dev/null 2>&1 || :
-            else
-                systemctl --no-reload preset "$unit_name" >/dev/null 2>&1 || :
-            fi
-        fi
-    done < "$1"
-}
-
-restore_units() {
-    grep '^[[:space:]]*[^#;]' "$1" | while read -r action unit_name
-    do
-        if is_static "$unit_name" && is_masked "$unit_name"
-        then
-            # If the unit had been masked by us, we must unmask it here.
-            # Otherwise systemctl preset will fail badly.
-            unmask "$unit_name"
-        fi
-        systemctl --no-reload preset "$unit_name" >/dev/null 2>&1 || :
-    done
-}
-
 configure_systemd() {
-    if [ "$1" -eq 1 ]
+
-    then
+PRESET_FAILED=0
-        preset_units /usr/lib/systemd/system-preset/$qubes_preset_file initial
+
-        changed=true
+if [ $1 -eq 1 ]; then
-    else
+    # Needs to be started two times to deal  with services name changes (systemctl bug?)
-        preset_units /usr/lib/systemd/system-preset/$qubes_preset_file upgrade
+    echo "Resetting systemd services to defaults presets (PASS 1)"
-        changed=true
+    systemctl --no-reload preset-all 2>&1 && PRESET_FAILED=0 || PRESET_FAILED=1
-        # Upgrade path - now qubes-iptables is used instead
+    echo "Resetting systemd services to defaults presets (PASS 2)"
-        for svc in iptables ip6tables
+    systemctl --no-reload preset-all 2>&1 && PRESET_FAILED=0 || PRESET_FAILED=1
-        do
+else
-            if [ -f "$svc".service ]
+    services="qubes-dvm qubes-misc-post qubes-firewall qubes-mount-dirs"
-            then
+    services="$services qubes-netwatcher qubes-network qubes-sysinit"
-                systemctl --no-reload preset "$svc".service
+    services="$services qubes-iptables qubes-updates-proxy qubes-qrexec-agent"
-                changed=true
+    services="$services qubes-random-seed"
+    for srv in $services; do
+        echo "Enable service defaults for $service"
+        systemctl --no-reload preset $srv.service
+    done
+    systemctl --no-reload preset qubes-update-check.timer
+    # Upgrade path - now qubes-iptables is used instead
+    systemctl --no-reload preset iptables.service
+    systemctl --no-reload preset ip6tables.service
+fi
+
+# Set default "runlevel"
+rm -f /etc/systemd/system/default.target
+ln -s /lib/systemd/system/multi-user.target /etc/systemd/system/default.target
+
+grep '^[[:space:]]*[^#;]' /lib/systemd/system-preset/75-qubes-vm.preset | while read action unit_name; do
+    case "$action" in
+    (disable)
+        if [ -f /lib/systemd/system/$unit_name ]; then
+            if ! fgrep -q '[Install]' /lib/systemd/system/$unit_name; then
+                # forcibly disable
+                ln -sf /dev/null /etc/systemd/system/$unit_name
             fi
-        done
+        fi
-    fi
+        ;;
+    *)
+        # preset-all is not available in fc20; so preset each unit file listed in 75-qubes-vm.preset
+        if [ $1 -eq 1 -a "${PRESET_FAILED}" -eq 1 ]; then
+            systemctl --no-reload preset "${unit_name}" > /dev/null 2>&1 || true
+        fi
+        ;;
+    esac
+done
 
-    if [ "$1" -eq 1 ]
+systemctl daemon-reload
-    then
-        # First install.
-        # Set default "runlevel".
-        # FIXME: this ought to be done via kernel command line.
-        # The fewer deviations of the template from the seed
-        # image, the better.
-        rm -f /etc/systemd/system/default.target
-        ln -s /lib/systemd/system/multi-user.target /etc/systemd/system/default.target
-        changed=true
-    fi
 
-    # remove old symlinks
-    if [ -L /etc/systemd/system/sysinit.target.wants/qubes-random-seed.service ]
-    then
-        rm -f /etc/systemd/system/sysinit.target.wants/qubes-random-seed.service
-        changed=true
-    fi
-    if [ -L /etc/systemd/system/multi-user.target.wants/qubes-mount-home.service ]
-    then
-        rm -f /etc/systemd/system/multi-user.target.wants/qubes-mount-home.service
-        changed=true
-    fi
-
-    if [ "x$changed" != "x" ]
-    then
-        systemctl daemon-reload
-    fi
 }
 
-######################
-## Archlinux Specific Functions ##
-######################
 config_prependtomark() {
-    FILE=$1
+FILE=$1
-    APPENDBEFORELINE=$2
+APPENDBEFORELINE=$2
-    APPENDLINE=$3
+APPENDLINE=$3
-    grep -F -q "$APPENDLINE" "$FILE" || sed "/$APPENDBEFORELINE/i$APPENDLINE" -i "$FILE"
+grep -F -q "$APPENDLINE" "$FILE" || sed "/$APPENDBEFORELINE/i$APPENDLINE" -i "$FILE"
 }
 
 config_appendtomark() {
-    FILE=$1
+FILE=$1
-    APPENDAFTERLINE=$2
+APPENDAFTERLINE=$2
-    APPENDLINE=$3
+APPENDLINE=$3
-    grep -F -q "$APPENDLINE" "$FILE" || sed "/$APPENDAFTERLINE/a$APPENDLINE" -i "$FILE"
+grep -F -q "$APPENDLINE" "$FILE" || sed "/$APPENDAFTERLINE/a$APPENDLINE" -i "$FILE"
 }
 
 config_cleanupmark() {
-    FILE="$1"
+FILE="$1"
-    BEGINMARK="$2"
+BEGINMARK="$2"
-    ENDMARK="$3"
+ENDMARK="$3"
-    if grep -F -q "$BEGINMARK" "$FILE"; then
+if grep -F -q "$BEGINMARK" "$FILE"; then
-        if grep -F -q "$ENDMARK" "$FILE"; then
+	if grep -F -q "$ENDMARK" "$FILE"; then
-            cp "$FILE" "$FILE.qubes-update-orig"
+		cp "$FILE" "$FILE.qubes-update-orig"
-            sed -i -e "/^$BEGINMARK$/,/^$ENDMARK$/{
+		sed -i -e "/^$BEGINMARK$/,/^$ENDMARK$/{
-                /^$ENDMARK$/b
+			/^$ENDMARK$/b
-                /^$BEGINMARK$/!d
+			/^$BEGINMARK$/!d
-                }" "$FILE"
+			}" "$FILE"
-            rm -f "$FILE.qubes-update-orig"
+		rm -f "$FILE.qubes-update-orig"
-        else
+	else
-            echo "ERROR: found $BEGINMARK marker but not $ENDMARK in $FILE. Please cleanup this file manually."
+		echo "ERROR: found $BEGINMARK marker but not $ENDMARK in $FILE. Please cleanup this file manually."
-        fi
+	fi
-    elif grep -F -q "$ENDMARK" "$FILE"; then
+elif grep -F -q "$ENDMARK" "$FILE"; then
-        echo "ERROR: found $ENDMARK marker but not $BEGINMARK in $FILE. Please cleanup this file manually."
+	echo "ERROR: found $ENDMARK marker but not $BEGINMARK in $FILE. Please cleanup this file manually."
-    fi
+fi
 }
 
 update_finalize() {
-    # Archlinux specific: If marker exists, cleanup text between begin and end marker
-    QUBES_MARKER="### QUBES CONFIG MARKER ###"
-    if grep -F -q "$QUBES_MARKER" /etc/pacman.conf; then
-        config_prependtomark "/etc/pacman.conf" "# REPOSITORIES" "### QUBES CONFIG END MARKER ###"
-        config_cleanupmark "/etc/pacman.conf" "$QUBES_MARKER" "### QUBES CONFIG END MARKER ###"
-    # Else, add qubes config block marker
-    else
-        config_prependtomark "/etc/pacman.conf" "# REPOSITORIES" "$QUBES_MARKER"
-        config_prependtomark "/etc/pacman.conf" "# REPOSITORIES" "### QUBES CONFIG END MARKER ###"
-    fi
 
-    # Include /etc/pacman.d drop-in directory
+	# Archlinux specific: Cleanup pre pacman.d qubes marker
-    config_appendtomark "/etc/pacman.conf" "$QUBES_MARKER" "Include = /etc/pacman.d/*.conf"
+	QUBES_MARKER="### QUBES CONFIG MARKER ###"
+	if grep -F -q "$QUBES_MARKER" /etc/pacman.conf; then
+		config_prependtomark "/etc/pacman.conf" "# REPOSITORIES" "### QUBES CONFIG END MARKER ###"
+		config_cleanupmark "/etc/pacman.conf" "$QUBES_MARKER" "### QUBES CONFIG END MARKER ###"
+	fi
 
-    /usr/lib/qubes/update-proxy-configs
+	# Include /etc/pacman.d drop-in directory
+	config_appendtomark "/etc/pacman.conf" "$QUBES_MARKER" "Include = /etc/pacman.d/*.conf"
 
-    # Archlinux specific: Update pam.d configuration for su to enable systemd-login wrapper
+	# Archlinux specific: Update pam.d configuration for su to enable systemd-login wrapper
-    # This is required as qubes-gui agent calls xinit with su -l user without initializing properly
+	# Also remove pam_unix.so from su configuration
-    # the user session.
+	# as system-login (which include system-auth) already gives pam_unix.so
-    # pam_unix.so can also be removed from su configuration
+	# with more appropriate parameters (fix the missing nullok parameter)
-    # as system-login (which include system-auth) already gives pam_unix.so
-    # with more appropriate parameters (fix the missing nullok parameter)
-    if grep -q pam_unix.so /etc/pam.d/su; then
-        echo "Fixing pam.d"
-	cp /etc/pam.d/qrexec /etc/pam.d/su-l
-    fi
 
-    # Archlinux specific: ensure tty1 is enabled
+	if [ -n "`cat /etc/pam.d/su | grep pam_unix.so`" ] ; then
-    rm -f /etc/systemd/system/getty.target.wants/getty@tty*.service
+		echo "Fixing pam.d"
-    systemctl enable getty\@tty1.service
+		cat <<EOF > /etc/pam.d/su
+#%PAM-1.0
+auth		sufficient	pam_rootok.so
+# Uncomment the following line to implicitly trust users in the "wheel" group.
+#auth		sufficient	pam_wheel.so trust use_uid
+# Uncomment the following line to require a user to be in the "wheel" group.
+#auth		required	pam_wheel.so use_uid
+auth		include		system-login
+account		include         system-login
+session		include		system-login
+EOF
+		cp /etc/pam.d/su /etc/pam.d/su-l
+	fi
 
-    systemctl daemon-reload
+	# Archlinux specific: ensure tty1 is enabled
+	rm -f /etc/systemd/system/getty.target.wants/getty@tty*.service
+	systemctl enable getty\@tty1.service
+
+	systemctl daemon-reload
 }
 
 ## arg 1:  the new package version
 post_install() {
-    update_qubesconfig
 
-    # do the rest of %post thing only when updating for the first time...
+	update_qubesconfig
-    if [ -e /etc/init/serial.conf ] && ! [ -f /var/lib/qubes/serial.orig ] ; then
-        cp /etc/init/serial.conf /var/lib/qubes/serial.orig
-    fi
 
-    chgrp user /var/lib/qubes/dom0-updates
+	# do the rest of %post thing only when updating for the first time...
+	if [ -e /etc/init/serial.conf ] && ! [ -f /var/lib/qubes/serial.orig ] ; then
+		cp /etc/init/serial.conf /var/lib/qubes/serial.orig
+	fi
 
-    # Remove most of the udev scripts to speed up the VM boot time
+	# Remove most of the udev scripts to speed up the VM boot time
-    # Just leave the xen* scripts, that are needed if this VM was
+	# Just leave the xen* scripts, that are needed if this VM was
-    # ever used as a net backend (e.g. as a VPN domain in the future)
+	# ever used as a net backend (e.g. as a VPN domain in the future)
-    #echo "--> Removing unnecessary udev scripts..."
+	#echo "--> Removing unnecessary udev scripts..."
-    mkdir -p /var/lib/qubes/removed-udev-scripts
+	mkdir -p /var/lib/qubes/removed-udev-scripts
-    for f in /etc/udev/rules.d/*
+	for f in /etc/udev/rules.d/*
-    do
+	do
-        if [ "$(basename "$f")" == "xen-backend.rules" ] ; then
+	    if [ $(basename $f) == "xen-backend.rules" ] ; then
-            continue
+	        continue
-        fi
+	    fi
 
-        if [ "$(basename "$f")" == "50-qubes-misc.rules" ] ; then
+	    if [ $(basename $f) == "50-qubes-misc.rules" ] ; then
-            continue
+	        continue
-        fi
+	    fi
 
-        if echo "$f" | grep -q qubes; then
+	    if echo $f | grep -q qubes; then
-            continue
+	        continue
-        fi
+	    fi
 
-        mv "$f" /var/lib/qubes/removed-udev-scripts/
+	    mv $f /var/lib/qubes/removed-udev-scripts/
-    done
+	done
 
-    mkdir -p /rw
+	mkdir -p /rw
 
-    configure_notification-daemon
+	configure_notification-daemon
-    configure_selinux
+	configure_selinux
 
-    configure_systemd 0
+	configure_systemd 0
+
+	update_finalize
 	
-    update_finalize
 }
 
 ## arg 1:  the new package version
 ## arg 2:  the old package version
 post_upgrade() {
-    update_qubesconfig
 
-    configure_notification-daemon
+	update_qubesconfig
-    configure_selinux
 
-    configure_systemd 1
+	configure_notification-daemon
+	configure_selinux
 
+	configure_systemd 1
+
+	update_finalize
 
-    update_finalize
 }
 
 ######################
@@ -396,6 +336,7 @@ post_upgrade() {
 
 ## arg 1:  the old package version
 pre_remove() {
+
     # no more packages left
     if [ -e /var/lib/qubes/fstab.orig ] ; then
     mv /var/lib/qubes/fstab.orig /etc/fstab
@@ -405,34 +346,10 @@ pre_remove() {
     mv /var/lib/qubes/serial.orig /etc/init/serial.conf
     fi
 
-    if [ "$1" -eq 0 ] ; then
-        # Run this only during uninstall.
-        # Save the preset file to later use it to re-preset services there
-        # once the Qubes OS preset file is removed.
-        mkdir -p /run/qubes-uninstall
-        cp -f /usr/lib/systemd/system-preset/$qubes_preset_file /run/qubes-uninstall/
-        cp -f /usr/lib/systemd/system-preset/$qubes_preset_file /run/qubes-uninstall/
-    fi
 }
 
 ## arg 1:  the old package version
 post_remove() {
-    changed=
-
-    if [ -d /run/qubes-uninstall ]
-    then
-        # We have a saved preset file (or more).
-        # Re-preset the units mentioned there.
-        restore_units /run/qubes-uninstall/$qubes_preset_file
-        rm -rf /run/qubes-uninstall
-        changed=true
-    fi
-
-    if [ "x$changed" != "x" ]
-    then
-        systemctl daemon-reload
-    fi
-
 
     if [ -L /lib/firmware/updates ] ; then
       rm /lib/firmware/updates
@@ -440,7 +357,8 @@ post_remove() {
 
     rm -rf /var/lib/qubes/xdg
 
-    for srv in qubes-sysinit qubes-misc-post qubes-mount-dirs qubes-qrexec-agent; do
+    for srv in qubes-dvm qubes-sysinit qubes-misc-post qubes-mount-dirs qubes-netwatcher qubes-network qubes-qrexec-agent; do
         systemctl disable $srv.service
     done
+    
 }

archlinux/PKGBUILD.qubes-update-desktop-icons.hook

@@ -6,6 +6,6 @@ Operation = Remove
 Target = usr/share/applications/*.desktop
 
 [Action]
-Description = Updating the Qubes desktop file App Icons and features...
+Description = Updating the Qubes desktop file App Icons...
 When = PostTransaction
-Exec = /etc/qubes-rpc/qubes.PostInstall
+Exec = /usr/lib/qubes/qubes-trigger-sync-appmenus.sh

autostart-dropins/org.gnome.SettingsDaemon.XSettings.desktop

@@ -1,2 +0,0 @@
-[Desktop Entry]
-OnlyShowIn=GNOME;X-QUBES

ci/requirements.txt

@@ -1,6 +0,0 @@
-# WARNING: those requirements are used only for travis-ci.org
-# they SHOULD NOT be used under normal conditions; use system package manager
-docutils
-pylint
-codecov
-python-daemon

debian-quilt

@@ -22,7 +22,7 @@ fi
 rm -f "${PATCH_DIR}/series"
 touch "${PATCH_DIR}/series"
 
-while read -r patch_file
+while read patch_file
 do
     if [ -e "${DIR}/${patch_file}" ]; then
         echo -e "${patch_file##*/}" >> "${PATCH_DIR}/series"

debian/control

@@ -1,52 +1,49 @@
 Source: qubes-core-agent
 Section: admin
 Priority: extra
-Maintainer: unman <unman@thirdeyesecurity.org>
+Maintainer: Davíð Steinn Geirsson <david@dsg.is>
 Build-Depends:
-    libpam0g-dev,
     libqrexec-utils-dev,
     libqubes-rpc-filecopy-dev (>= 3.1.3),
     libvchan-xen-dev,
     python,
-    python-setuptools,
     debhelper,
     quilt,
     libxen-dev,
     pkg-config,
     dh-systemd (>= 1.5),
-    dh-python,
     lsb-release,
     xserver-xorg-dev,
-    config-package-dev,
+    config-package-dev
-    pandoc,
 Standards-Version: 3.9.5
-Homepage: https://www.qubes-os.org
+Homepage: http://www.qubes-os.org
-Vcs-Git: https://github.com/QubesOS/qubes-core-agent-linux
+Vcs-Git: git://git.qubes-os.org/marmarek/core-agent-linux.git
 
 Package: qubes-core-agent
 Architecture: any
 Depends:
-    dconf-cli,
     dmsetup,
+    ethtool,
+    fakeroot,
     gawk,
     imagemagick,
     init-system-helpers,
     initscripts,
+    iptables,
     librsvg2-bin,
+    libvchan-xen,
     locales,
+    locales-all,
     ncurses-term,
+    net-tools,
     psmisc,
-    procps,
-    util-linux,
     python2.7,
-    python-daemon,
-    python-qubesdb,
     python-gi,
     python-xdg,
     python-dbus,
+    python-gtk2,
     qubes-utils (>= 3.1.3),
-    qubes-core-agent-qrexec,
+    sudo,
-    qubesdb-vm,
     systemd,
     x11-xserver-utils,
     xdg-user-dirs,
@@ -55,121 +52,28 @@ Depends:
     xenstore-utils,
     xinit,
     xserver-xorg-core,
-    ${python:Depends},
+    xserver-xorg-video-dummy,
     ${shlibs:Depends},
     ${misc:Depends}
 Recommends:
     cups,
+    gnome-packagekit,
     gnome-terminal,
     gnome-themes-standard,
     haveged,
     libnotify-bin,
-    locales-all,
     mate-notification-daemon,
+    network-manager (>= 0.8.1-1),
+    network-manager-gnome,
     ntpdate,
+    python-nautilus,
     system-config-printer,
-    qubes-core-agent-nautilus,
+    tinyproxy,
-    qubes-core-agent-networking,
+    xsettingsd,
-    qubes-core-agent-network-manager,
+    yum,
-    xsettingsd
+    yum-utils
-Conflicts: qubes-core-agent-linux, firewalld, qubes-core-vm-sysvinit
+Provides: ${diverted-files}
+Conflicts: ${diverted-files}, qubes-core-agent-linux, firewalld, qubes-core-vm-sysvinit
 Description: Qubes core agent
  This package includes various daemons necessary for qubes domU support,
  such as qrexec.
-
-Package: qubes-core-agent-qrexec
-Architecture: any
-Depends:
-    libvchan-xen,
-    ${shlibs:Depends},
-    ${misc:Depends}
-Replaces: qubes-core-agent (<< 4.0.0-1)
-Breaks: qubes-core-agent (<< 4.0.0-1)
-Description: Qubes qrexec agent
- Agent part of Qubes RPC system. A daemon responsible for starting processes as
- requested by dom0 or other VMs, according to dom0-enforced policy.
-
-Package: qubes-core-agent-nautilus
-Architecture: any
-Depends:
-    python-nautilus,
-    qubes-core-agent-qrexec,
-Replaces: qubes-core-agent (<< 4.0.0-1)
-Breaks: qubes-core-agent (<< 4.0.0-1)
-Description: Qubes integration for Nautilus
- Nautilus addons for inter-VM file copy/move/open.
-
-Package: qubes-core-agent-thunar
-Architecture: any
-Depends:
-    thunar,
-    qubes-core-agent-qrexec,
-Replaces: qubes-core-agent (<< 4.0.0-1)
-Breaks: qubes-core-agent (<< 4.0.0-1)
-Description: Qubes integration for Thunar
- Thunar addons for inter-VM file copy/move/open.
-
-Package: qubes-core-agent-dom0-updates
-Architecture: any
-Depends:
-    fakeroot,
-    yum,
-    yum-utils,
-    qubes-core-agent-qrexec,
-Replaces: qubes-core-agent (<< 4.0.0-1)
-Breaks: qubes-core-agent (<< 4.0.0-1)
-Description: Scripts required to handle dom0 updates.
-  Scripts required to handle dom0 updates. This will allow to use the VM as
-  "Updates VM".
-
-Package: qubes-core-agent-networking
-Architecture: any
-Depends:
-    qubes-core-agent,
-    tinyproxy,
-    iptables,
-    net-tools,
-    ethtool,
-    socat,
-    tinyproxy,
-    ${python:Depends},
-    ${misc:Depends}
-Suggests:
-    nftables,
-Replaces: qubes-core-agent (<< 4.0.0-1)
-Breaks: qubes-core-agent (<< 4.0.0-1)
-Description: Networking support for Qubes VM
- This package provides:
-  * basic network functionality (setting IP address, DNS, default gateway)
-  * proxy service used by TemplateVMs to download updates
-  * qubes-firewall service (FirewallVM)
- .
- Note: if you want to use NetworkManager (you do want it in NetVM), install
- also qubes-core-agent-network-manager.
-
-Package: qubes-core-agent-network-manager
-Architecture: any
-Depends:
-    qubes-core-agent-networking,
-    libglib2.0-bin,
-    network-manager (>= 0.8.1-1),
-    network-manager-gnome,
-Replaces: qubes-core-agent (<< 4.0.0-1)
-Breaks: qubes-core-agent (<< 4.0.0-1)
-Description: NetworkManager integration for Qubes VM
- Integration of NetworkManager for Qubes VM:
-  * make connections config persistent
-  * adjust DNS redirections when needed
-  * show/hide NetworkManager applet icon
-
-Package: qubes-core-agent-passwordless-root
-Architecture: any
-Replaces: qubes-core-agent (<< 4.0.0-1)
-Breaks: qubes-core-agent (<< 4.0.0-1)
-Provides: ${diverted-files}
-Conflicts: ${diverted-files}
-Description: Passwordless root access from normal user
- Configure sudo, PolicyKit and similar tool to not ask for any password when
- switching from user to root. Since all the user data in a VM is accessible
- already from normal user account, there is not much more to guard there. Qubes
- VM is a single user system.

debian/qubes-core-agent-dom0-updates.install

@@ -1 +0,0 @@
-usr/lib/qubes/qubes-download-dom0-updates.sh

debian/qubes-core-agent-nautilus.install

@@ -1 +0,0 @@
-usr/share/nautilus-python/extensions/*

debian/qubes-core-agent-network-manager.install

@@ -1,7 +0,0 @@
-etc/NetworkManager/dispatcher.d/30-qubes-external-ip
-etc/NetworkManager/dispatcher.d/qubes-nmhook
-etc/xdg/autostart/00-qubes-show-hide-nm-applet.desktop
-usr/lib/NetworkManager/conf.d/30-qubes.conf
-usr/lib/qubes/network-manager-prepare-conf-dir
-usr/lib/qubes/qubes-fix-nm-conf.sh
-usr/lib/qubes/show-hide-nm-applet.sh

debian/qubes-core-agent-network-manager.postinst

@@ -1,56 +0,0 @@
-#!/bin/bash
-# postinst script for core-agent-linux
-#
-# see: dh_installdeb(1)
-
-set -e
-
-# The postinst script may be called in the following ways:
-#   * <postinst> 'configure' <most-recently-configured-version>
-#   * <old-postinst> 'abort-upgrade' <new version>
-#   * <conflictor's-postinst> 'abort-remove' 'in-favour' <package>
-#     <new-version>
-#   * <postinst> 'abort-remove'
-#   * <deconfigured's-postinst> 'abort-deconfigure' 'in-favour'
-#     <failed-install-package> <version> 'removing'
-#     <conflicting-package> <version>
-#
-#    For details, see http://www.debian.org/doc/debian-policy/ or
-# https://www.debian.org/doc/debian-policy/ch-maintainerscripts.html or
-# the debian-policy package
-
-
-case "${1}" in
-    configure)
-        # Initial installation of package only
-        # ($2 contains version number on update; nothing on initial installation)
-        if [ -z "${2}" ]; then
-
-            # Create NetworkManager configuration if we do not have it
-            if ! [ -e /etc/NetworkManager/NetworkManager.conf ]; then
-                echo '[main]' > /etc/NetworkManager/NetworkManager.conf
-                echo 'plugins = keyfile' >> /etc/NetworkManager/NetworkManager.conf
-                echo '[keyfile]' >> /etc/NetworkManager/NetworkManager.conf
-            fi
-            /usr/lib/qubes/qubes-fix-nm-conf.sh
-        fi
-        ;;
-
-    abort-upgrade|abort-remove|abort-deconfigure)
-        exit 0
-        ;;
-
-    *)
-        echo "postinst called with unknown argument \`${1}'" >&2
-        exit 1
-        ;;
-esac
-
-# dh_installdeb will replace this with shell code automatically
-# generated by other debhelper scripts.
-
-#DEBHELPER#
-
-exit 0
-
-# vim: set ts=4 sw=4 sts=4 et :

debian/qubes-core-agent-networking.install

@@ -1,21 +0,0 @@
-etc/dhclient.d/qubes-setup-dnat-to-ns.sh
-etc/qubes-rpc/qubes.UpdatesProxy
-etc/qubes/ip6tables.rules
-etc/qubes/ip6tables-enabled.rules
-etc/qubes/iptables.rules
-etc/tinyproxy/tinyproxy-updates.conf
-etc/tinyproxy/updates-blacklist
-etc/udev/rules.d/99-qubes-network.rules
-etc/xen/scripts/vif-qubes-nat.sh
-etc/xen/scripts/vif-route-qubes
-lib/systemd/system/qubes-firewall.service
-lib/systemd/system/qubes-iptables.service
-lib/systemd/system/qubes-network.service
-lib/systemd/system/qubes-updates-proxy.service
-usr/lib/qubes/init/network-proxy-setup.sh
-usr/lib/qubes/init/qubes-iptables
-usr/lib/qubes/iptables-updates-proxy
-usr/lib/qubes/qubes-setup-dnat-to-ns
-usr/lib/qubes/setup-ip
-usr/lib/tmpfiles.d/qubes-core-agent-linux.conf
-usr/sbin/qubes-firewall

debian/qubes-core-agent-passwordless-root.install

@@ -1,4 +0,0 @@
-etc/polkit-1/localauthority/50-local.d/qubes-allow-all.pkla
-etc/polkit-1/rules.d/00-qubes-allow-all.rules
-etc/pam.d/su.qubes
-etc/sudoers.d/qubes

debian/qubes-core-agent-passwordless-root.postrm

@@ -1,54 +0,0 @@
-#!/bin/sh
-# postrm script for core-agent-linux
-#
-# see: dh_installdeb(1)
-
-set -e
-
-# The prerm script may be called in the following ways:
-#   * <postrm> 'remove'
-#   * <postrm> 'purge'
-#   * <old-postrm> 'upgrade' <new-version>
-#   * <disappearer's-postrm> 'disappear' <overwriter> <overwriter-version>
-#
-#     The postrm script is called after the package's files have been removed
-# or replaced. The package whose postrm is being called may have previously been
-# deconfigured and only be "Unpacked", at which point subsequent package changes
-# do not consider its dependencies. Therefore, all postrm actions may only rely
-# on essential packages and must gracefully skip any actions that require the
-# package's dependencies if those dependencies are unavailable.[48]
-#
-#   * <new-postrm> 'failed-upgrade' <old-version>
-#
-#     Called when the old postrm upgrade action fails. The new package will be
-# unpacked, but only essential packages and pre-dependencies can be relied on.
-# Pre-dependencies will either be configured or will be "Unpacked" or
-# "Half-Configured" but previously had been configured and was never removed.
-#
-#   * <new-postrm> 'abort-install'
-#   * <new-postrm> 'abort-install' <old-version>
-#   * <new-postrm> 'abort-upgrade' <old-version>
-#
-#     Called before unpacking the new package as part of the error handling of
-# preinst failures. May assume the same state as preinst can assume.
-#
-#    For details, see http://www.debian.org/doc/debian-policy/ or
-# https://www.debian.org/doc/debian-policy/ch-maintainerscripts.html or
-# the debian-policy package
-
-if [ "${1}" = "remove" ] ; then
-    gpasswd -d user sudo
-    if [ "$(passwd -S root|cut -f 2 -d ' ')" = "NP" ]; then
-        passwd -l root
-    fi
-fi
-
-
-# dh_installdeb will replace this with shell code automatically
-# generated by other debhelper scripts.
-
-#DEBHELPER#
-
-exit 0
-
-# vim: set ts=4 sw=4 sts=4 et :

debian/qubes-core-agent-passwordless-root.preinst

@@ -1,47 +0,0 @@
-#!/bin/sh
-# preinst script for core-agent-linux
-#
-# see: dh_installdeb(1)
-
-set -e
-
-# The preinst script may be called in the following ways:
-#   * <new-preinst> 'install'
-#   * <new-preinst> 'install' <old-version>
-#   * <new-preinst> 'upgrade' <old-version>
-#
-#     The package will not yet be unpacked, so the preinst script cannot rely
-# on any files included in its package. Only essential packages and
-# pre-dependencies (Pre-Depends) may be assumed to be available.
-# Pre-dependencies will have been configured at least once, but at the time the
-# preinst is called they may only be in an "Unpacked" or "Half-Configured" state
-# if a previous version of the pre-dependency was completely configured and has
-# not been removed since then.
-#
-#
-#  * <old-preinst> 'abort-upgrade' <new-version>
-#
-#    Called during error handling of an upgrade that failed after unpacking the
-# new package because the postrm upgrade action failed. The unpacked files may
-# be partly from the new version or partly missing, so the script cannot rely
-# on files included in the package. Package dependencies may not be available.
-# Pre-dependencies will be at least "Unpacked" following the same rules as
-# above, except they may be only "Half-Installed" if an upgrade of the
-# pre-dependency failed.[46]
-#
-#    For details, see http://www.debian.org/doc/debian-policy/ or
-# https://www.debian.org/doc/debian-policy/ch-maintainerscripts.html or
-# the debian-policy package
-
-if [ "$1" = "install" ] ; then
-    usermod -p '' root
-fi
-
-# dh_installdeb will replace this with shell code automatically
-# generated by other debhelper scripts.
-
-#DEBHELPER#
-
-exit 0
-
-# vim: set ts=4 sw=4 sts=4 et :

debian/qubes-core-agent-qrexec.install

@@ -1,10 +0,0 @@
-etc/pam.d/qrexec
-etc/qubes/rpc-config/README
-lib/systemd/system/qubes-qrexec-agent.service
-usr/bin/qrexec-client-vm
-usr/bin/qrexec-fork-server
-usr/lib/qubes/qrexec-agent
-usr/lib/qubes/qrexec-client-vm
-usr/lib/qubes/qrexec_client_vm
-usr/lib/qubes/qubes-rpc-multiplexer
-usr/share/man/man1/qrexec-client-vm.1.gz

debian/qubes-core-agent-thunar.install

@@ -1,3 +0,0 @@
-usr/lib/qubes/qvm-actions.sh
-usr/lib/qubes/uca_qubes.xml
-etc/xdg/xfce4/xfconf/xfce-perchannel-xml/thunar.xml

debian/qubes-core-agent-thunar.postinst

@@ -1,58 +0,0 @@
-#!/bin/bash
-# postinst script for core-agent-linux
-#
-# see: dh_installdeb(1)
-
-set -e
-
-# The postinst script may be called in the following ways:
-#   * <postinst> 'configure' <most-recently-configured-version>
-#   * <old-postinst> 'abort-upgrade' <new version>
-#   * <conflictor's-postinst> 'abort-remove' 'in-favour' <package>
-#     <new-version>
-#   * <postinst> 'abort-remove'
-#   * <deconfigured's-postinst> 'abort-deconfigure' 'in-favour'
-#     <failed-install-package> <version> 'removing'
-#     <conflicting-package> <version>
-#
-#    For details, see http://www.debian.org/doc/debian-policy/ or
-# https://www.debian.org/doc/debian-policy/ch-maintainerscripts.html or
-# the debian-policy package
-
-
-case "${1}" in
-    configure)
-        # There is no system-wide Thunar custom actions. There is only a default
-        # file and a user file created from the default one. Qubes actions need
-        # to be placed after all already defined actions and before </actions>
-        # the end of file.
-        if [ -f /etc/xdg/Thunar/uca.xml ] ; then
-          cp -p /etc/xdg/Thunar/uca.xml /etc/xdg/Thunar/uca.xml.bak
-          #shellcheck disable=SC2016
-          sed -i '$e cat /usr/lib/qubes/uca_qubes.xml' /etc/xdg/Thunar/uca.xml
-        fi
-        if [ -f /home/user/.config/Thunar/uca.xml ] ; then
-          cp -p /home/user/.config/Thunar/uca.xml /home/user/.config/Thunar/uca.xml.bak
-          #shellcheck disable=SC2016
-          sed -i '$e cat /usr/lib/qubes/uca_qubes.xml' /home/user/.config/Thunar/uca.xml
-        fi
-        ;;
-
-    abort-upgrade|abort-remove|abort-deconfigure)
-        exit 0
-        ;;
-
-    *)
-        echo "postinst called with unknown argument \`${1}'" >&2
-        exit 1
-        ;;
-esac
-
-# dh_installdeb will replace this with shell code automatically
-# generated by other debhelper scripts.
-
-#DEBHELPER#
-
-exit 0
-
-# vim: set ts=4 sw=4 sts=4 et :

debian/qubes-core-agent-thunar.postrm

@@ -1,57 +0,0 @@
-#!/bin/sh
-# postrm script for core-agent-linux
-#
-# see: dh_installdeb(1)
-
-set -e
-
-# The prerm script may be called in the following ways:
-#   * <postrm> 'remove'
-#   * <postrm> 'purge'
-#   * <old-postrm> 'upgrade' <new-version>
-#   * <disappearer's-postrm> 'disappear' <overwriter> <overwriter-version>
-#
-#     The postrm script is called after the package's files have been removed
-# or replaced. The package whose postrm is being called may have previously been
-# deconfigured and only be "Unpacked", at which point subsequent package changes
-# do not consider its dependencies. Therefore, all postrm actions may only rely
-# on essential packages and must gracefully skip any actions that require the
-# package's dependencies if those dependencies are unavailable.[48]
-#
-#   * <new-postrm> 'failed-upgrade' <old-version>
-#
-#     Called when the old postrm upgrade action fails. The new package will be
-# unpacked, but only essential packages and pre-dependencies can be relied on.
-# Pre-dependencies will either be configured or will be "Unpacked" or
-# "Half-Configured" but previously had been configured and was never removed.
-#
-#   * <new-postrm> 'abort-install'
-#   * <new-postrm> 'abort-install' <old-version>
-#   * <new-postrm> 'abort-upgrade' <old-version>
-#
-#     Called before unpacking the new package as part of the error handling of
-# preinst failures. May assume the same state as preinst can assume.
-#
-#    For details, see http://www.debian.org/doc/debian-policy/ or
-# https://www.debian.org/doc/debian-policy/ch-maintainerscripts.html or
-# the debian-policy package
-
-if [ "${1}" = "remove" ] ; then
-  if [ -f /etc/xdg/Thunar/uca.xml ] ; then
-    mv /etc/xdg/Thunar/uca.xml /etc/xdg/Thunar/uca.xml.uninstall
-    mv /etc/xdg/Thunar/uca.xml.bak /etc/xdg/Thunar/uca.xml
-  fi
-  if [ -f /home/user/.config/Thunar/uca.xml ] ; then
-    mv /home/user/.config/Thunar/uca.xml /home/user/.config/Thunar/uca.xml.uninstall
-    mv /home/user/.config/Thunar/uca.xml.bak /home/user/.config/Thunar/uca.xml
-  fi
-fi
-
-# dh_installdeb will replace this with shell code automatically
-# generated by other debhelper scripts.
-
-#DEBHELPER#
-
-exit 0
-
-# vim: set ts=4 sw=4 sts=4 et :

debian/qubes-core-agent.dirs

@@ -1,11 +1,4 @@
 etc/qubes/protected-files.d
 etc/systemd/system
-etc/qubes
-etc/qubes/autostart
-etc/qubes/suspend-post.d
-etc/qubes/suspend-pre.d
-usr/lib/qubes-bind-dirs.d
 lib/modules
 var/lib/qubes
-var/lib/qubes/dom0-updates
-rw

debian/qubes-core-agent.displace

@@ -1,4 +1,4 @@
-## This file is part of Qubes OS.
+## This file is part of Whonix.
 ## Copyright (C) 2012 - 2014 Patrick Schleizer <adrelanos@riseup.net>
 ## See the file COPYING for copying conditions.
 

debian/qubes-core-agent.install

@@ -1,147 +0,0 @@
-etc/X11/xorg-preload-apps.conf
-etc/apt/apt.conf.d/00notify-hook
-etc/apt/apt.conf.d/70no-unattended
-etc/apt/sources.list.d/qubes-r4.list
-etc/apt/trusted.gpg.d/qubes-archive-keyring.gpg
-etc/dconf/db/local.d/dpi
-etc/default/grub.d/30-qubes.cfg
-etc/fstab
-etc/needrestart/conf.d/50_qubes.conf
-etc/profile.d/qt_x11_no_mitshm.sh
-etc/qubes-rpc/qubes.Backup
-etc/qubes-rpc/qubes.DetachPciDevice
-etc/qubes-rpc/qubes.Filecopy
-etc/qubes-rpc/qubes.GetAppmenus
-etc/qubes-rpc/qubes.GetImageRGBA
-etc/qubes-rpc/qubes.InstallUpdatesGUI
-etc/qubes-rpc/qubes.OpenInVM
-etc/qubes-rpc/qubes.OpenURL
-etc/qubes-rpc/qubes.PostInstall
-etc/qubes-rpc/qubes.ResizeDisk
-etc/qubes-rpc/qubes.Restore
-etc/qubes-rpc/qubes.SelectDirectory
-etc/qubes-rpc/qubes.SelectFile
-etc/qubes-rpc/qubes.SetDateTime
-etc/qubes-rpc/qubes.StartApp
-etc/qubes-rpc/qubes.SuspendPost
-etc/qubes-rpc/qubes.SuspendPostAll
-etc/qubes-rpc/qubes.SuspendPre
-etc/qubes-rpc/qubes.SuspendPreAll
-etc/qubes-rpc/qubes.VMShell
-etc/qubes-rpc/qubes.VMRootShell
-etc/qubes-rpc/qubes.WaitForSession
-etc/qubes-rpc/qubes.GetDate
-etc/qubes-suspend-module-blacklist
-etc/qubes/autostart/*
-etc/qubes/post-install.d/README
-etc/qubes/post-install.d/*.sh
-etc/qubes/rpc-config/qubes.OpenInVM
-etc/qubes/rpc-config/qubes.OpenURL
-etc/qubes/rpc-config/qubes.SelectFile
-etc/qubes/rpc-config/qubes.SelectDirectory
-etc/qubes/rpc-config/qubes.StartApp
-etc/qubes/rpc-config/qubes.InstallUpdatesGUI
-etc/qubes/rpc-config/qubes.VMShell+WaitForSession
-etc/qubes/suspend-post.d/README
-etc/qubes/suspend-post.d/*.sh
-etc/qubes/suspend-pre.d/README
-etc/sudoers.d/qt_x11_no_mitshm
-etc/sudoers.d/umask
-etc/sysctl.d/20_tcp_timestamps.conf
-etc/sysctl.d/80-qubes.conf
-etc/systemd/system/haveged.service
-etc/udev/rules.d/50-qubes-misc.rules
-lib/modules-load.d/qubes-core.conf
-lib/systemd/system-preset/75-qubes-vm.preset
-lib/systemd/system/ModemManager.service.d/30_qubes.conf
-lib/systemd/system/NetworkManager-wait-online.service.d/30_qubes.conf
-lib/systemd/system/NetworkManager.service.d/30_qubes.conf
-lib/systemd/system/anacron-resume.service.d/30_qubes.conf
-lib/systemd/system/anacron.service.d/30_qubes.conf
-lib/systemd/system/avahi-daemon.service.d/30_qubes.conf
-lib/systemd/system/chronyd.service.d/30_qubes.conf
-lib/systemd/system/cron.service.d/30_qubes.conf
-lib/systemd/system/cups.path.d/30_qubes.conf
-lib/systemd/system/cups.service.d/30_qubes.conf
-lib/systemd/system/cups.socket.d/30_qubes.conf
-lib/systemd/system/cups-browsed.service.d/30_qubes.conf
-lib/systemd/system/exim4.service.d/30_qubes.conf
-lib/systemd/system/getty@tty.service.d/30_qubes.conf
-lib/systemd/system/netfilter-persistent.service.d/30_qubes.conf
-lib/systemd/system/org.cups.cupsd.path.d/30_qubes.conf
-lib/systemd/system/org.cups.cupsd.service.d/30_qubes.conf
-lib/systemd/system/org.cups.cupsd.socket.d/30_qubes.conf
-lib/systemd/system/qubes-early-vm-config.service
-lib/systemd/system/qubes-misc-post.service
-lib/systemd/system/qubes-mount-dirs.service
-lib/systemd/system/qubes-rootfs-resize.service
-lib/systemd/system/qubes-sysinit.service
-lib/systemd/system/qubes-update-check.service
-lib/systemd/system/qubes-update-check.timer
-lib/systemd/system/qubes-updates-proxy-forwarder@.service
-lib/systemd/system/qubes-updates-proxy-forwarder.socket
-lib/systemd/system/qubes-sync-time.service
-lib/systemd/system/qubes-sync-time.timer
-lib/systemd/system/systemd-random-seed.service.d/30_qubes.conf
-lib/systemd/system/tinyproxy.service.d/30_not_needed_in_qubes_by_default.conf
-lib/systemd/system/tmp.mount.d/30_qubes.conf
-lib/systemd/system/tor.service.d/30_qubes.conf
-lib/systemd/system/tor@default.service.d/30_qubes.conf
-lib/systemd/system/systemd-timesyncd.service.d/30_qubes.conf
-usr/bin/qubes-desktop-run
-usr/bin/qubes-open
-usr/bin/qubes-session-autostart
-usr/bin/qubes-run-terminal
-usr/bin/qvm-copy
-usr/bin/qvm-copy-to-vm
-usr/bin/qvm-features-request
-usr/bin/qvm-move
-usr/bin/qvm-move-to-vm
-usr/bin/qvm-open-in-dvm
-usr/bin/qvm-open-in-vm
-usr/bin/qvm-run-vm
-usr/bin/qvm-sync-clock
-usr/bin/xenstore-watch-qubes
-usr/lib/python2.7/dist-packages/qubesagent-*.egg-info/*
-usr/lib/python2.7/dist-packages/qubesagent/*
-usr/lib/qubes-bind-dirs.d/30_cron.conf
-usr/lib/qubes/close-window
-usr/lib/qubes/init/bind-dirs.sh
-usr/lib/qubes/init/control-printer-icon.sh
-usr/lib/qubes/init/functions
-usr/lib/qubes/init/misc-post-stop.sh
-usr/lib/qubes/init/misc-post.sh
-usr/lib/qubes/init/mount-dirs.sh
-usr/lib/qubes/init/qubes-early-vm-config.sh
-usr/lib/qubes/init/qubes-random-seed.sh
-usr/lib/qubes/init/qubes-sysinit.sh
-usr/lib/qubes/init/resize-rootfs-if-needed.sh
-usr/lib/qubes/init/setup-rw.sh
-usr/lib/qubes/init/setup-rwdev.sh
-usr/lib/qubes/prepare-suspend
-usr/lib/qubes/qfile-agent
-usr/lib/qubes/qfile-unpacker
-usr/lib/qubes/qopen-in-vm
-usr/lib/qubes/qubes-sync-clock
-usr/lib/qubes/qrun-in-vm
-usr/lib/qubes/qubes-trigger-sync-appmenus.sh
-usr/lib/qubes/qvm-copy-to-vm.gnome
-usr/lib/qubes/qvm-copy-to-vm.kde
-usr/lib/qubes/qvm-move-to-vm.gnome
-usr/lib/qubes/qvm-move-to-vm.kde
-usr/lib/qubes/resize-rootfs
-usr/lib/qubes/tar2qfile
-usr/lib/qubes/update-proxy-configs
-usr/lib/qubes/upgrades-installed-check
-usr/lib/qubes/upgrades-status-notify
-usr/lib/qubes/vm-file-editor
-usr/lib/qubes/xdg-icon
-usr/lib/systemd/user/pulseaudio.service.d/30_qubes.conf
-usr/lib/systemd/user/pulseaudio.socket.d/30_qubes.conf
-usr/share/glib-2.0/schemas/*
-usr/share/kde4/services/*.desktop
-usr/share/kservices5/ServiceMenus/*.desktop
-usr/share/applications/*.desktop
-usr/share/man/man1/qvm-*
-usr/share/qubes/mime-override/globs
-usr/share/qubes/qubes-master-key.asc

debian/qubes-core-agent.links

@@ -1,3 +0,0 @@
-## compatibility symlink
-## https://github.com/QubesOS/qubes-issues/issues/2191
-/usr/lib/qubes/init/bind-dirs.sh /usr/lib/qubes/bind-dirs.sh

debian/qubes-core-agent.postinst

@@ -22,74 +22,35 @@ set -e
 
 debug() {
     if [ "${DEBDEBUG}" == "1" ]; then
-        echo -e "$@"
+        echo -e ""$@""
     fi
 }
 
-is_static() {
+systemdPreload() {
-    [ -f "/lib/sytemd/system/$1" ] && ! grep -q '^[[].nstall]' "/lib/systemd/system/$1"
+    # Debian systemd helper does not yet honour preset, therefore use
-}
+    # systemctl preset on each unit file (not using preset-all either since
+    # wheezy does not support it) listed in 75-qubes-vm.preset.
 
-is_masked() {
+    systemctl --no-reload preset-all > /dev/null 2>&1 && PRESET_FAILED=0 || PRESET_FAILED=1
-    if [ ! -L /etc/systemd/system/"$1" ]
-    then
-       return 1
-    fi
-    target=$(readlink /etc/systemd/system/"$1" 2>/dev/null || :)
-    if [ "$target" = "/dev/null" ]
-    then
-       return 0
-    fi
-    return 1
-}
 
-mask() {
+    # Mask any static unit files that are marked to be disabled
-    ln -sf /dev/null /etc/systemd/system/"$1"
+    grep '^[[:space:]]*[^#;]' /lib/systemd/system-preset/75-qubes-vm.preset | while read action unit_name; do
-}
+        case "${action}" in
-
+        disable)
-unmask() {
+            if [ -e "/lib/systemd/system/${unit_name}" ]; then
-    if ! is_masked "$1"
+                if ! fgrep -q '[Install]' "/lib/systemd/system/${unit_name}"; then
-    then
-        return 0
-    fi
-    rm -f /etc/systemd/system/"$1"
-}
-
-preset_units() {
-    local represet=
-    while read -r action unit_name
-    do
-        if [ "$action" = "#" ] && [ "$unit_name" = "Units below this line will be re-preset on package upgrade" ]
-        then
-            represet=1
-            continue
-        fi
-        echo "$action $unit_name" | grep -q '^[[:space:]]*[^#;]' || continue
-        if ! [ -n "$action" ] || ! [ -n "$unit_name" ]; then
-            continue
-        fi
-        if [ "$2" = "initial" ] || [ "$represet" = "1" ]
-        then
-            if [ "$action" = "disable" ] && is_static "$unit_name"
-            then
-                if ! is_masked "$unit_name"
-                then
-                    # We must effectively mask these units, even if they are static.
                     deb-systemd-helper mask "${unit_name}" > /dev/null 2>&1 || true
                 fi
-            elif [ "$action" = "enable" ] && is_static "$unit_name"
-            then
-                if is_masked "$unit_name"
-                then
-                    # We masked this static unit before, now we unmask it.
-                    deb-systemd-helper unmask "${unit_name}" > /dev/null 2>&1 || true
-                fi
-                systemctl --no-reload preset "$unit_name" >/dev/null 2>&1 || :
-            else
-                systemctl --no-reload preset "$unit_name" >/dev/null 2>&1 || :
             fi
-        fi
+            ;;
-    done < "$1"
+        *)
+            # preset-all is not available in wheezy; so preset each unit file listed in 75-qubes-vm.preset
+            if [ "${PRESET_FAILED}" -eq 1 ]; then
+                systemctl --no-reload preset "${unit_name}" > /dev/null 2>&1 || true
+            fi
+            ;;
+        esac
+    done
 
     systemctl daemon-reload
 }
@@ -108,44 +69,48 @@ case "${1}" in
         if [ -z "${2}" ]; then
 
             debug "FIRST INSTALL..."
+            # Create NetworkManager configuration if we do not have it
+            if ! [ -e /etc/NetworkManager/NetworkManager.conf ]; then
+                echo '[main]' > /etc/NetworkManager/NetworkManager.conf
+                echo 'plugins = keyfile' >> /etc/NetworkManager/NetworkManager.conf
+                echo '[keyfile]' >> /etc/NetworkManager/NetworkManager.conf
+            fi
+            /usr/lib/qubes/qubes-fix-nm-conf.sh
+
             # Location of files which contains list of protected files
-            # shellcheck source=init/functions
+            PROTECTED_FILE_LIST='/etc/qubes/protected-files.d'
-            . /usr/lib/qubes/init/functions
 
             # ensure that hostname resolves to 127.0.1.1 resp. ::1 and that /etc/hosts is
             # in the form expected by qubes-sysinit.sh
-            if ! is_protected_file /etc/hostname ; then
+            if ! grep -rq "^/etc/hostname$" "${PROTECTED_FILE_LIST}" 2>/dev/null; then
                 for ip in '127\.0\.1\.1' '::1'; do
                     if grep -q "^${ip}\(\s\|$\)" /etc/hosts; then
-                        sed -i "/^${ip}\s/,+0s/\(\s$(hostname)\)\+\(\s\|$\)/\2/g" /etc/hosts || true
+                        sed -i "/^${ip}\s/,+0s/\(\s`hostname`\)\+\(\s\|$\)/\2/g" /etc/hosts || true
-                        sed -i "s/^${ip}\(\s\|$\).*$/\0 $(hostname)/" /etc/hosts || true
+                        sed -i "s/^${ip}\(\s\|$\).*$/\0 `hostname`/" /etc/hosts || true
                     else
-                        echo "${ip//\\/} $(hostname)" >> /etc/hosts || true
+                        echo "${ip//\\/} `hostname`" >> /etc/hosts || true
                     fi
                 done
             fi
 
             # remove hostname from 127.0.0.1 line (in debian the hostname is by default
             # resolved to 127.0.1.1)
-            if ! is_protected_file /etc/hosts ; then
+            if ! grep -rq "^/etc/hosts$" "${PROTECTED_FILE_LIST}" 2>/dev/null; then
-                sed -i "/^127\.0\.0\.1\s/,+0s/\(\s$(hostname)\)\+\(\s\|$\)/\2/g" /etc/hosts || true
+                sed -i "/^127\.0\.0\.1\s/,+0s/\(\s`hostname`\)\+\(\s\|$\)/\2/g" /etc/hosts || true
             fi
 
+            chown user:user /home_volatile/user
+
             # Set default "runlevel"
             rm -f /etc/systemd/system/default.target
             ln -s /lib/systemd/system/multi-user.target /etc/systemd/system/default.target
 
             # Systemd preload-all
-            preset_units /lib/systemd/system-preset/75-qubes-vm.preset initial
+            systemdPreload
 
             # Maybe install overridden serial.conf init script
             installSerialConf
-        else
-            preset_units /lib/systemd/system-preset/75-qubes-vm.preset upgrade
         fi
-        systemctl reenable haveged
-
-        chgrp user /var/lib/qubes/dom0-updates
 
         debug "UPDATE..."
         # disable some Upstart services
@@ -158,48 +123,17 @@ case "${1}" in
         done
         dpkg-divert --divert /etc/init/serial.conf.qubes-orig --package qubes-core-agent --rename --add /etc/init/serial.conf
 
-        if [ ! -L /etc/systemd/system/rpcbind.service ]; then
-            ln -s /dev/null /etc/systemd/system/rpcbind.service
-        fi
-
         # Remove old firmware updates link
         if [ -L /lib/firmware/updates ]; then
             rm -f /lib/firmware/updates
         fi
 
-        # convert /usr/local symlink to a mount point
-        if [ -L /usr/local ]; then
-            rm -f /usr/local
-            mkdir /usr/local
-            mount /usr/local || :
-        fi
-
-        # remove old symlinks
-        if [ -L /etc/systemd/system/sysinit.target.wants/qubes-random-seed.service ]; then
-            rm /etc/systemd/system/sysinit.target.wants/qubes-random-seed.service
-        fi
-        if [ -L /etc/systemd/system/multi-user.target.wants/qubes-mount-home.service ]; then
-            rm /etc/systemd/system/multi-user.target.wants/qubes-mount-home.service
-        fi
-
         if ! dpkg-statoverride --list /var/lib/qubes/dom0-updates >/dev/null 2>&1; then
             dpkg-statoverride --update --add user user 775 /var/lib/qubes/dom0-updates
         fi
 
-        glib-compile-schemas /usr/share/glib-2.0/schemas || true
+        # Update Qubes App Menus
-
+        /usr/lib/qubes/qubes-trigger-sync-appmenus.sh || true
-        if ! [ -r /etc/dconf/profile/user ]; then
-            mkdir -p /etc/dconf/profile
-            echo "user-db:user" >> /etc/dconf/profile/user
-            echo "system-db:local" >> /etc/dconf/profile/user
-        fi
-
-        if [ -x /usr/bin/dconf ]; then
-            dconf update
-        fi
-
-        # tell dom0 about installed updates (applications, features etc)
-        /etc/qubes-rpc/qubes.PostInstall || true
         ;;
 
     abort-upgrade|abort-remove|abort-deconfigure)
@@ -211,8 +145,8 @@ case "${1}" in
             case "${trigger}" in
 
                 /usr/share/applications)
-                    debug "Updating Qubes App Menus and advertising features..."
+                    debug "Updating Qubes App Menus..."
-                    /etc/qubes-rpc/qubes.PostInstall || true
+                    /usr/lib/qubes/qubes-trigger-sync-appmenus.sh || true
                     ;;
 
                 # Install overridden serial.conf init script

debian/qubes-core-agent.postrm

@@ -43,7 +43,7 @@ if [ "${1}" = "remove" ] ; then
         rm /lib/firmware/updates
     fi
 
-    for srv in qubes-sysinit qubes-misc-post qubes-network qubes-qrexec-agent; do
+    for srv in qubes-dvm qubes-sysinit qubes-misc-post qubes-netwatcher qubes-network qubes-qrexec-agent; do
         systemctl disable ${srv}.service
     done
 fi

debian/qubes-core-agent.preinst

@@ -44,12 +44,13 @@ if [ "$1" = "install" ] ; then
     # User add / modifications
     # --------------------------------------------------------------------------
     id -u 'user' >/dev/null 2>&1 || {
-        useradd --user-group --create-home --shell /bin/bash user
+        useradd --password "" --user-group --create-home --shell /bin/bash user
     }
     id -u 'tinyproxy' >/dev/null 2>&1 || {
         useradd --user-group --system -M --home /run/tinyproxy --shell /bin/false tinyproxy
     }
-    usermod -L -a --groups qubes user
+    usermod -p '' root
+    usermod -L -a --groups qubes,sudo user
 
     # --------------------------------------------------------------------------
     # Remove `mesg` from root/.profile?

debian/qubes-core-agent.undisplace

@@ -1,2 +0,0 @@
-# moved to qubes-core-agent-passwordless-root
-/etc/pam.d/su.qubes

debian/rules

@@ -3,13 +3,12 @@
 
 # Uncomment this to turn on verbose mode.
 #export DH_VERBOSE=1
-export PYTHON_PREFIX_ARG=--install-layout=deb
 
 include /usr/share/dpkg/default.mk
-export DESTDIR=$(shell pwd)/debian/tmp
+export DESTDIR=$(shell pwd)/debian/qubes-core-agent
 
 %:
-	dh $@ --with systemd,python2 --with=config-package
+	dh $@ --with systemd --with=config-package
 
 override_dh_auto_build:
 	make all
@@ -23,6 +22,3 @@ override_dh_fixperms:
 
 override_dh_systemd_start:
 	dh_systemd_start --no-restart-on-upgrade
-
-override_dh_install:
-	dh_install --fail-missing

doc/vm-tools/qrexec-client-vm.rst

@@ -1,85 +0,0 @@
-================
-qrexec-client-vm
-================
-
-NAME
-====
-qrexec-client-vm - call Qubes RPC service
-
-SYNOPSIS
-========
-| qrexec-client-vm [--buffer-size=*BUFFER_SIZE*] *target_vmname* *service* [*local_program* [*local program arguments*]]
-
-DESCRIPTION
-===========
-
-Call Qubes RPC (aka qrexec) service to a different VM. The service call request
-is sent to dom0, where Qubes RPC policy is evaluated and when it allows the
-call, it is forwarded to appropriate target VM (which may be different than
-requested, if policy says so). Local program (if given) is started only
-when service call is allowed by the policy.
-
-Remote service can communicate with the caller (``qrexec-client-vm``) using
-stdin/stdout.  When *local_program* is given, its stdin/stdout is connected to
-service stdin/stdout (stderr is not redirected), otherwise - service
-stdin/stdout is connected to those of ``qrexec-client-vm``.
-
-OPTIONS
-=======
-
---buffer-size=*BUFFER_SIZE*
-
-    Optional buffer size for vchan connection. This size is used as minimum
-    size for a buffer in each connection direction (read and write).
-    Default: 64KiB.
-
-*target_vmname*
-
-    Name of target VM to which service is requested. Qubes RPC policy may
-    ignore this value and redirect call somewhere else.
-
-    This argument, can contain VM name, or one of special values:
-
-    * ``$default`` or empty string - let Qubes RPC policy decide, without giving any preference 
-
-    * ``$dispvm`` - new Disposable VM
-
-    * ``$dispvm:dispvm-template`` - new Disposable VM based on *dispvm-template*
-
-    This field is limited to 31 characters (alphanumeric, plus ``-_.$``).
-
-*service*
-
-    Requested service. Besides service name, it can contain a service argument
-    after ``+`` character. For example ``some.service+argument``.
-
-    This field is limited to 63 characters (alphanumeric, plus ``-_.$+``).
-
-*local_program*
-
-    Full path to local program to be connected with remote service. Optional.
-
-*local program arguments*
-
-    Arguments to *local_program*. Optional.
-
-EXIT STATUS
-===========
-
-If service call is allowed by dom0 and ``qrexec-client-vm`` is started without
-*local_program* argument, it reports remote service exit code.
-
-If service call is allowed by dom0 and ``qrexec-client-vm`` is started with
-*local_program* argument, it reports the local program exit code. There is no
-way to learn exit code of remote service in this case.
-
-In both cases, if process (local or remote) was terminated by a signal, exit
-status is 128+signal number.
-
-If service call is denied by dom0, ``qrexec-client-vm`` exit with status 126.
-
-AUTHORS
-=======
-| Joanna Rutkowska <joanna at invisiblethingslab dot com>
-| Rafal Wojtczuk <rafal at invisiblethingslab dot com>
-| Marek Marczykowski-Górecki <marmarek at invisiblethingslab dot com>

doc/vm-tools/qvm-copy-to-vm.rst

@@ -6,6 +6,8 @@ NAME
 ====
 qvm-copy-to-vm - copy specified files to specified destination VM
 
+:Date:   2012-05-30
+
 SYNOPSIS
 ========
 | qvm-copy-to-vm [--without-progress] dest_vmname file [file]+

doc/vm-tools/qvm-open-in-dvm.rst

@@ -6,6 +6,8 @@ NAME
 ====
 qvm-open-in-dvm - open a specified file in disposable VM
 
+:Date:   2012-05-30
+
 SYNOPSIS
 ========
 | qvm-open-in-dvm filename

doc/vm-tools/qvm-open-in-vm.rst

@@ -6,6 +6,8 @@ NAME
 ====
 qvm-open-in-vm - open a specified file in other VM
 
+:Date:   2012-05-30
+
 SYNOPSIS
 ========
 | qvm-open-in-vm vmname filename

doc/vm-tools/qvm-run.rst

@@ -1,14 +1,16 @@
-==========
+=======
-qvm-run-vm
+qvm-run
-==========
+=======
 
 NAME
 ====
-qvm-run-vm - run a specified command in a specified VM
+qvm-run - run a specified command in a specified VM
+
+:Date:   2012-05-30
 
 SYNOPSIS
 ========
-| qvm-run-vm vmname command [aguments]
+| qvm-run vmname command [aguments]
 
 OPTIONS
 =======

init/control-printer-icon.sh

@@ -1,15 +0,0 @@
-#!/bin/bash
-
-# Source Qubes library.
-# shellcheck source=init/functions
-. /usr/lib/qubes/init/functions
-
-if ! is_fully_persistent && test -f /etc/xdg/autostart/print-applet.desktop ; then
-	if qsvc cups ; then
-		# Allow also notification icon
-		sed -i -e '/^NotShowIn=.*QUBES/s/;QUBES//' /etc/xdg/autostart/print-applet.desktop
-	else
-		# Disable notification icon
-		sed -i -e '/QUBES/!s/^NotShowIn=\(.*\)/NotShowIn=QUBES;\1/' /etc/xdg/autostart/print-applet.desktop
-	fi
-fi

init/functions

@@ -1,188 +0,0 @@
-#!/bin/bash
-
-# Location of files which contains list of protected files
-PROTECTED_FILE_LIST='/etc/qubes/protected-files.d'
-
-qsvc() {
-    # Returns whether a service is enabled.
-    # Usage: qsvc <nameofservice>
-    #
-    # Must only be used after qubes-sysinit has started.
-    # See qsvc_early for more information.
-    local count=100
-    while [ ! -e /var/run/qubes-service-environment ] ; do
-        if [ "$count" = "0" ] ; then
-            echo "qsvc: Warning: qubes-sysinit has not finished executing yet" >&2
-            break
-        fi
-        sleep 0.1
-        count=$(( count - 1 ))
-    done
-    [ -e /var/run/qubes-service/"$1" ]
-}
-
-under_systemd() {
-    pidof systemd >/dev/null 2>&1
-}
-
-systemd_version_changed() {
-    under_systemd || return
-    systemd_pkg_version=$(systemctl --version|head -n 1)
-    if dmesg | grep -q "$systemd_pkg_version running in system mode."; then
-        return 1
-    fi
-    return 0
-}
-
-possibly_run_save_script() {
-    ENCODED_SCRIPT=$(qubesdb-read /qubes-save-script)
-    if [ -z "$ENCODED_SCRIPT" ] ; then return ; fi
-    tmpfile=$(mktemp /tmp/qubes-save-script.XXXXXXXXX)
-    echo "$ENCODED_SCRIPT"|base64 -d >"$tmpfile"
-    chmod 755 "$tmpfile"
-    DISPLAY=:0 su - user -c "$tmpfile"
-    ret=$?
-    rm -f "$tmpfile"
-    return $ret
-}
-
-have_qubesdb() {
-    # Tests whether qubesdb-read exists and can be executed.
-    type qubesdb-read >/dev/null 2>&1
-}
-
-have_qrexec_agent() {
-    # Tests whether qrexec-agent exists and can be executed.
-    PATH=/usr/lib/qubes type qrexec-agent >/dev/null 2>&1
-}
-
-qubes_vm_type() {
-    qubesdb-read /qubes-vm-type
-}
-
-is_netvm() {
-    [ "$(qubes_vm_type)" = "NetVM" ]
-}
-
-is_appvm() {
-    [ "$(qubes_vm_type)" = "AppVM" ]
-}
-
-is_proxyvm() {
-    [ "$(qubes_vm_type)" = "ProxyVM" ]
-}
-
-is_templatevm() {
-    [ "$(qubes_vm_type)" = "TemplateVM" ]
-}
-
-is_dispvm() {
-    [ "$(qubes_vm_type)" = "DisposableVM" ]
-}
-
-is_fully_persistent() {
-    [ "$(qubesdb-read /qubes-vm-persistence)" = "full" ]
-}
-
-is_rwonly_persistent() {
-    [ "$(qubesdb-read /qubes-vm-persistence)" = "rw-only" ]
-}
-
-is_updateable() {
-    [ "$(qubesdb-read /qubes-vm-updateable)" = "True" ]
-}
-
-reload_random_seed() {
-    local seed
-    seed=$(qubesdb-read /qubes-random-seed)
-    echo "$seed" | base64 -d > /dev/urandom
-    qubesdb-rm /qubes-random-seed
-}
-
-is_protected_file() {
-    grep -Fxrq --exclude='*.rpmsave' --exclude='*~' --exclude='*.rpmnew' --exclude='*.rpmold' -- "${1}" "$PROTECTED_FILE_LIST" 2>/dev/null
-}
-
-umount_retry() {
-    local count=5
-    while mountpoint -q "$1" ; do
-        if umount "$1" ; then break ; fi
-        echo "Something prevents unmounting $1:" >&2
-        fuser -vmM "$1" >&2
-        if [ "$count" = "0" ] ; then
-            return 1
-        fi
-        sleep 5
-        count=$(( count - 1 ))
-    done
-    return 0
-}
-
-initialize_home() {
-    local home_root
-    local mode
-    #local user
-    local uid
-    local gid
-    local homedir
-    local homedirwithouthome
-    local pair
-    local homedir_uid
-    local homedir_gid
-    local waitpid
-    local waitpids
-
-    home_root="$1"
-    mode="$2"
-
-    if [ -z "$home_root" ] ; then
-        echo "initialize_home() needs a target home root directory, such as /rw/home, as first parameter" >&2
-        return 64
-    fi
-
-    if [ "$mode" != "unconditionally" ] && [ "$mode" != "ifneeded" ] ; then
-        echo "initialize_home() second parameter must be 'unconditionally' or 'ifneeded'" >&2
-        return 64
-    fi
-
-    if ! [ -d "$home_root" ] ; then
-        echo "initialize_home: populating $home_root" >&2
-        mkdir -p "$home_root"
-    fi
-
-    # Chown home if users' UIDs have changed - can be the case on template switch.
-    for pair in $(getent passwd | awk -F : '/\/home/ { print $1":"$3":"$4":"$6 } ') ; do
-        #user=$(echo "$pair" | awk -F : ' { print $1 } ')
-        uid=$(echo "$pair" | awk -F : ' { print $2 } ')
-        gid=$(echo "$pair" | awk -F : ' { print $3 } ')
-        homedir=$(echo "$pair" | awk -F : ' { print $4 } ')
-        homedirwithouthome=${homedir#/home/}
-        if ! test -d "$home_root/$homedirwithouthome" || [ "$mode" = "unconditionally" ] ; then
-            echo "initialize_home: populating $mode $home_root/$homedirwithouthome from /etc/skel" >&2
-            mkdir -p "$home_root/$homedirwithouthome"
-            cp -af -T /etc/skel "$home_root/$homedirwithouthome"
-            echo "initialize_home: adjusting permissions $mode on $home_root/$homedirwithouthome" >&2
-            chown -R "$uid" "$home_root/$homedirwithouthome" &
-            waitpids="$!"
-            chgrp -R "$gid" "$home_root/$homedirwithouthome" &
-            waitpids="$waitpids $!"
-            chmod 700 "$home_root/$homedirwithouthome" &
-            waitpids="$waitpids $!"
-            for waitpid in $waitpids ; do wait "$waitpid" ; done ; waitpids=
-        fi
-        waitpids=
-        homedir_uid=$(stat --format=%u "$home_root/$homedirwithouthome")
-        homedir_gid=$(stat --format=%g "$home_root/$homedirwithouthome")
-        if [ "$uid" -ne "$homedir_uid" ]; then
-            echo "initialize_home: adjusting ownership on $home_root/$homedirwithouthome to $uid" >&2
-            find "$home_root/$homedirwithouthome" -uid "$homedir_uid" -print0 | xargs -0 chown "$uid" &
-            waitpids="$waitpids $!"
-        fi
-        if [ "$gid" -ne "$homedir_gid" ]; then
-            echo "initialize_home: adjusting groupship on $home_root/$homedirwithouthome to $gid" >&2
-            find "$home_root/$homedirwithouthome" -gid "$homedir_gid" -print0 | xargs -0 chgrp "$gid" &
-            waitpids="$waitpids $!"
-        fi
-        for waitpid in $waitpids ; do wait "$waitpid" ; done ; waitpids=
-    done
-}

init/resize-rootfs-if-needed.sh

@@ -1,28 +0,0 @@
-#!/bin/sh
-
-# Possibly resize root device (partition, filesystem), if underlying device was
-# enlarged.
-
-set -e
-
-# if underlying root device is read-only, don't do anything
-if [ "$(blockdev --getro /dev/xvda)" -eq "1" ]; then
-    echo "xvda is read-only, not resizing" >&2
-    exit 0
-fi
-
-sysfs_xvda="/sys/class/block/xvda"
-
-# if root filesystem use already (almost) the whole dis
-non_rootfs_data=$(( 250 * 1024 * 2 ))
-rootfs_size=$(df --output=size / | tail -n 1)
-# convert to 512-byte blocks
-rootfs_size=$(( rootfs_size * 2 ))
-if [ "$(cat "$sysfs_xvda/size")" -lt \
-       $(( non_rootfs_data + rootfs_size )) ]; then
-   echo "root filesystem already at $rootfs_size blocks" >&2
-   exit 0
-fi
-
-# resize needed, do it
-/usr/lib/qubes/resize-rootfs

init/setup-rw.sh

@@ -1,77 +0,0 @@
-#!/bin/sh
-
-dev=/dev/xvdb
-
-if mountpoint -q /rw ; then
-    # This means /rw is mounted now.
-    echo "Checking /rw" >&2
-
-    echo "Private device size management: enlarging $dev" >&2
-    if content=$(resize2fs "$dev" 2>&1) ; then
-        echo "Private device size management: resize2fs of $dev succeeded" >&2
-    else
-        echo "Private device size management: resize2fs $dev failed:" >&2
-        echo "$content" >&2
-    fi
-
-    if ! [ -d /rw/config ] ; then
-        echo "Virgin boot of the VM: populating /rw/config" >&2
-
-        mkdir -p /rw/config
-        touch /rw/config/rc.local
-        cat > /rw/config/rc.local <<EOF
-#!/bin/sh
-
-# This script will be executed at every VM startup, you can place your own
-# custom commands here. This include overriding some configuration in /etc,
-# starting services etc.
-
-# Example for overriding the whole CUPS configuration:
-#  rm -rf /etc/cups
-#  ln -s /rw/config/cups /etc/cups
-#  systemctl --no-block restart cups
-EOF
-        chmod 755 /rw/config/rc.local
-
-        touch /rw/config/qubes-firewall-user-script
-        cat > /rw/config/qubes-firewall-user-script <<EOF
-#!/bin/sh
-
-# This script is called in AppVMs after every firewall update (configuration
-# change, starting some VM etc). This is good place to write own custom
-# firewall rules, in addition to autogenerated ones. Remember that in most cases
-# you'll need to insert the rules at the beginning (iptables -I) for it to be
-# efective.
-EOF
-        chmod 755 /rw/config/qubes-firewall-user-script
-
-        touch /rw/config/suspend-module-blacklist
-        cat > /rw/config/suspend-module-blacklist <<EOF
-# You can list modules here that you want to be unloaded before going to sleep. This
-# file is used only if the VM has any PCI device assigned. Modules will be
-# automatically re-loaded after resume.
-EOF
-    fi
-
-    if ! [ -d /rw/usrlocal ] ; then
-        if [ -d /usr/local.orig ] ; then
-            echo "Virgin boot of the VM: populating /rw/usrlocal from /usr/local.orig" >&2
-            cp -af /usr/local.orig /rw/usrlocal
-        else
-            echo "Virgin boot of the VM: creating /rw/usrlocal" >&2
-            mkdir -p /rw/usrlocal
-        fi
-    fi
-
-    echo "Finished checking /rw" >&2
-fi
-
-# Old Qubes versions had symlink /home -> /rw/home; now we use mount --bind
-if [ -L /home ]; then
-    rm /home
-    mkdir /home
-fi
-
-if [ ! -e /var/lib/qubes/first-boot-completed ]; then
-    touch /var/lib/qubes/first-boot-completed
-fi

init/setup-rwdev.sh

@@ -1,40 +0,0 @@
-#!/bin/sh
-
-set -e
-
-dev=/dev/xvdb
-max_size=1073741824  # check at most 1 GiB
-
-if [ -e "$dev" ] ; then
-    # The private /dev/xvdb device is present.
-
-    # check if private.img (xvdb) is empty - all zeros
-    private_size=$(( $(blockdev --getsz "$dev") * 512))
-    if [ $private_size -gt $max_size ]; then
-        private_size=$max_size
-    fi
-    if cmp --bytes $private_size "$dev" /dev/zero >/dev/null && { blkid -p "$dev" >/dev/null; [ $? -eq 2 ]; }; then
-        # the device is empty, create filesystem
-        echo "Virgin boot of the VM: creating private.img filesystem on $dev" >&2
-        if ! content=$(mkfs.ext4 -m 0 -q "$dev" 2>&1) ; then
-            echo "Virgin boot of the VM: creation of private.img on $dev failed:" >&2
-            echo "$content" >&2
-            echo "Virgin boot of the VM: aborting" >&2
-            exit 1
-        fi
-        if ! content=$(tune2fs -m 0 "$dev" 2>&1) ; then
-            echo "Virgin boot of the VM: marking free space on $dev as usable failed:" >&2
-            echo "$content" >&2
-            echo "Virgin boot of the VM: aborting" >&2
-            exit 1
-        fi
-    fi
-
-    echo "Private device management: checking $dev" >&2
-    if content=$(fsck.ext4 -p "$dev" 2>&1) ; then
-        echo "Private device management: fsck.ext4 of $dev succeeded" >&2
-    else
-        echo "Private device management: fsck.ext4 $dev failed:" >&2
-        echo "$content" >&2
-    fi
-fi

misc/20_org.gnome.desktop.wm.preferences.qubes.gschema.override

@@ -1,2 +0,0 @@
-[org.gnome.desktop.wm.preferences]
-button-layout='appmenu:'

misc/30_cron.conf

@@ -1 +0,0 @@
-binds+=( '/var/spool/cron' )

misc/Makefile

@@ -23,7 +23,7 @@ python2:
 python3:
 	rm -rf py3
 	mkdir -p py3
-	cp dnf-qubes-hooks.py py3/
+	cp dnf-qubes-hooks.py xdg.py py3/
 	python3 -m compileall py3
 	python3 -O -m compileall py3
 

misc/RPM-GPG-KEY-qubes-3-primary

@@ -0,0 +1,40 @@
+-----BEGIN PGP PUBLIC KEY BLOCK-----
+Version: GnuPG v1
+
+mQINBFRsmtIBEAC7UgrYFrkPpSxjRoT9OmU0JqYmzLBqzRRdHCtakTdN8pRl/yE/
+zQHvmPnrQ57u45KtxY7EYveWC6RtNEw9IVvyQZp6jGQ05ljhwkNKfxKZcGvT4Qd4
+oCcXdKzGOjsw/mW0saklcrBdm7PiEhQvC0Oc66RreNeZ/2INQALVZLv808KLlNHs
+uK9u/mjrT/A3RpzvFYvVnPJPJFjnYyGM8cVysCez4yeH9nymbLLD73pZyKhSU5Uo
+x3LJKMfIUee0N677Lb45iM+iHW+kcHay3i7tev0xkm08V61ym2YwCJxIpMCvryvK
+h1kScMeAOLsHkZpsqoXuSy8GFz1gKiZFCaiuF+ojRSXcN221Exfz/pF47aMd7Sm3
+0hSQk6Om9DESrzDXm85czq7Taw48NL35nCoPUqNfAP+BknSz79KoNkPDGP9+ps34
+S9o401dygAZToQNTJNuJeZwEVEBykRlsoeR/C9CTsSZMufBGBS9805h31FoZ3ePv
+ITTaZidVWxUnRn4mlcYlfUEniyrmtc8IG0SZQZ+AQu0BgDZ/oV2LsS/g+YbN6qjF
+LczBCWPngXUYvmm0syPdGfPQZJCnvwnEpPoRq+bqknLUN/EzEihbILR9gaO0U/XR
+9+EB796N973+v6HsKxKmfJMqkIXa+PhLvfWVs3ZZnM6USTpA0DYHpvcVIwARAQAB
+tB5RdWJlcyBPUyBSZWxlYXNlIDMgU2lnbmluZyBLZXmJAjgEEwECACIFAlRsmtIC
+GwMGCwkIBwMCBhUIAgkKCwQWAgMBAh4BAheAAAoJEMsRyh0D+lCCAyUP/jM+dKCC
+WIjTAFzdudJFfznjFjiggI7EdNJYpMd3FP8Gq53qqFH5rvg0fwJjnNGPBpfEjhHM
+TlCNn3M0L6NZbB7PQwUBD332f2QwE4PIcuo1e7c9ySrhdMc0maR5+CcMlJHG6T8Q
+EacL+Xhc91GC2Gi/qMOjE4lo337Y3GLE6WHFRVvqBpI+ovr9LYKP5vQ+InY+uVsP
+LTL7AQVRDZcu4eQdI1HdJ0fYyhx5lJSiPWaM80VBkOgfF6HyGrMcjzWs+9gtYs76
+g6QoEKgu3YuPi1J1JE7d+Un7iYSqrUv3ljSDq2PMlx4vpq+oc1/1qHLyMYpGjmHa
+cQRjPo8bqgZ4vo6BC4Za+SGliLPcN9w0ivjsaGZ2L5PHxJ7kCSJ6SbZUrjWhTZL3
+arWGCFQmYqAY5EkNSWrQePgkCj/5I5YAou39LnREN91KgYDT8bMeED7uQ/fskRns
+Xfbx6ACsU69lLYIqd4HcuhcHWV9lTYtavjLKny71BauLALOve9uHmYX/cweBnt98
+8AWGuIuspvs3kwFJLu5k30m3HUMZPG8lDfN0R9v5eyoNxFc+WNbxHq4fIUXmbGfN
+Jclsn3hzUUS3XBG2G9VDmcf/N82xlwRMDHD78G/+Q3MumQeLtlXirhASQqi3XdXk
+CR5+NjOJZWRYfvk+WbJsshE3sosG2uLHzgs/iQIcBBABAgAGBQJUbJtEAAoJEN36
+Gj42h5SUuVsQAI5QPmqJvnUgUMzoj1gCWW2eJTbxTWs9jALN8JRqPGT4KKe+x5te
+IgYkK056WlxBA73UDcXLQ4dKoqF9J3wMF2O+Ir7C46p+dFS5KTjUj4vaYMgAmshu
+ihZmBChmldQpIYmFvWtdvdanEpaOiblr+AXK1Hd5aJrpBFf5I/EP7iCWeOXc5FzK
+UEZylf8PVmNO3s8uuyWMdGR7cGcukwOONzre9XurO6P8fHfjh+vXeI+5KsJ1Cd2y
+22OWAK0QjtCBLTQ4E6WUM2/FjLU55HB3fdAo4ucd2QgJhf4HuWq6KiLRz74O04o1
+lrqtS3M9GfLmQx/lUF8vIS4jVf8X7/iZY52VCJM5PDoeF0xKTACJ2+emuQfyw0SE
+7AfxCrt35cvXBWAzUN/kLFslQkBI+/FssnUDBYGeU+SkgEfkpuWwRsqfwCITN0I4
+jmwDfa+6PQpMF9lkgF+BanNa8bfroWztmW9dZYp6jyV8/VI5SeG7RYu6TZUeXXoS
+eMIL/d9eIhebLj5syd0BNukZMpI92wnSDWTWxBZFliltOIv6/yC6Bj7UaCyt2JkV
+/xbi+rOiemBS1mPHhV/CAM7sV0TM8xONyVXM4g5eVj0RStFYjc586ZguleNeIfYT
+qDqp/VUKnu6jYNOWS2W/kpenXId22X1TdXcxwm3U3kOc06pygu1fTdDp
+=idYC
+-----END PGP PUBLIC KEY BLOCK-----

misc/RPM-GPG-KEY-qubes-3-unstable

@@ -0,0 +1,29 @@
+-----BEGIN PGP PUBLIC KEY BLOCK-----
+Version: GnuPG v1
+
+mQINBFRuA2sBEACjOSNmDK6g6vpirgy0mRbRORP44eI0R45JN3oSGgsmCD5jJSTo
+RRUE1RknbK26+bjnsKAKwpP67CA3So/5sa4l7i7G4xJdgVZooM3ZTK7ubQCqkMYB
+h4yYTBAtt7vi6olhKvEkCvhzozcUa4/qW/NuIuTCpF0G0kBUWyqqYQzwtWD5QimE
+6NjbxjuKf0P0KtzUvF2SdNYh87kXUj+6+RcA6VxjsLY3gSWnl+786L4yKUekRjB7
+JvD9yMd1V+U/P1MUamJFyn68Aih6dRi17/ZvHKHY0gj6k6acE34Oy6SDmbwuWWeZ
+jMpSACAHHhWJID0wwrig3ZsxV4lGWoND/n+OSmEyWg4J8dB1thZpoBgjL05prBgC
+oygzwyHlyewVqdtdjMJOSSk34pehQ35lPQ9XqASnF1igQaVTKFxUIg1eoaQMZibd
+dSJzEcwuFUeJ1S22lyUdtaC/WdGb5vvHSEDiOA/3Ll0gpaHm2tor08J0s9C6CD2Q
+irF/FwUu52yO/bNtOkXunX5G2Ua+c49o3D6bvc+mfBY4EVKN5k6URW+vy47gJDbH
+4CVcxgBRoFy8SdAogqf/H/4+UOAR5jo5QLzsRq0mRHRbleLHwyH5PQxF9M73UVgL
+J5OohzOoThyiWbIesjyFw9aiC1Dk9l6ugprPTAS6LPNpxNaByNlpbX/eJQARAQAB
+tCdRdWJlcyBPUyBSZWxlYXNlIDMgVW5zdGFibGUgU2lnbmluZyBLZXmJAjgEEwEC
+ACIFAlRuA2sCGwMGCwkIBwMCBhUIAgkKCwQWAgMBAh4BAheAAAoJEJP+RAmjx3Ot
+WFMP/1y98l3kXaIUIXZFjdtCmiZvFZKETP5S/81Rn32PISSs5TklxWbt6B3rNY67
+ovtK10qJXxarLeu0+IR+UM+AV1R/OvT3qtrJuvbbr0vIyy0RONaapoPIdI2eD2FC
+E/7JTv7KibKSE4nI9W9ZdRboJB1MPigffBR7qAC2ReCGtyKVUWRCKh57aQqbSDkZ
+AruTV1gXbFDusuKh1kQ2zVXFMn9KU98Qv0nKewjndNwnfOk7UFdsTkRCEyHr19wx
+KOuoLH4bfCyV8dEfriM5d6ABjmpv0Olp9XFT5YznoxrsXAjO0aUIBiNYYTk5vRLG
+ixBJGRjruDUzCZ8gIObIEwfAJsJ4LsFZ5LI0csF2uNueeogmNm0LfejyrWBlyRfW
+XdM5WP9vAbWectxNfaW84pPkvAEaer2W+x9ddO+FirTPNgU0M55JxcjKve8XsbuK
+iOA80h8eiMuukn2CDENVG9g7hiui9YzcenQKzmZIYYARWPzSKRyRrMFWrhDjOZ+R
+sG2PKzuJVIatGqhzqjD4CmoMPkVDli9p1ADOJLMJu062D53aWjgVi6DFHt5cZmFx
+rvDPiLqy/uuWWSDaDgX36KEenvwzQLjlEdTrN8a3qiBMxeceLWFLQqAknQnmU19/
+HcyP+lX0FzFFm1yIB/aEQpcXsfJcil0Dg6zAeFbXxdQYWlVm
+=7CDU
+-----END PGP PUBLIC KEY BLOCK-----

misc/RPM-GPG-KEY-qubes-4-centos

@@ -1,29 +0,0 @@
------BEGIN PGP PUBLIC KEY BLOCK-----
-Version: GnuPG v2
-
-mQINBFnOuKQBEACc4uru1ruuHsZAIFFJhkmYVL0I07MlIjA9FC0vwNQA0sq0roJ6
-LElswKLyu9ST8h0qwlqW9RalFxxkhvm0ySvNcWPEayHW2L0izGfD+IH1SUk3QALn
-IudHFd0VYw7REunDgEMfQXvYp1nAQqJ6/e4PrYtIqYfenSYd226/7qBgEJHixeWJ
-XXPoGLSqrsPFzB2KHJRRAJNKB/SFeGd4EHD/LKuxxArAjID+hEo3S53E1xf/G330
-dyEAt5PLsqA0USnWCsREyW7OhW8Bbs02wyYHbOeIt2VM5/GOGJFvGRQC8YsUspBV
-OY3PPMxxmf/8GtORQsTD5BgrtbbZg5mTn3vPi/0LiPIVoyUqLcNY1xLIUtoikhi4
-X5o+37DcRsP720jinXoqqyZPvQlynPAzgJ0i+IIk/8QUp3qQEUm0WXvNamTpluY2
-HPC2dNEW45FnTatMg5mDGf091UdMk6JKXyETRYRWdQfGq+n2BQMO5p6VFMgbzDP9
-I2IYvYnjEi59X7dORGHxYs7LqNGoKL1em8r5NiTS6PhRmw7yQYdrpykFjwZxQvM9
-F+HGIKLd0map8g08Sew0VTZ96OpRWkoMMpveLq0W7Ke4Cgu0t1245rE000r+/sRZ
-l/fg1eSPwVxHHFu8Wj6l4VJiZzi4hSHxOZipNIkfz/SvGvkcgeXGRW7QKQARAQAB
-tCZRdWJlcyBPUyA0IENlbnRPUyBQYWNrYWdlcyBTaWduaW5nIEtleYkCNwQTAQgA
-IQUCWc6/DQIbAwULCQgHAgYVCAkKCwIEFgIDAQIeAQIXgAAKCRAZIFoR/ePQqjMe
-D/9/L0TK532j4k4ZYgOULnqq6JTN0qvmG8JWiRBjRoc90ksDHcH0JwnceYugN2/K
-eV1Nfrm2SLzbaNFJKLGhktskXKEU6dRe5IHlOfXLCnzTsUlnrV7JQ7RhRd27B5YJ
-2OZ9xukwJMihfvBEGD8u98i1OceyeqB6n4T/vwxeAq0UWd3rbFzrzXNDEVy1+7LV
-4s8NtsnAUOece+njTMtxEZep6SZ3MM9XkhD+WwsKan1kUxq8WdFj5o8N0VojdDBv
-9ZCJLn65F2WLTvyILp8K25KI2uLolk+J6monS6keFsdQ+cjEiqadHcfZruIIC5m5
-XpJ8+VdBj+s22q5b1KXRwkK7j69IgMnDbsEJOvH0gW3Nwvofzim32K5TrPXSGlYe
-5qTNYlzRjEhheBLBsK9iJ17CgEhDSzaU6TZOZIM1MVg/7OY//99WL/h6/+bAMkoq
-aDCOhxDFkoX8lHGjlAMV1JiESNy8Xxnt+J8+j86ugz/TSKToRawKBRCXno0Cycq5
-w/auNLHsXyeyftIOva2H9sLVW7DwvipqiYBGunRE+gqznsX1r0oli1mZrW/JiEfj
-6F5+l8L9+GQi/f2WvBMXKgjqHgyl7MWVWiZ3B3Jy98NzNKgDVxRkrhaXLzjgdQKz
-J3xJNOrHCRPqyH7qq4CbS62nLeaOgEPdmsygcn7VfNYajQ==
-=F3Wg
------END PGP PUBLIC KEY BLOCK-----

misc/RPM-GPG-KEY-qubes-4-primary

@@ -1,39 +0,0 @@
------BEGIN PGP PUBLIC KEY BLOCK-----
-
-mQINBFi9Xv4BEADTkOlBTDmO6DsFJi754ilTFqsluGWleeProuz8Q+bHFlx0Mqtk
-uOUcxIjEWwxhn1qN98dIPYds+mD9Bohamdh+bJYxB/YYj9B2xvURhCpxVlWzzkzt
-i1lPYhj/MR637N9JqIdILmJSBFDxmnuWfQxfsbIsi4lUx5oq6HzIAYXzUzA+0/0a
-c/j0zAm9oBq+pXPad/xkH8ebkNAL0+HbHArBNFzrhVKmi1VskpxurPIYZEcQ0dUu
-n447TM/37y+dzmNYxvSuK2zBPFa9upXsKZEoVaJqksXDdX2YuMsZFiesdieL85w7
-sD1iI6Eqmp5EIZXa8t0/MHTaDrm1tDKJdSu/5zrh0RFh+J73qxJH8lDJqcTVggCe
-Xoasoi1LNg0CIgzVM+zLEDbpNd6mILdXQNHzsU4CP2UFpMxOUUDMEPYSE3WBExWX
-0dBO8QgvTOzqvRWq7TL2jKaprsB/ZXiZief5hOK2QFL6HFEOuFuWLf3tb2+tpJoZ
-LXbXYW+6M+WNRHr9mDg3o6SuZmSwUCOa1FV/i51gqiUHmXEfIGH3iE5WWq2bvUG1
-dhjkzDGPL9fXbCWS6+QARakXRbxslsc4RgMrQR6nLEAuOL7GDaG3c7ldqgfotkal
-5KDB5/1AxYW1TC0JfoKWalYrfXlUJlbHcvDFqHdyljOnoeJ8WVqLNE9hUQARAQAB
-tB5RdWJlcyBPUyBSZWxlYXNlIDQgU2lnbmluZyBLZXmJAjcEEwEIACEFAli9Xv4C
-GwMFCwkIBwIGFQgJCgsCBBYCAwECHgECF4AACgkQGEh5L54nlem9QRAAkaDEfYey
-FoldssIDE/gliYYb7RSYBjs+QrYJQjBxFGXXPgHS5kGMZfMkqVVBc8EtHh41q7gU
-mUIHVbjnKIcYaKLaVl/qb9Jkx+6/NxEYWjNVEMMwPk820QgI1alWrweH7ZuxxGlz
-CzOQsyKZLH3TESEf46CUjv9FHW2nKPAp5qVMzLRlgtquQAdfh7SWau7Kd+WPQOiB
-9cj+j3/yswsrpLmvqJP8trS/aKAhsn2jGrxwSAbdGCzQorJjUy5HLZ6xVIk9yD0T
-+o9cbK4SQSuOHUiA9Z5gA7vuxwOuloDhIm74k2PBWMaUEvx19nIh4XmgGEKNzI6V
-SbR+s+d9ciQ/aC/bXdeeZOpCDaty54D8sKzMi2y15Urycxwpz508LwE6I3Zm0Won
-xMEf5gGR30szgQdh6sJKIqZ2nVDLBg4H1mc4CULhsgViN/vM3Rrj2t4kOwUM30AU
-M49o4JPzY4wvhsAmhIQGl38C8wDkSqPwntRsszpbLgzI3Lsxb00xiPcLR6Y/pviH
-AfHxh/1uYymjD1Fq9u9ylgR6+15qqEYY/uEHr2EQyVvXQ08R1iKkT+v8fufMFUWa
-rJxyB+5v/RPRKvRRi9Xb1HkoiFo3E/bEPYKlGA2colp5iqFYpTUBJYJXyMosgjI+
-mqH0I+V+LuMtlE521YHKg0tsB9GVlfWBS12JAhwEEAECAAYFAljAUaEACgkQ3foa
-PjaHlJR8xw/5AYj/vJNbpnFNYV1jK7AwaEScpGpuDwh+izdGB6eCajynoZMmHSs5
-S3ToygNDo6Tlnh4/Tk7g6nG+eRWdAGghrrz2TXZd0sQX2KJ+m2omT5TZMrwPzM0v
-HcUSAZhW1+nK8miMdvxeOAtY91OaDXwjddii/f420m+9tXwCVKbD+EC83wPpr76r
-sokeOrp5H53CZQ++SbbG7qRmj4uc+VuyXNbAYNDa999Dpm5CW95LgMJ8/YpZbQ9S
-Gk8xlo2DTdBig84yO8Dp9L40KxhIbtpOfLZSWR7OwfMchb2wdt/rRcFsAUPjW7of
-/ZO7lQIPfkdl6cvssoZEjEGZnaxjRzR1b6GtPmlrq8MwUHOZqVizlo9vskuAczYl
-VECk2+D5ZH52GsSbX+C/2DpLUI+o8hLmNDkyBHkz7eOV69lMOzKKsXVyOyrsaLY1
-xNY6JPhMwJVuX8zNW2upETvWs8kr+ZOSvalinvmD6BAQp602PQRnUYDgRxG7GXw+
-z9D/6ea14TjGpQWW+wvRUUpqgs7WKCzjAAPDiqTpLvz5xtSTToW/qQJJn4LO7w3H
-Qo9G00Mruapdmy4nV5lHqsjm817M1vChTq1Q5+4ZPLMBoAndNM6vZAVJzfhhR+zG
-ZFp6oNCNJuSPFd+xN4tczA+aNZgUDDYhcvelFevUubLSjAR3ulfwxns=
-=d8U3
------END PGP PUBLIC KEY BLOCK-----

misc/RPM-GPG-KEY-qubes-4-unstable

@@ -1,29 +0,0 @@
------BEGIN PGP PUBLIC KEY BLOCK-----
-Version: GnuPG v2
-
-mQINBFk/KJsBEADR8mS6Z0NYFnY99BdaYN2Hng2IYIc56qMr+OpdwnriiGZhnd9m
-LyL/HJoFpg+kqdZyI9u31kAzXb2GbaCc75O46T1QckrlTInQns889k43vxRHIZCe
-KhIAakexLI1MynUIZtwB23pSeNrfIpkNMY2VwE6wrY57fSnb3+67/Jj7spVoMekw
-2M6U3cbzB7ijBECmzvRCnF2X0qs0r3qyaneunkCUPHbhM6/EUim722efMzVDu43Z
-XEIC3Vw/ydWk2ulyHEdK8ZZ8OfyiMEWvUFm1yvFDr4jS3Wl0bHYs4kGozlu9xGDz
-MO9966awBW4yCIl5XzIR2qcYdeDZmNysbafOkmcB8ObRkOAZeGjCpJBs0mgpMSfN
-ZXAQFw/COw7yyPH2GLxIOPYLYHzM0XkOPIvl5vl9F2pLT2x9emIR1D8lgqdNMIhW
-4eIcw50jS1TjyBCcS4cgiiCHT+rdSp6u7GpqRfwQNXBHOGHptkLY+VrqwtJ+5ckG
-oMIVKq/cLpHVe5usBiPs8v8uK0ufNvj3NmuAypwNsW49igLBOhIy8s9OjDnGtWfX
-2NU/QXQm/IBAAzXZ0VKPl9U4rAaidpJt991OZ+D2BAwZn2Go/vUPWi6/IqAvaE7g
-vZjBW7Hucpd6h26lEAIdzFqgym6yqCdQxdaOn9pP1qzRplUXqo9DAH2i5QARAQAB
-tCdRdWJlcyBPUyBSZWxlYXNlIDQgVW5zdGFibGUgU2lnbmluZyBLZXmJAjcEEwEI
-ACEFAlk/KJsCGwMFCwkIBwIGFQgJCgsCBBYCAwECHgECF4AACgkQevnGU3u23ofo
-4g//Tmjw09UAL0uV/Oyjz1C0JBWQ7T7rt63L5KQ2S0DRjEykBJnZ8MPkYb0oXjOh
-SAqhJdA0Exjo+OIyofpLkT/Sjz02qE4auQni9aUYr6IqfLmOaQHkCxq8MNhSyu8s
-T7zTLPcP8JO86U0lWZ0n2k5fAyZKFqKIBQJAOGg1M3W4m0jIhNK5VCNLGCxyDvZJ
-kmh4STQdQWA5pu6dw8ruwhfWUPKXUVJttWWXTJd+MDR5Q/QNNATsK+123zmjqB85
-Wz1H6f4aGXrJGkz8Ize22H+56mxZ/B7ZFRAeKZwH1wXRg8mE33k77aJW0QrIbc7Y
-TVeZBTs38AxiG+0fiFTdZWmknkJ9YEcTMYtYlUrxpqaPjw1x8tLKd/mo/A7yvdo8
-XzvRs04aXVGS65jYS9rA4uTKXJ3q/pKouPLQT4GEcnDWWP63un3Ku6iSVyWWnOS6
-xJbFo1pgoSpNqjVh+oL3qU88nbN7KGaSua9FsAJknKzvzZheLqvrBddEFUvELGwx
-bbXzzwocIISe9m3NZnOMdjAGjmoukwCVFEFeq/9ieLRe5wcbKNg8pogiQRt8Izar
-lsSbtUT0s8X4EmD+61/g6nu8+RcNeYPrWqB4KMbYPiz30qsiP7XoTNVJYDxjU5md
-6watPaYvxmqnXkjdwM4Zpaq3cs3YZcMyqp/y2eus89EmDIY=
-=ShJt
------END PGP PUBLIC KEY BLOCK-----

misc/RPM-GPG-KEY-upgrade-qubes-3-primary

@@ -0,0 +1,40 @@
+-----BEGIN PGP PUBLIC KEY BLOCK-----
+Version: GnuPG v1
+
+mQINBFRsmtIBEAC7UgrYFrkPpSxjRoT9OmU0JqYmzLBqzRRdHCtakTdN8pRl/yE/
+zQHvmPnrQ57u45KtxY7EYveWC6RtNEw9IVvyQZp6jGQ05ljhwkNKfxKZcGvT4Qd4
+oCcXdKzGOjsw/mW0saklcrBdm7PiEhQvC0Oc66RreNeZ/2INQALVZLv808KLlNHs
+uK9u/mjrT/A3RpzvFYvVnPJPJFjnYyGM8cVysCez4yeH9nymbLLD73pZyKhSU5Uo
+x3LJKMfIUee0N677Lb45iM+iHW+kcHay3i7tev0xkm08V61ym2YwCJxIpMCvryvK
+h1kScMeAOLsHkZpsqoXuSy8GFz1gKiZFCaiuF+ojRSXcN221Exfz/pF47aMd7Sm3
+0hSQk6Om9DESrzDXm85czq7Taw48NL35nCoPUqNfAP+BknSz79KoNkPDGP9+ps34
+S9o401dygAZToQNTJNuJeZwEVEBykRlsoeR/C9CTsSZMufBGBS9805h31FoZ3ePv
+ITTaZidVWxUnRn4mlcYlfUEniyrmtc8IG0SZQZ+AQu0BgDZ/oV2LsS/g+YbN6qjF
+LczBCWPngXUYvmm0syPdGfPQZJCnvwnEpPoRq+bqknLUN/EzEihbILR9gaO0U/XR
+9+EB796N973+v6HsKxKmfJMqkIXa+PhLvfWVs3ZZnM6USTpA0DYHpvcVIwARAQAB
+tB5RdWJlcyBPUyBSZWxlYXNlIDMgU2lnbmluZyBLZXmJAjgEEwECACIFAlRsmtIC
+GwMGCwkIBwMCBhUIAgkKCwQWAgMBAh4BAheAAAoJEMsRyh0D+lCCAyUP/jM+dKCC
+WIjTAFzdudJFfznjFjiggI7EdNJYpMd3FP8Gq53qqFH5rvg0fwJjnNGPBpfEjhHM
+TlCNn3M0L6NZbB7PQwUBD332f2QwE4PIcuo1e7c9ySrhdMc0maR5+CcMlJHG6T8Q
+EacL+Xhc91GC2Gi/qMOjE4lo337Y3GLE6WHFRVvqBpI+ovr9LYKP5vQ+InY+uVsP
+LTL7AQVRDZcu4eQdI1HdJ0fYyhx5lJSiPWaM80VBkOgfF6HyGrMcjzWs+9gtYs76
+g6QoEKgu3YuPi1J1JE7d+Un7iYSqrUv3ljSDq2PMlx4vpq+oc1/1qHLyMYpGjmHa
+cQRjPo8bqgZ4vo6BC4Za+SGliLPcN9w0ivjsaGZ2L5PHxJ7kCSJ6SbZUrjWhTZL3
+arWGCFQmYqAY5EkNSWrQePgkCj/5I5YAou39LnREN91KgYDT8bMeED7uQ/fskRns
+Xfbx6ACsU69lLYIqd4HcuhcHWV9lTYtavjLKny71BauLALOve9uHmYX/cweBnt98
+8AWGuIuspvs3kwFJLu5k30m3HUMZPG8lDfN0R9v5eyoNxFc+WNbxHq4fIUXmbGfN
+Jclsn3hzUUS3XBG2G9VDmcf/N82xlwRMDHD78G/+Q3MumQeLtlXirhASQqi3XdXk
+CR5+NjOJZWRYfvk+WbJsshE3sosG2uLHzgs/iQIcBBABAgAGBQJUbJtEAAoJEN36
+Gj42h5SUuVsQAI5QPmqJvnUgUMzoj1gCWW2eJTbxTWs9jALN8JRqPGT4KKe+x5te
+IgYkK056WlxBA73UDcXLQ4dKoqF9J3wMF2O+Ir7C46p+dFS5KTjUj4vaYMgAmshu
+ihZmBChmldQpIYmFvWtdvdanEpaOiblr+AXK1Hd5aJrpBFf5I/EP7iCWeOXc5FzK
+UEZylf8PVmNO3s8uuyWMdGR7cGcukwOONzre9XurO6P8fHfjh+vXeI+5KsJ1Cd2y
+22OWAK0QjtCBLTQ4E6WUM2/FjLU55HB3fdAo4ucd2QgJhf4HuWq6KiLRz74O04o1
+lrqtS3M9GfLmQx/lUF8vIS4jVf8X7/iZY52VCJM5PDoeF0xKTACJ2+emuQfyw0SE
+7AfxCrt35cvXBWAzUN/kLFslQkBI+/FssnUDBYGeU+SkgEfkpuWwRsqfwCITN0I4
+jmwDfa+6PQpMF9lkgF+BanNa8bfroWztmW9dZYp6jyV8/VI5SeG7RYu6TZUeXXoS
+eMIL/d9eIhebLj5syd0BNukZMpI92wnSDWTWxBZFliltOIv6/yC6Bj7UaCyt2JkV
+/xbi+rOiemBS1mPHhV/CAM7sV0TM8xONyVXM4g5eVj0RStFYjc586ZguleNeIfYT
+qDqp/VUKnu6jYNOWS2W/kpenXId22X1TdXcxwm3U3kOc06pygu1fTdDp
+=idYC
+-----END PGP PUBLIC KEY BLOCK-----

misc/RPM-GPG-KEY-upgrade-qubes-3-unstable

@@ -0,0 +1,29 @@
+-----BEGIN PGP PUBLIC KEY BLOCK-----
+Version: GnuPG v1
+
+mQINBFRuA2sBEACjOSNmDK6g6vpirgy0mRbRORP44eI0R45JN3oSGgsmCD5jJSTo
+RRUE1RknbK26+bjnsKAKwpP67CA3So/5sa4l7i7G4xJdgVZooM3ZTK7ubQCqkMYB
+h4yYTBAtt7vi6olhKvEkCvhzozcUa4/qW/NuIuTCpF0G0kBUWyqqYQzwtWD5QimE
+6NjbxjuKf0P0KtzUvF2SdNYh87kXUj+6+RcA6VxjsLY3gSWnl+786L4yKUekRjB7
+JvD9yMd1V+U/P1MUamJFyn68Aih6dRi17/ZvHKHY0gj6k6acE34Oy6SDmbwuWWeZ
+jMpSACAHHhWJID0wwrig3ZsxV4lGWoND/n+OSmEyWg4J8dB1thZpoBgjL05prBgC
+oygzwyHlyewVqdtdjMJOSSk34pehQ35lPQ9XqASnF1igQaVTKFxUIg1eoaQMZibd
+dSJzEcwuFUeJ1S22lyUdtaC/WdGb5vvHSEDiOA/3Ll0gpaHm2tor08J0s9C6CD2Q
+irF/FwUu52yO/bNtOkXunX5G2Ua+c49o3D6bvc+mfBY4EVKN5k6URW+vy47gJDbH
+4CVcxgBRoFy8SdAogqf/H/4+UOAR5jo5QLzsRq0mRHRbleLHwyH5PQxF9M73UVgL
+J5OohzOoThyiWbIesjyFw9aiC1Dk9l6ugprPTAS6LPNpxNaByNlpbX/eJQARAQAB
+tCdRdWJlcyBPUyBSZWxlYXNlIDMgVW5zdGFibGUgU2lnbmluZyBLZXmJAjgEEwEC
+ACIFAlRuA2sCGwMGCwkIBwMCBhUIAgkKCwQWAgMBAh4BAheAAAoJEJP+RAmjx3Ot
+WFMP/1y98l3kXaIUIXZFjdtCmiZvFZKETP5S/81Rn32PISSs5TklxWbt6B3rNY67
+ovtK10qJXxarLeu0+IR+UM+AV1R/OvT3qtrJuvbbr0vIyy0RONaapoPIdI2eD2FC
+E/7JTv7KibKSE4nI9W9ZdRboJB1MPigffBR7qAC2ReCGtyKVUWRCKh57aQqbSDkZ
+AruTV1gXbFDusuKh1kQ2zVXFMn9KU98Qv0nKewjndNwnfOk7UFdsTkRCEyHr19wx
+KOuoLH4bfCyV8dEfriM5d6ABjmpv0Olp9XFT5YznoxrsXAjO0aUIBiNYYTk5vRLG
+ixBJGRjruDUzCZ8gIObIEwfAJsJ4LsFZ5LI0csF2uNueeogmNm0LfejyrWBlyRfW
+XdM5WP9vAbWectxNfaW84pPkvAEaer2W+x9ddO+FirTPNgU0M55JxcjKve8XsbuK
+iOA80h8eiMuukn2CDENVG9g7hiui9YzcenQKzmZIYYARWPzSKRyRrMFWrhDjOZ+R
+sG2PKzuJVIatGqhzqjD4CmoMPkVDli9p1ADOJLMJu062D53aWjgVi6DFHt5cZmFx
+rvDPiLqy/uuWWSDaDgX36KEenvwzQLjlEdTrN8a3qiBMxeceLWFLQqAknQnmU19/
+HcyP+lX0FzFFm1yIB/aEQpcXsfJcil0Dg6zAeFbXxdQYWlVm
+=7CDU
+-----END PGP PUBLIC KEY BLOCK-----

misc/apt-conf-70no-unattended

@@ -1,26 +0,0 @@
-## Based on pkg-manager-no-autoupdate by Patrick Schleizer <adrelanos@riseup.net>
-## https://github.com/Whonix/pkg-manager-no-autoupdate
-
-## Disable automatic update check APT::Periodic::Update-Package-Lists
-## which is the Debian default in /etc/apt/apt.conf.d/10periodic.
-##
-## The execution time would be too predictable, thus make us fingerprintable.
-##
-## 20noperiodic comes after 10periodic in alphabet so it takes precedence.
-##
-## Quoted from the Debian Handbook
-## http://debian-handbook.info/browse/wheezy/sect.apt-get.html
-##
-## "[...] Each directory represents a configuration file which is split over multiple
-## files. In this sense, all of the files in /etc/apt/apt.conf.d/ are instructions
-## for the configuration of APT. APT includes them in alphabetical order, so that the
-## last ones can modify a configuration element defined in one of the first ones. [...]
-##
-## That changes take effect can be verified using:
-## apt-config dump
-
-APT::Periodic::Update-Package-Lists "0";
-APT::Periodic::Download-Upgradeable-Packages "0";
-APT::Periodic::AutocleanInterval "0";
-APT::Periodic::Unattended-Upgrade "0";
-APT::Periodic::Enable "0";

misc/block-snapshot

@@ -0,0 +1,274 @@
+#!/bin/bash
+
+# Usage: block-snapshot add|remove img-file cow-file
+#
+# This creates dm-snapshot device on given arguments
+
+dir=$(dirname "$0")
+if [ "$1" = "prepare" ] || [ "$1" = "cleanup" ]; then
+  . "$dir/xen-hotplug-common.sh"
+  command=$1
+else
+  . "$dir/block-common.sh"
+fi
+
+shopt -s nullglob
+
+if [ -n "$XENBUS_PATH" ]; then
+  HOTPLUG_STORE="/var/run/xen-hotplug/${XENBUS_PATH//\//-}"
+fi
+
+get_dev() {
+  dev=$1
+
+  if [ -L "$dev" ]; then
+    dev=$(readlink -f "$dev") || fatal "$dev link does not exist."
+  fi
+
+  if [ -f "$dev" ]; then
+    file=$dev
+
+    loopdev=$(losetup -j $file | head -1 | cut -d : -f 1)
+    if [ -n "$loopdev" ]; then
+      # found existing loop to this file
+      echo $loopdev
+      return
+    fi
+
+    # assign new loop device
+    loopdev=$(losetup -f 2>/dev/null || find_free_loopback_dev)
+    if [ "$loopdev" = '' ]
+    then
+      release_lock "block"
+      fatal 'Failed to find an unused loop device'
+    fi
+
+    do_or_die losetup "$loopdev" "$file"
+    echo $loopdev
+  else
+    test -e "$dev" || fatal "$dev does not exist."
+    test -b "$dev" || fatal "$dev is not a block device nor file."
+  fi
+}
+
+get_dm_snapshot_name() {
+  base=$1
+  cow=$2
+
+  echo snapshot-$(stat -c '%D:%i' "$base")-$(stat -c '%D:%i' "$cow")
+}
+
+create_dm_snapshot() {
+  local base_dev cow_dev base_sz
+
+  dm_devname=$1
+  base=$2
+  cow=$3
+
+  if [ ! -e /dev/mapper/$dm_devname ]; then
+    # prepare new snapshot device
+    base_dev=$(get_dev $base)
+    cow_dev=$(get_dev $cow)
+    base_sz=$(blockdev --getsz $base_dev)
+    do_or_die dmsetup create $dm_devname --table "0 $base_sz snapshot $base_dev $cow_dev P 256"
+  fi
+
+}
+
+create_dm_snapshot_origin() {
+  local base_dev base_sz
+
+  dm_devname=$1
+  base=$2
+
+  if [ ! -e /dev/mapper/$dm_devname ]; then
+    # prepare new snapshot-origin device
+    base_dev=$(get_dev $base)
+    base_sz=$(blockdev --getsz $base_dev)
+    do_or_die dmsetup create $dm_devname --table "0 $base_sz snapshot-origin $base_dev"
+  fi
+}
+
+t=$(xenstore_read_default "$XENBUS_PATH/type" 'MISSING')
+
+case "$command" in
+  add)
+    case $t in
+      snapshot|origin)
+        p=$(xenstore_read_default "$XENBUS_PATH/params" 'MISSING')
+        if [ "$p" == "MISSING" ]; then
+          fatal "Missing device parameters ($t $XENBUS_PATH/params)"
+        fi
+        base=${p/:*/}
+        cow=${p/*:/}
+
+        if [ -L "$base" ]; then
+          base=$(readlink -f "$base") || fatal "$base link does not exist."
+        fi
+
+        if [ -L "$cow" ]; then
+          cow=$(readlink -f "$cow") || fatal "$cow link does not exist."
+        fi
+
+        # first ensure that snapshot device exists (to write somewhere changes from snapshot-origin)
+        dm_devname=$(get_dm_snapshot_name "$base" "$cow")
+
+        claim_lock "block"
+
+        # prepare snapshot device
+        create_dm_snapshot $dm_devname "$base" "$cow"
+
+        if [ "$t" == "snapshot" ]; then
+          #that's all for snapshot, store name of prepared device
+          xenstore_write "$XENBUS_PATH/node" "/dev/mapper/$dm_devname"
+          echo "/dev/mapper/$dm_devname" > "$HOTPLUG_STORE-node"
+          write_dev /dev/mapper/$dm_devname
+        elif [ "$t" == "origin" ]; then
+          # for origin - prepare snapshot-origin device and store its name
+          dm_devname=origin-$(stat -c '%D:%i' "$base")
+          create_dm_snapshot_origin $dm_devname "$base"
+          xenstore_write "$XENBUS_PATH/node" "/dev/mapper/$dm_devname"
+          echo "/dev/mapper/$dm_devname" > "$HOTPLUG_STORE-node"
+          write_dev /dev/mapper/$dm_devname
+        fi
+        # Save domain name for template commit on device remove
+        domain=$(xenstore_read_default "$XENBUS_PATH/domain" '')
+        if [ -z "$domain" ]; then
+          domid=$(xenstore_read "$XENBUS_PATH/frontend-id")
+          domain=$(xl domname $domid)
+        fi
+        echo $domain > "$HOTPLUG_STORE-domain"
+
+        release_lock "block"
+        exit 0
+        ;;
+    esac
+    ;;
+  prepare)
+    t=$2
+    case $t in
+      snapshot|origin)
+        p=$3
+        base=${p/:*/}
+        cow=${p/*:/}
+
+        if [ -L "$base" ]; then
+          base=$(readlink -f "$base") || fatal "$base link does not exist."
+        fi
+
+        if [ -L "$cow" ]; then
+          cow=$(readlink -f "$cow") || fatal "$cow link does not exist."
+        fi
+
+        # first ensure that snapshot device exists (to write somewhere changes from snapshot-origin)
+        dm_devname=$(get_dm_snapshot_name "$base" "$cow")
+
+        claim_lock "block"
+
+        # prepare snapshot device
+        create_dm_snapshot $dm_devname "$base" "$cow"
+
+        if [ "$t" == "snapshot" ]; then
+          #that's all for snapshot, store name of prepared device
+          echo "/dev/mapper/$dm_devname"
+        elif [ "$t" == "origin" ]; then
+          # for origin - prepare snapshot-origin device and store its name
+          dm_devname=origin-$(stat -c '%D:%i' "$base")
+          create_dm_snapshot_origin $dm_devname "$base"
+          echo "/dev/mapper/$dm_devname"
+        fi
+
+        release_lock "block"
+        exit 0
+        ;;
+    esac
+    ;;
+  remove|cleanup)
+    if [ "$command" = "cleanup" ]; then
+      t=$2
+    else
+      t=$(cat $HOTPLUG_STORE-type 2>/dev/null || echo 'MISSING')
+    fi
+    case "$t" in
+      snapshot|origin)
+        if [ "$command" = "cleanup" ]; then
+          node=$3
+        else
+          node=$(cat "$HOTPLUG_STORE-node" 2> /dev/null)
+        fi
+
+        if [ -z "$node" ]; then
+          #fatal "No device node to remove"
+          #Most likely already removed
+          exit 0
+        fi
+
+        if [ ! -e "$node" ]; then
+          fatal "Device $node does not exists"
+        fi
+
+        claim_lock "block"
+
+        use_count=$(dmsetup info $node|grep Open|awk '{print $3}')
+
+        # do not remove snapshot if snapshot origin is still present
+        if [ "${node/snapshot/}" != "$node" -a -e "/dev/mapper/origin-$(echo $node|cut -d- -f2)" ]; then
+          use_count=1
+        fi
+
+        if [ "$use_count" -gt 0 ]; then
+          log info "Device $node still in use - not removing"
+          release_lock "block"
+          exit 0
+        fi
+
+        # get list of used (loop) devices
+        deps="$(dmsetup deps $node | cut -d: -f2 | sed -e 's#(7, \([0-9]\+\))#/dev/loop\1#g')"
+
+        # if this is origin
+        if [ "${node/origin/}" != "$node" ]; then
+          # remove unused snapshots
+          for snap in /dev/mapper/snapshot-$(echo $node|cut -d- -f2)-*; do
+            use_count=$(dmsetup info $snap|grep Open|awk '{print $3}')
+            if [ "$use_count" -eq 0 ]; then
+              # unused snapshot - remove it
+              deps="$deps $(dmsetup deps $snap | cut -d: -f2 | sed -e 's#(7, \([0-9]\+\))#/dev/loop\1#g')"
+              log debug "Removing $snap"
+              dmsetup remove $snap
+            fi
+          done
+          if [ "$command" = "remove" ]; then
+            # Commit template changes
+            domain=$(cat "$HOTPLUG_STORE-domain")
+            if [ "$domain" ]; then
+              # Dont stop on errors
+              /usr/bin/qvm-template-commit "$domain" || true
+            fi
+          fi
+        fi
+
+        if [ -e $node ]; then
+          log debug "Removing $node"
+          dmsetup remove $node
+        fi
+
+        # try to free loop devices
+        for dev in $deps; do
+          if [ -b "$dev" ]; then
+            log debug "Removing $dev"
+            losetup -d $dev 2> /dev/null || true
+          fi
+        done
+
+        if [ -n "$HOTPLUG_STORE" ]; then
+          rm $HOTPLUG_STORE-*
+        fi
+        release_lock "block"
+
+        exit 0
+        ;;
+    esac
+    ;;
+esac
+
+# vim:sw=2:et:

misc/dconf-db-local-dpi

@@ -1,2 +0,0 @@
-[org/gnome/desktop/interface]
-scaling-factor=uint32 1

misc/dconf-profile-user

@@ -1,2 +0,0 @@
-user-db:user
-system-db:local

misc/dispvm-prerun.sh

@@ -0,0 +1,37 @@
+#!/bin/sh
+
+apps="/usr/libexec/evinced"
+
+#If user have customized DispVM settings, use its home instead of default dotfiles
+if [ ! -e /home/user/.qubes-dispvm-customized ]; then
+	if [ -e /rw/home/user/.qubes-dispvm-customized ]; then
+		cp -af /rw/home/user /home/
+	else
+		cat /etc/dispvm-dotfiles.tbz | tar -xjf- --overwrite -C /home/user --owner user 2>&1 >/tmp/dispvm-dotfiles-errors.log
+	fi
+fi
+
+for app in $apps ; do
+    echo "Launching: $app..."
+    $app >>/tmp/dispvm_prerun_errors.log 2>&1 &
+done
+
+echo "Sleeping..."
+PREV_IO=0
+while true; do
+	IO=`vmstat -D | awk '/read|write/ {IOs+=$1} END {print IOs}'`
+	if [ $IO -lt $(( $PREV_IO + 50 )) ]; then
+		break;
+	fi
+	PREV_IO=$IO
+	sleep 2
+done
+
+ps aufwwx > /tmp/dispvm-prerun-proclist.log
+
+echo "Closing windows..."
+/usr/lib/qubes/close-window `xwininfo -root -children|tail -n +7 |awk '{print $1}'`
+sleep 1
+fuser -vkm /rw
+
+echo done.

misc/dnf-qubes-hooks.py

@@ -20,10 +20,8 @@
 #
 
 from __future__ import absolute_import
-from distutils.version import LooseVersion
 import logging
 import dnf
-import dnf.const
 import subprocess
 
 PLUGIN_CONF = 'qubes-hooks'
@@ -37,10 +35,7 @@ class QubesHooks(dnf.Plugin):
         self.log = logging.getLogger('dnf')
 
     def transaction(self):
-        if LooseVersion(dnf.const.VERSION) < '2.0.0':
+        config = self.read_config(self.base.conf, PLUGIN_CONF)
-            config = self.read_config(self.base.conf, PLUGIN_CONF)
-        else:
-            config = self.read_config(self.base.conf)
 
         if config.getboolean('main', 'notify-updates'):
             # Get all updates available _before_ this transaction
@@ -61,5 +56,6 @@ class QubesHooks(dnf.Plugin):
                 str(len(updates))
             ])
 
-        self.log.info("Notifying dom0 about installed applications")
+        if config.getboolean('main', 'sync-appmenus'):
-        subprocess.call(['/etc/qubes-rpc/qubes.PostInstall'])
+            self.log.info("Sending application list and icons to dom0")
+            subprocess.call(['/usr/lib/qubes/qubes-trigger-sync-appmenus.sh'])

misc/fstab

@@ -1,10 +1,9 @@
 # Accessible filesystems, by reference, are maintained under '/dev/disk'
 # See man pages fstab(5), findfs(8), mount(8) and/or blkid(8) for more info
 #
-/dev/mapper/dmroot /                       ext4 defaults,discard,noatime        1 1
+/dev/mapper/dmroot /                       ext4 defaults,noatime        1 1
 /dev/xvdb		/rw			auto	noauto,defaults,discard	1 2
 /rw/home        /home       none    noauto,bind,defaults 0 0
-/rw/usrlocal        /usr/local       none    noauto,bind,defaults 0 0
 /dev/xvdc1      swap                    swap    defaults        0 0
 tmpfs                   /dev/shm                tmpfs   defaults,size=1G        0 0
 devpts                  /dev/pts                devpts  gid=5,mode=620  0 0

misc/grub.qubes

@@ -1,12 +0,0 @@
-# make sure to use /dev/mapper/dmroot, not /dev/xvda directly - both have the
-# same fs, including UUID
-GRUB_DISABLE_LINUX_UUID=true
-GRUB_DISABLE_OS_PROBER=true
-GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX root=/dev/mapper/dmroot console=hvc0 console=tty0"
-# make SWIOTLB smaller - it isn't really needed unless PCI passthrough is used,
-# and even then, 16MB is enough
-GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX swiotlb=8192"
-# add noresume - to avoid a 30 second hang on Debian HVM boot as it tries to
-# locate swap space for hibernation
-GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX noresume"
-GRUB_TIMEOUT=0

misc/qubes-desktop-run

@@ -1,6 +1,6 @@
 #!/usr/bin/python
 
-from qubesagent.xdg import launch
+from qubes.xdg import launch
 import sys
 
 if __name__ == '__main__':

misc/qubes-download-dom0-updates.sh

@@ -2,12 +2,11 @@
 
 DOM0_UPDATES_DIR=/var/lib/qubes/dom0-updates
 
+DOIT=0
 GUI=1
 CLEAN=0
 CHECK_ONLY=0
 OPTS="--installroot $DOM0_UPDATES_DIR --config=$DOM0_UPDATES_DIR/etc/yum.conf"
-# DNF uses /etc/yum.repos.d, even when --installroot is specified
-OPTS="$OPTS --setopt=reposdir=$DOM0_UPDATES_DIR/etc/yum.repos.d"
 PKGLIST=
 YUM_ACTION=
 
@@ -16,7 +15,7 @@ export LC_ALL=C
 while [ -n "$1" ]; do
     case "$1" in
         --doit)
-            # ignore
+            DOIT=1
             ;;
         --nogui)
             GUI=0
@@ -51,11 +50,11 @@ if [ -z "$YUM_ACTION" ]; then
 fi
 
 YUM="yum"
-if type dnf >/dev/null 2>&1; then
+# prefer yum-deprecated over dnf, because of still missing features in dnf (at least --downloaddir)
-    YUM="dnf --best --allowerasing --noplugins"
+if type dnf >/dev/null 2>&1 && type yum-deprecated >/dev/null 2>&1; then
-else
+    echo "(Note: dnf will complain that the yum command has been deprecated." >&2
-    # salt in dom0 thinks it's using dnf but we only have yum so need to remove extra options
+    echo "This message is safe to ignore.)" >&2
-    OPTS="${OPTS/--best --allowerasing/}"
+    YUM="yum-deprecated"
 fi
 
 if ! [ -d "$DOM0_UPDATES_DIR" ]; then
@@ -64,6 +63,7 @@ if ! [ -d "$DOM0_UPDATES_DIR" ]; then
 fi
 
 mkdir -p $DOM0_UPDATES_DIR/etc
+sed -i '/^reposdir\s*=/d' $DOM0_UPDATES_DIR/etc/yum.conf
 
 if [ -e /etc/debian_version ]; then
     # Default rpm configuration on Debian uses ~/.rpmdb for rpm database (as
@@ -76,72 +76,65 @@ rm -f $DOM0_UPDATES_DIR/var/lib/rpm/__*
 rpm --root=$DOM0_UPDATES_DIR --rebuilddb
 
 if [ "$CLEAN" = "1" ]; then
-    # shellcheck disable=SC2086
     $YUM $OPTS clean all
-    rm -f "$DOM0_UPDATES_DIR"/packages/*
+    rm -f $DOM0_UPDATES_DIR/packages/*
-    rm -rf "$DOM0_UPDATES_DIR"/var/cache/yum/*
 fi
 
-# just check for updates, but don't download any package
+if [ "x$PKGLIST" = "x" ]; then
-if [ "x$PKGLIST" = "x" ] && [ "$CHECK_ONLY" = "1" ]; then
     echo "Checking for dom0 updates..." >&2
-    # shellcheck disable=SC2086
+    UPDATES_FULL=`$YUM $OPTS check-update`
-    UPDATES_FULL=$($YUM $OPTS check-update)
     check_update_retcode=$?
-    if [ "$check_update_retcode" -eq 1 ]; then
+    UPDATES_FULL=`echo "$UPDATES_FULL" | grep -v "^Loaded plugins:\|^$"`
+    if [ $check_update_retcode -eq 1 ]; then
         # Exit here if yum have reported an error. Exit code 100 isn't an
         # error, it's "updates available" info, so check specifically for exit code 1
         exit 1
     fi
-    if [ $check_update_retcode -eq 100 ]; then
+    UPDATES=`echo "$UPDATES_FULL" | grep -v "^Obsoleting\|Could not" | cut -f 1 -d ' '`
-        echo "Available updates: "
+    if [ -z "$UPDATES" -a $check_update_retcode -eq 100 ]; then
-        echo "$UPDATES_FULL"
+        # save not empty string for below condition (-z "$UPDATES"), but blank
-        exit 100
+        # to not confuse the user wwith magic strings in messages
-    else
+        UPDATES=" "
-        echo "No new updates available"
-        if [ "$GUI" = 1 ]; then
-            zenity --info --text="No new updates available"
-        fi
-        exit 0
     fi
+else
+    PKGS_FROM_CMDLINE=1
 fi
 
-# now, we will download something
+if [ -z "$PKGLIST" -a -z "$UPDATES" ]; then
-YUM_COMMAND="fakeroot $YUM $YUM_ACTION -y --downloadonly"
+    echo "No new updates available"
+    if [ "$GUI" = 1 ]; then
+        zenity --info --text="No new updates available"
+    fi
+    exit 0
+fi
+
+if [ "$CHECK_ONLY" = "1" ]; then
+    echo "Available updates: "
+    echo "$UPDATES_FULL"
+    exit 100
+fi
+
+if [ "$DOIT" != "1" -a "$PKGS_FROM_CMDLINE" != "1" ]; then
+    zenity --question --title="Qubes Dom0 updates" \
+      --text="There are updates for dom0 available, do you want to download them now?" || exit 0
+fi
+
+YUM_COMMAND="fakeroot $YUM $YUM_ACTION -y --downloadonly --downloaddir=$DOM0_UPDATES_DIR/packages"
 # check for --downloadonly option - if not supported (Debian), fallback to
 # yumdownloader
 if ! $YUM --help | grep -q downloadonly; then
-    if [ "$YUM_ACTION" = "install" ]; then
+    if [ "$YUM_ACTION" != "install" -a "$YUM_ACTION" != "upgrade" ]; then
-        YUM_COMMAND="yumdownloader --destdir=$DOM0_UPDATES_DIR/packages --resolve"
+        echo "ERROR: yum version installed in VM `hostname` does not suppport --downloadonly option" >&2
-    elif [ "$YUM_ACTION" = "upgrade" ]; then
-        # shellcheck disable=SC2086
-        UPDATES_FULL=$($YUM $OPTS check-update $PKGLIST)
-        check_update_retcode=$?
-        UPDATES_FULL=$(echo "$UPDATES_FULL" | grep -v "^Loaded plugins:\|^Last metadata\|^$")
-        UPDATES=$(echo "$UPDATES_FULL" | grep -v "^Obsoleting\|Could not" | cut -f 1 -d ' ')
-        if [ "$check_update_retcode" -eq 0 ]; then
-            # exit code 0 means no updates available - regardless of stdout messages
-            echo "No new updates available"
-            exit 0
-        fi
-        PKGLIST=$UPDATES
-        YUM_COMMAND="yumdownloader --destdir=$DOM0_UPDATES_DIR/packages --resolve"
-    elif [ "$YUM_ACTION" == "list" ] || [ "$YUM_ACTION" == "search" ]; then
-        # those actions do not download any package, so lack of --downloadonly is irrelevant
-        YUM_COMMAND="$YUM $YUM_ACTION -y"
-    elif [ "$YUM_ACTION" == "reinstall" ]; then
-        # this is just approximation of 'reinstall' action...
-        # shellcheck disable=SC2086
-        PKGLIST=$(rpm --root=$DOM0_UPDATES_DIR -q $PKGLIST)
-        YUM_COMMAND="yumdownloader --destdir=$DOM0_UPDATES_DIR/packages --resolve"
-    else
-        echo "ERROR: yum version installed in VM $(hostname) does not suppport --downloadonly option" >&2
         echo "ERROR: only 'install' and 'upgrade' actions supported ($YUM_ACTION not)" >&2
         if [ "$GUI" = 1 ]; then
             zenity --error --text="yum version too old for '$YUM_ACTION' action, see console for details"
         fi
         exit 1
     fi
+    if [ "$YUM_ACTION" = "upgrade" ]; then
+        PKGLIST=$UPDATES
+    fi
+    YUM_COMMAND="yumdownloader --destdir=$DOM0_UPDATES_DIR/packages --resolve"
 fi
 
 mkdir -p "$DOM0_UPDATES_DIR/packages"
@@ -150,25 +143,20 @@ set -e
 
 if [ "$GUI" = 1 ]; then
     ( echo "1"
-    # shellcheck disable=SC2086
     $YUM_COMMAND $OPTS $PKGLIST
     echo 100 ) | zenity --progress --pulsate --auto-close --auto-kill \
          --text="Downloading updates for Dom0, please wait..." --title="Qubes Dom0 updates"
 else
-    # shellcheck disable=SC2086
     $YUM_COMMAND $OPTS $PKGLIST
 fi
 
-find "$DOM0_UPDATES_DIR/var/cache/yum" -name '*.rpm' -print0 |\
+if ls $DOM0_UPDATES_DIR/packages/*.rpm > /dev/null 2>&1; then
-    xargs -0 -r ln -f -t "$DOM0_UPDATES_DIR/packages/"
-
-if ls "$DOM0_UPDATES_DIR"/packages/*.rpm > /dev/null 2>&1; then
     cmd="/usr/lib/qubes/qrexec-client-vm dom0 qubes.ReceiveUpdates /usr/lib/qubes/qfile-agent"
     qrexec_exit_code=0
-    $cmd "$DOM0_UPDATES_DIR"/packages/*.rpm || { qrexec_exit_code=$? ; true; };
+    $cmd $DOM0_UPDATES_DIR/packages/*.rpm || { qrexec_exit_code=$? ; true; };
     if [ ! "$qrexec_exit_code" = "0" ]; then
         echo "'$cmd $DOM0_UPDATES_DIR/packages/*.rpm' failed with exit code ${qrexec_exit_code}!" >&2
-        exit "$qrexec_exit_code"
+        exit $qrexec_exit_code
     fi
 else
     echo "No packages downloaded"

misc/qubes-master-key.asc

@@ -1,29 +0,0 @@
------BEGIN PGP PUBLIC KEY BLOCK-----
-Version: GnuPG v1
-
-mQINBEu0kPkBEADHOaL53AVx8ECt+vsTFpNv/oyDXXs8dNmMsQhaCQ7BxTu95QKD
-j5S0TiFoXegBwE8YhRg/8sBHOUbmdD1iQHxJSlJc8NYJkctq4KjiyeshquT1mIYx
-wTGSuagX2PbM+Sv6Cuyo/DyhmzIH5dssFH25qnQ/RwednxWMG9qBW2JujDdwlMjB
-1p6u5lzkwECO0Kk8w7rvSMJwPo2FPTpSTcdN7+Yc1i7WEv1fOpNYBfEn76Eck3LP
-dndceRxnErvkEH7K95R1wEOqXxOEjE3BoUqh7q40GDW6bBMV5EauLBgMX4DQRIDE
-uU0NW5Kk29/8RZaZrRXmpVmof1dMYVBWu4wM+Khm3IZ30pUR188jZz+eUhPDieJL
-lN3iRKikSv7Rm9SETmwvvVOpP+RfkfaS6XGu3XfSv1diLy00p6Eh9J6LsfiCRuCI
-svADNHsyFxJkIwEGVkUgvPFCRDY73LQuV5Bt5gutPFVnVS5nM9pwQEBFAha8wB5N
-L+0fq47a1NJFbmKQ5PzOom3qQjee/3ic4wPcf9YtmLOdxukIEXvrGtcMt2kQHC9a
-YypW/AYQB/TxpLP/aXSHiO9bR4hA4au26d6ytsgCZpPVQ5WchYetTVXfcjv6mbCS
-g/QFYx1Ss/lZ2Uao/w7eYdAlvvJ1JBYotuMLuiONReRHGY5I94H8RRju8wARAQAB
-tBhRdWJlcyBNYXN0ZXIgU2lnbmluZyBLZXmJAjgEEwECACIFAku0kPkCGwMGCwkI
-BwMCBhUIAgkKCwQWAgMBAh4BAheAAAoJEN36Gj42h5SU17kP/2sF0pzYETEJykY8
-MTfHpey+eAjP6Ejt2mkasiFMEIZ0mjFt9A/7I4gYgiI1pNRat2icbjK0HmUDSHzo
-LRjCcuP39D5LRdoFMzMzXusHx7pCKkx9rvitOq/p4LN+O6orCJYhHN7Si3LXWYv6
-5HG9iGbeE262myPb43KTBbNF5recwkHZTufNMISGQiSkwFOPRbBX7q2c3/qHjmiw
-RZ16DRSY1xHaV1HVplaDSCIXYcDhWsywB+5iuUFDsZGmfCncR7SZ00eSWpKVB5mp
-P9vlk0Tri28dQWqfd63rDU9ZwxFpZfL+hlhA0W07np6L3yyai+jzaWFY7VsqdOnp
-zBJe8sveMr8SP0QhrGEL0aj/R9XPKgfYm5wlf1qJ/Z/10jJm8D0MTMUxPUI07Hja
-u5lIW7GZKFdI5DWt/JTvy3FJp0yDajaUOc84l5wJKl7cNCmeZH1/oNYkAb+JqqGX
-/VPWEot7fOaqUrHswsE/YKK+9fv/aMY6qjF7qVGAfbd04kAZuPha7/s3USbdiRA7
-aJapZ/mtaUY+P9k1j/dI8sOPpxgl4c6esIBhwe5Sv3HUZc5SZhW3h1ISScvoeYTV
-KLRIi9ELMmsqfESjDhnDbVsqIjL8+kKxegaRXwNxeZoe7EfiL8PKSJMSbaIhXLFC
-QUkIyUJmS9aV8bQN8vheR4JNciA0
-=5mf9
------END PGP PUBLIC KEY BLOCK-----

misc/qubes-r3.list.in

@@ -0,0 +1,15 @@
+# Main qubes updates repository
+deb [arch=amd64] http://deb.qubes-os.org/r3.1/vm @DIST@ main
+#deb-src http://deb.qubes-os.org/r3.1/vm @DIST@ main
+
+# Qubes updates candidates repository
+#deb [arch=amd64] http://deb.qubes-os.org/r3.1/vm @DIST@-testing main
+#deb-src http://deb.qubes-os.org/r3.1/vm @DIST@-testing main
+
+# Qubes security updates testing repository
+#deb [arch=amd64] http://deb.qubes-os.org/r3.1/vm @DIST@-securitytesting main
+#deb-src http://deb.qubes-os.org/r3.1/vm @DIST@-securitytesting main
+
+# Qubes experimental/unstable repository
+#deb [arch=amd64] http://deb.qubes-os.org/r3.1/vm @DIST@-unstable main
+#deb-src http://deb.qubes-os.org/r3.1/vm @DIST@-unstable main

misc/qubes-r3.repo

@@ -0,0 +1,31 @@
+[qubes-vm-r3.1-current]
+name = Qubes OS Repository for VM (updates)
+baseurl = http://yum.qubes-os.org/r3.1/current/vm/fc$releasever
+gpgkey = file:///etc/pki/rpm-gpg/RPM-GPG-KEY-qubes-3-primary
+skip_if_unavailable=False
+gpgcheck = 1
+enabled=1
+
+[qubes-vm-r3.1-current-testing]
+name = Qubes OS Repository for VM (updates-testing)
+baseurl = http://yum.qubes-os.org/r3.1/current-testing/vm/fc$releasever
+gpgkey = file:///etc/pki/rpm-gpg/RPM-GPG-KEY-qubes-3-primary
+skip_if_unavailable=False
+gpgcheck = 1
+enabled=0
+
+[qubes-vm-r3.1-security-testing]
+name = Qubes OS Repository for VM (security-testing)
+baseurl = http://yum.qubes-os.org/r3.1/security-testing/vm/fc$releasever
+gpgkey = file:///etc/pki/rpm-gpg/RPM-GPG-KEY-qubes-3-primary
+skip_if_unavailable=False
+gpgcheck = 1
+enabled=0
+
+[qubes-vm-r3.1-unstable]
+name = Qubes OS Repository for VM (unstable)
+baseurl = http://yum.qubes-os.org/r3.1/unstable/vm/fc$releasever
+gpgkey = file:///etc/pki/rpm-gpg/RPM-GPG-KEY-qubes-3-unstable
+gpgcheck = 1
+enabled=0
+

misc/qubes-r4.list.in

@@ -1,33 +0,0 @@
-# Main qubes updates repository
-deb [arch=amd64] http://deb.qubes-os.org/r4.0/vm @DIST@ main
-#deb-src http://deb.qubes-os.org/r4.0/vm @DIST@ main
-
-# Qubes updates candidates repository
-#deb [arch=amd64] http://deb.qubes-os.org/r4.0/vm @DIST@-testing main
-#deb-src http://deb.qubes-os.org/r4.0/vm @DIST@-testing main
-
-# Qubes security updates testing repository
-#deb [arch=amd64] http://deb.qubes-os.org/r4.0/vm @DIST@-securitytesting main
-#deb-src http://deb.qubes-os.org/r4.0/vm @DIST@-securitytesting main
-
-# Qubes experimental/unstable repository
-#deb [arch=amd64] http://deb.qubes-os.org/r4.0/vm @DIST@-unstable main
-#deb-src http://deb.qubes-os.org/r4.0/vm @DIST@-unstable main
-
-
-# Qubes Tor updates repositories
-# Main qubes updates repository
-#deb [arch=amd64] http://deb.sik5nlgfc5qylnnsr57qrbm64zbdx6t4lreyhpon3ychmxmiem7tioad.onion/r4.0/vm @DIST@ main
-#deb-src http://deb.sik5nlgfc5qylnnsr57qrbm64zbdx6t4lreyhpon3ychmxmiem7tioad.onion/r4.0/vm @DIST@ main
-
-# Qubes updates candidates repository
-#deb [arch=amd64] http://deb.sik5nlgfc5qylnnsr57qrbm64zbdx6t4lreyhpon3ychmxmiem7tioad.onion/r4.0/vm @DIST@-testing main
-#deb-src http://deb.sik5nlgfc5qylnnsr57qrbm64zbdx6t4lreyhpon3ychmxmiem7tioad.onion/r4.0/vm @DIST@-testing main
-
-# Qubes security updates testing repository
-#deb [arch=amd64] http://deb.sik5nlgfc5qylnnsr57qrbm64zbdx6t4lreyhpon3ychmxmiem7tioad.onion/r4.0/vm @DIST@-securitytesting main
-#deb-src http://deb.sik5nlgfc5qylnnsr57qrbm64zbdx6t4lreyhpon3ychmxmiem7tioad.onion/r4.0/vm @DIST@-securitytesting main
-
-# Qubes experimental/unstable repository
-#deb [arch=amd64] http://deb.sik5nlgfc5qylnnsr57qrbm64zbdx6t4lreyhpon3ychmxmiem7tioad.onion/r4.0/vm @DIST@-unstable main
-#deb-src http://deb.sik5nlgfc5qylnnsr57qrbm64zbdx6t4lreyhpon3ychmxmiem7tioad.onion/r4.0/vm @DIST@-unstable main

misc/qubes-r4.repo.in

@@ -1,35 +0,0 @@
-[qubes-vm-r4.0-current]
-name = Qubes OS Repository for VM (updates)
-baseurl = https://yum.qubes-os.org/r4.0/current/vm/@DIST@$releasever
-#baseurl = http://yum.sik5nlgfc5qylnnsr57qrbm64zbdx6t4lreyhpon3ychmxmiem7tioad.onion/r4.0/current/vm/@DIST@$releasever
-gpgkey = file:///etc/pki/rpm-gpg/RPM-GPG-KEY-qubes-4-primary
-skip_if_unavailable=False
-gpgcheck = 1
-enabled=1
-
-[qubes-vm-r4.0-current-testing]
-name = Qubes OS Repository for VM (updates-testing)
-baseurl = https://yum.qubes-os.org/r4.0/current-testing/vm/@DIST@$releasever
-#baseurl = http://yum.sik5nlgfc5qylnnsr57qrbm64zbdx6t4lreyhpon3ychmxmiem7tioad.onion/r4.0/current-testing/vm/@DIST@$releasever
-gpgkey = file:///etc/pki/rpm-gpg/RPM-GPG-KEY-qubes-4-primary
-skip_if_unavailable=False
-gpgcheck = 1
-enabled=0
-
-[qubes-vm-r4.0-security-testing]
-name = Qubes OS Repository for VM (security-testing)
-baseurl = https://yum.qubes-os.org/r4.0/security-testing/vm/@DIST@$releasever
-#baseurl = http://yum.sik5nlgfc5qylnnsr57qrbm64zbdx6t4lreyhpon3ychmxmiem7tioad.onion/r4.0/security-testing/vm/@DIST@$releasever
-gpgkey = file:///etc/pki/rpm-gpg/RPM-GPG-KEY-qubes-4-primary
-skip_if_unavailable=False
-gpgcheck = 1
-enabled=0
-
-[qubes-vm-r4.0-unstable]
-name = Qubes OS Repository for VM (unstable)
-baseurl = https://yum.qubes-os.org/r4.0/unstable/vm/@DIST@$releasever
-#baseurl = http://yum.sik5nlgfc5qylnnsr57qrbm64zbdx6t4lreyhpon3ychmxmiem7tioad.onion/r4.0/unstable/vm/@DIST@$releasever
-gpgkey = file:///etc/pki/rpm-gpg/RPM-GPG-KEY-qubes-4-unstable
-gpgcheck = 1
-enabled=0
-

misc/qubes-run-terminal

@@ -1,12 +0,0 @@
-#!/bin/sh
-# Try to find a terminal emulator that's installed and run it.
-
-for terminal in x-terminal-emulator gnome-terminal xfce4-terminal konsole urxvt rxvt termit terminator Eterm aterm roxterm termite lxterminal mate-terminal terminology st xterm; do
-    # bogus warning from ShellCheck < 0.5.0
-    # shellcheck disable=SC2039
-    if type "$terminal" >/dev/null 2>&1 ; then
-        exec "$terminal"
-    fi
-done
-
-echo "ERROR: No suitable terminal found." >&2

misc/qubes-run-terminal.desktop

@@ -1,5 +0,0 @@
-[Desktop Entry]
-Name=Run Terminal
-Exec=qubes-run-terminal
-Icon=utilities-terminal
-Type=Application

misc/qubes-serial-login

@@ -1,6 +1,6 @@
 #!/bin/sh
 if /bin/ls -l /proc/self/fd/0 | grep -q /dev/hvc0 ; then
-	exec su - "$2"
+	exec su - $2
 	exit
 else
 	exec /bin/login "$@"

misc/qubes-session-autostart

@@ -25,7 +25,7 @@ import subprocess
 import sys
 
 from xdg.DesktopEntry import DesktopEntry
-from qubesagent.xdg import launch
+from qubes.xdg import launch
 import xdg.BaseDirectory
 import os
 
@@ -76,7 +76,7 @@ def process_autostart(environments):
                 else:
                     entry = DesktopEntry(entry_path)
                 if entry_should_be_started(entry, environments):
-                    launch(entry_path, wait=False)
+                    launch(entry_path)
             except Exception as e:
                 print >>sys.stderr, "Failed to process '{}': {}".format(
                     entry_name, str(e)

misc/qubes-suspend-module-blacklist

@@ -4,5 +4,3 @@
 
 ehci_pci
 xhci_pci
-iwldvm
-iwlmvm

misc/qubes-trigger-sync-appmenus.action

@@ -0,0 +1 @@
+*:any:/usr/lib/qubes/qubes-trigger-sync-appmenus.sh

misc/qubes-trigger-sync-appmenus.sh

@@ -1,9 +1,7 @@
-#!/bin/bash
+#!/bin/sh
 
-# Source Qubes library.
+UPDATEABLE=`qubesdb-read /qubes-vm-updateable`
-# shellcheck source=init/functions
-. /usr/lib/qubes/init/functions
 
-if is_updateable ; then
+if [ "$UPDATEABLE" = "True" ]; then
     /usr/lib/qubes/qrexec-client-vm dom0 qubes.SyncAppMenus /bin/sh /etc/qubes-rpc/qubes.GetAppmenus
 fi

misc/qubes-upgrade.repo

@@ -0,0 +1,20 @@
+[qubes-upgrade-vm-current]
+name = Qubes OS Repository for VM (updates)
+baseurl = http://yum.qubes-os.org/r3.2/current/vm/fc$releasever
+gpgkey = file:///etc/pki/rpm-gpg/RPM-GPG-KEY-upgrade-qubes-3-primary
+gpgcheck = 1
+
+[qubes-upgrade-vm-current-testing]
+name = Qubes OS Repository for VM (updates-testing)
+baseurl = http://yum.qubes-os.org/r3.2/current-testing/vm/fc$releasever
+gpgkey = file:///etc/pki/rpm-gpg/RPM-GPG-KEY-upgrade-qubes-3-primary
+gpgcheck = 1
+enabled=0
+
+[qubes-upgrade-vm-unstable]
+name = Qubes OS Repository for VM (unstable)
+baseurl = http://yum.qubes-os.org/r3.2/unstable/vm/fc$releasever
+gpgkey = file:///etc/pki/rpm-gpg/RPM-GPG-KEY-upgrade-qubes-3-unstable
+gpgcheck = 1
+enabled=0
+

misc/qubes.sudoers

@@ -25,8 +25,9 @@ user ALL=(ALL) NOPASSWD: ALL
 # and for sure, root/user isolation is not a mitigating factor.
 #
 # Because, really, if somebody could find and exploit a bug in the Xen
-# hypervisor -- as of 2016, there have been only three publicly disclosed
+# hypervisor -- so far there has been only one (!) publicly disclosed
-# exploitable bugs in the Xen hypervisor from a VM -- then it would be
+# exploitable bug in the Xen hypervisor from a VM, found in 2008,
+# incidentally by one of the Qubes developers (RW) -- then it would be
 # highly unlikely that that person couldn't also find a user-to-root
 # escalation in the VM (which as we know from history of UNIX/Linux
 # happens all the time).

misc/qvm-features-request

@@ -1,81 +0,0 @@
-#!/usr/bin/env python2
-# vim: fileencoding=utf-8
-
-#
-# The Qubes OS Project, https://www.qubes-os.org/
-#
-# Copyright (C) 2010-2016  Joanna Rutkowska <joanna@invisiblethingslab.com>
-# Copyright (C)      2016  Wojtek Porczyk <woju@invisiblethingslab.com>
-#
-# This program is free software; you can redistribute it and/or modify
-# it under the terms of the GNU General Public License as published by
-# the Free Software Foundation; either version 2 of the License, or
-# (at your option) any later version.
-#
-# This program is distributed in the hope that it will be useful,
-# but WITHOUT ANY WARRANTY; without even the implied warranty of
-# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-# GNU General Public License for more details.
-#
-# You should have received a copy of the GNU General Public License along
-# with this program; if not, write to the Free Software Foundation, Inc.,
-# 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
-#
-
-import argparse
-import os
-import subprocess
-import sys
-
-import qubesdb
-
-class FeatureRequestAction(argparse.Action):
-    '''Action for argument parser that stores a property.'''
-    # pylint: disable=redefined-builtin,too-few-public-methods
-    def __init__(self,
-            option_strings,
-            dest='features',
-            metavar='NAME=VALUE',
-            required=False,
-            help='request a feature with the value'):
-        super(FeatureRequestAction, self).__init__(option_strings, dest=dest,
-            metavar=metavar, nargs='*', required=required, default={},
-            help=help)
-
-    def __call__(self, parser, namespace, values, option_string=None):
-        for request in values:
-            try:
-                feature, value = request.split('=', 1)
-            except ValueError:
-                parser.error(
-                    'invalid feature request token: {!r}'.format(request))
-
-            getattr(namespace, self.dest)[feature] = value
-
-
-parser = argparse.ArgumentParser(
-    description='submit a feature request to the dom0')
-
-parser.add_argument('--commit',
-    action='store_true', default=False,
-    help='actually send the request (without it, only make entries in qubesdb)')
-
-parser.add_argument('features',
-    action=FeatureRequestAction)
-
-
-def main(args=None):
-    args = parser.parse_args(args)
-
-    qdb = qubesdb.QubesDB()
-    for feature, value in args.features.items():
-        qdb.write('/features-request/' + feature, value)
-
-    if args.commit:
-        devnull = os.open(os.devnull, os.O_RDWR)
-        subprocess.check_call(
-            ['qrexec-client-vm', 'dom0', 'qubes.FeaturesRequest'],
-            stdin=devnull, stdout=devnull)
-
-if __name__ == '__main__':
-    sys.exit(main())

misc/resize-rootfs

@@ -1,42 +0,0 @@
-#!/bin/sh
-
-set -e
-
-dm_major=$(printf %x "$(grep device-mapper /proc/devices | cut -f 1 -d ' ')")
-case "$(stat -Lc %t:%T /dev/mapper/dmroot)" in
-    ca:0)
-        # nothing needed, xvda used directly
-        ;;
-    ca:3)
-        # resize partition table itself
-        # use undocumented ---pretend-input-tty (yes, three '-') to
-        # force unattended operation, otherwise it aborts on first
-        # prompt, even with '-s' option
-        echo fix | parted ---pretend-input-tty /dev/xvda print >/dev/null
-        # then resize 3rd partition, even though it is mounted
-        echo yes 100% | parted ---pretend-input-tty /dev/xvda resizepart 3
-        # and reload partition table; prefer partprobe over blockdev
-        # --rereadpt, as it works on mounted partitions
-        partprobe /dev/xvda
-        ;;
-    ca:*)
-        echo "Unsupported partition layout, resize it manually" >&2
-        exit 1
-        ;;
-    $dm_major:*)
-        new_size=$(cat /sys/block/xvda/size)
-        ro=$(cat /sys/block/xvda/ro)
-        if [ "$ro" -eq 1 ]; then
-            new_table="0 $new_size snapshot /dev/xvda /dev/xvdc2 N 16"
-        else
-            new_table="0 $new_size linear /dev/xvda 0"
-        fi
-        dmsetup load dmroot --table "$new_table"
-        dmsetup resume dmroot
-        ;;
-    *)
-        echo "Unsupported device type for root volume, resize it manually" >&2
-        exit 1
-        ;;
-esac
-resize2fs /dev/mapper/dmroot

misc/thunar.xml

@@ -1,5 +0,0 @@
-<?xml version="1.0" encoding="UTF-8"?>
-
-<channel name="thunar" version="1.0">
-  <property name="misc-thumbnail-mode" type="string" value="THUNAR_THUMBNAIL_MODE_NEVER"/>
-</channel>

misc/uca_qubes.xml

@@ -1,85 +0,0 @@
-<action>
-	<icon>folder-copy</icon>
-	<name>Copy to VM</name>
-	<unique-id>1507455450991127-4</unique-id>
-	<command>/usr/lib/qubes/qvm-actions.sh copy %F</command>
-	<description></description>
-	<patterns>*</patterns>
-	<directories/>
-	<audio-files/>
-	<image-files/>
-	<other-files/>
-	<text-files/>
-	<video-files/>
-</action>
-<action>
-	<icon>folder-move</icon>
-	<name>Move to VM</name>
-	<unique-id>1507455437157027-3</unique-id>
-	<command>/usr/lib/qubes/qvm-actions.sh move %F</command>
-	<description></description>
-	<patterns>*</patterns>
-	<directories/>
-	<audio-files/>
-	<image-files/>
-	<other-files/>
-	<text-files/>
-	<video-files/>
-</action>
-<action>
-	<icon>document-open</icon>
-	<name>Open in VM</name>
-	<unique-id>1507455471075266-5</unique-id>
-	<command>/usr/lib/qubes/qvm-actions.sh openvm %F</command>
-	<description></description>
-	<patterns>*</patterns>
-	<audio-files/>
-	<image-files/>
-	<other-files/>
-	<text-files/>
-	<video-files/>
-</action>
-<action>
-	<icon>gtk-convert</icon>
-	<name>Convert in DisposableVM</name>
-	<unique-id>1507455488971315-6</unique-id>
-	<command>/usr/lib/qubes/qvm-actions.sh pdf %F</command>
-	<description></description>
-	<patterns>*.pdf</patterns>
-	<other-files/>
-</action>
-<action>
-	<icon>gtk-convert</icon>
-	<name>Convert in DisposableVM</name>
-	<unique-id>1507455503129941-7</unique-id>
-	<command>/usr/lib/qubes/qvm-actions.sh img %F</command>
-	<description></description>
-	<patterns>*</patterns>
-	<image-files/>
-</action>
-<action>
-	<icon>document-open</icon>
-	<name>Edit in DisposableVM</name>
-	<unique-id>1507455559234996-8</unique-id>
-	<command>/usr/lib/qubes/qvm-actions.sh opendvm %F</command>
-	<description></description>
-	<patterns>*</patterns>
-	<audio-files/>
-	<image-files/>
-	<other-files/>
-	<text-files/>
-	<video-files/>
-</action>
-<action>
-	<icon>document-open</icon>
-	<name>View in DisposableVM</name>
-	<unique-id>1507455559234997-9</unique-id>
-	<command>/usr/lib/qubes/qvm-actions.sh viewdvm %F</command>
-	<description></description>
-	<patterns>*</patterns>
-	<audio-files/>
-	<image-files/>
-	<other-files/>
-	<text-files/>
-	<video-files/>
-</action>

misc/upgrades-installed-check

@@ -9,7 +9,6 @@
 
 if [ -e /etc/system-release ]; then
    ## Fedora
-   # shellcheck disable=SC2034
    yum_output="$(yum -q check-update 2>&1)"
    exit_code="$?"
    [ "$exit_code" -eq 100 ] && echo "false" && exit 0
@@ -18,18 +17,9 @@ elif [ -e /etc/debian_version ]; then
    ## Debian
    set -e
    set -o pipefail
-   # shellcheck disable=SC2034
+   apt_get_output="$(LANG="C" apt-get -s upgrade 2>&1)"
-   apt_get_update_output="$(apt-get -q update 2>&1)"
-   apt_get_upgrade_output="$(LANG="C" apt-get -s upgrade 2>&1)"
    exit_code="$?"
-   echo "$apt_get_upgrade_output" | awk "/^Inst/{ print $2 }" | [ "$(wc -L)" -eq 0 ] && echo "true" || echo "false"
+   echo "$apt_get_output" | awk "/^Inst/{ print $2 }" | [ "$(wc -L)" -eq 0 ] && echo "true" || echo "false"
-elif [ -e /etc/arch-release ]; then
-    ## Archlinux
-    set -e
-    set -o pipefail
-    checkupdates_output="$(checkupdates 2>&1)"
-    exit_code="$?"
-    echo "$checkupdates_output" | grep -qF -- '->' && echo "false" || echo "true"
 else
    echo "Check not implemented for this distribution" >&2
    exit 1

misc/vusb-ctl.py

@@ -0,0 +1,24 @@
+#!/usr/bin/python
+
+##
+## Python script wrapper around xen.util.vusb_util bind_usb_device() and unbind_usb_device() methods
+## Run as root in usbvm
+##
+
+from xen.util import vusb_util
+import sys
+import os
+
+if len(sys.argv)!=3:
+    print 'usage: vusb-ctl <bind|unbind> device'
+    sys.exit(1)
+
+device=sys.argv[2]
+if sys.argv[1] == 'bind':
+    vusb_util.bind_usb_device(device)
+elif sys.argv[1] == 'unbind':
+    vusb_util.unbind_usb_device(device)
+else:
+    print "Invalid command, must be 'bind' or 'unbind'"
+    sys.exit(1)
+