-
-
Notifications
You must be signed in to change notification settings - Fork 48
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Prepare R4.0 -> R4.1 upgrade procedure #5685
Comments
Here is example |
This set of packages will allow running rpm 4.14 in a fc25-based dom0 (R4.0), which is necessary to update to fc31-based dom0 (R4.1). QubesOS/qubes-issues#5685
Procedure I followed to achieve successful upgrade: For dom0 update itself:
And then to fix grub's not being there:
|
@fepitre can you write a script that handle the grub part? |
Sure. |
This set of packages will allow running rpm 4.14 in a fc25-based dom0 (R4.0), which is necessary to update to fc31-based dom0 (R4.1). QubesOS/qubes-issues#5685
This allows using various --with/--without options (or rather --define="_with_* 1" and --define="_without_* 1" - for which --with/--without are aliases). For now it is used only for package rebuilt from a different Fedora version (linux-dom0-updates repo). Adjust also legacy build code that calls dnf builddep manually - here is why it needs to be --define. Change dependencies handling for src.rpm there, to extract spec file and operate on it directly, because otherwise --define options takes no effect (dnf normally looks at src.rpm dependencies in the header, not within the spec file). This issue does not apply to mock, because mock first rebuilds src.rpm package, including various --define. QubesOS/qubes-issues#5685
This set of packages will allow running rpm 4.14 in a fc25-based dom0 (R4.0), which is necessary to update to fc31-based dom0 (R4.1). QubesOS/qubes-issues#5685
New repositories require rpm 4.14 (packages compressed with zstd) and also new rpm requires qubes-core-dom0-linux >= 4.0.23 (different output in rpm -K). Prevent installing new qubes-release unless those other updates are installed too. Otherwise updating the system will stop working. QubesOS/qubes-issues#5685
I'm still using legacy boot, so updating dom0 went swimmingly, after I noticed I had to adjust the repo links in /etc/yum.repos.d/qubes-dom0.repo (to fc31) after step 5. updating fedora-30 template led to some issues as dnf refused to update xen-libs because of dependencies, didn't pursue that very far because I already had a fedora-31-xfce template configured. |
That's probably because of not updated qubes-release package. Do you know what qubes-release package version you had at that step (was it updated in step 5 or not)? |
I seem to recall seeing a package with 4.1 in the name, but not sure, sorry |
There are some upgrade problems described in a duplicate issue here: #4867 |
I will add that the upgrade process should fail-safe ― if there is a failure during install, the system should still be usable. |
Generally yes (and the script already tries to do that), but making a backup before is still recommended. |
Left after upgrade to fc32: fedora-obsolete-packages All are listed under 'removing dependent packages' when running qubes-dom0-update, yet all are left in place. |
During
|
Upgrade path to fc32 depends on a packaging change in python-systemd-234-4. Otherwise python2-systemd conflicts with python3-systemd on files, but lack appropriate package metadata about it. QubesOS/qubes-issues#5685
- legacy file pool on LVM - Debian (default one, and 10) as default template, including sys-net and sys-firewall QubesOS/qubes-issues#5685
The updatevm already downloads packages only (either using --downloadonly option internally, or using yumdownloader). The option from the user matters for the dnf call in dom0 only. Especially, sending --downloadonly breaks downloading updates via debian-10, which uses yumdownloader, as it doesn't have --downloadonly option. This is mostly relevant for R4.0 -> R4.1 upgrade (and maybe some future too?), as the process uses --downloadonly option internally. QubesOS/qubes-issues#5685
The updatevm already downloads packages only (either using --downloadonly option internally, or using yumdownloader). The option from the user matters for the dnf call in dom0 only. Especially, sending --downloadonly breaks downloading updates via debian-10, which uses yumdownloader, as it doesn't have --downloadonly option. This is mostly relevant for R4.0 -> R4.1 upgrade (and maybe some future too?), as the process uses --downloadonly option internally. QubesOS/qubes-issues#5685 (cherry picked from commit 0018597)
I tried to get it working with debian-10 as updatevm, but sadly the changes required are too severe. In short: yumdownloader cannot parse "rich dependencies", which are used in some newer packages, and there is no way to get dnf into debian-10. So, I'll adjust the tool to complain early about this case, and let the user change updatevm (template) while it is still possible. |
I recommend taking a (LVM or BTRFS) snapshot of the dom0 root filesystem, so that in the event of a disaster the user has a chance to recover. |
It may help in some situations, but actually not that many. To restore from such snapshot, you'd need to reboot. At this point (when recovering from failed stage 4), you'll have all the templates and standalones already upgraded to R4.1, and it won't be compatible with reverted dom0 (we provide only backward compatibility, not forward compatibility, and both GUI and qrexec protocols have changed). So, you may get dom0 back to running, but not much more. You could try to restore templates from snapshots too, if you really want (and have one)... The dist upgrade tool tries to check assumptions before performing the upgrade and refuse to continue when there is still a chance (this now includes all the cases reported in this issue too). And it also prints a huge warning about doing the backup before. The cases that are easy to recover are handled already, but otherwise the recommended way is to either retry directly (which should work if the failure was some intermittent download issue), or reinstall (possibly R4.1 already) and restore from backup - like in the other upgrade procedure. |
I wonder if we should intentionally reboot dom0 after upgrading it, and only upgrade the templates and standalones afterwards. What do you think? |
That could work, but it would make the upgrade process less convenient. Currently we exploit the fact that running VMs still works even after upgrading their templates, to perform the upgrade in the opposite order, requiring just one reboot instead of two. This way, you can call |
Personally, I consider the improved reliability to be worthwhile. Rebooting dom0 after a successful upgrade means that we can take a snapshot of the dom0 filesystem before the upgrade, and revert to it if the upgrade fails. We could also use Fedora’s offline system upgrade feature. We can also clone at least one of the templates before upgrading them, ensuring that the user will always be able to recover their system. |
While some of those ideas are okay, it is way too late to do major restructure of the upgrade process, that has been confirmed to work for many users already. Please propose such major structure changes earlier, when we'll prepare upgrades for R4.2. |
I think I've managed to upgrade qvm-appmenus before the 4.0 -> 4.1 dist upgrade, which breaks the dist upgrade.
|
@ViliusSutkus89: Please note that the issue tracker ( |
@andrewdavidwong Oh no, I don't need help or tech support, I just wanted to report a possible failure scenario. No idea why I didn't open a new issue. Sorry about that. BTW, Qubes is extra cool, thanks for working on this project. |
Prepare and test the upgrade procedure, this will be similar to https://www.qubes-os.org/doc/upgrade-to-r3.2/
Things that will need a special care:
Based on the above, tasks here:
upgrade LUKS1 header to LUKS2impossible from a running system, and benefits too small to fight with offline approachqvm-appmenus --all --update
at the end/etc/yum.repos.d/qubes-dom0.repo.rpmnew
(otherwise "STAGE 4" won't use fc32 repos)xl info
before reboot may not work - save it at the beginning of upgrade?All of the above should be reasonably safe to use - scripts should check assumptions before continuing and better refuse to start (for example on custom partition layout that don't have space for separate /boot) than to leave the system with broken bootloader.
Also, upgrade procedure should document supported configurations.
The text was updated successfully, but these errors were encountered: