#Qubes os for macbook air how to
#Qubes os for macbook air install
#Qubes os for macbook air update
#Qubes os for macbook air manual
#Qubes os for macbook air Offline

My thoughts on the general approach of your proposed solution are written above in the section вЂњManually Scripted Downloader and/or Installer of Update FilesвЂќ. Potentially, a pre-existing script from a more knowledgeable expert would work fine here, and maybe some of the built-in protection mechanisms of Qubes, Fedora, Debian, etc would help to mitigate exploits upon installation of updates, but I know there have been several issues with update vulnerabilities that Qubes has even recently had to independently harden its update process against, so to not only rely upon Fedora/DNF etc.Д«rainhack - Thanks for your ideas.

#Qubes os for macbook air how to

Experts might know how to manually process or script each step along the way without risk, but I donвЂ™t expect to become an expert in this subject matter any time soon. Additionally, my concern is with the security/authentication/verification of the updates.

Depending on the method of implementation, there may be a higher cost in the initial configuration/scripting setup. Manually Scripted Downloader and/or Installer of Update Files: While this could seemingly work, this approach seems to have even more downsides and costs to it. Not a huge cost, but some cost, if a more ideal UpdateVM cache canвЂ™t be easily achieved.

#Qubes os for macbook air Offline

However, the cost involved would be the initial configuration and maintaining the web server setup that provides this mirror service between online and offline networks. This seems to be the 2nd most straight forward solution. Running a Mirror Updates Web Server: IвЂ™m not familiar enough with Linux distro update authentication processes, but since many people/organisations create public HTTP update mirrors, then it should seemingly work to host the same type of HTTP update mirror on the LAN-network and point the Dom0 & Template repo files to the LAN-network IP address of oneвЂ™s own update mirror web server. Regarding other approaches, here are some of my thoughts: Maybe rustybirdвЂ™s вЂњqubes-updates-cacheвЂќ or unmanвЂ™s вЂњapt-cacher-ngвЂќ programs (linked below) could achieve this? I donвЂ™t know if such a Qubes-compatible UpdateVM caching program exists or not. Theoretically, the recommended more-secure вЂњsaltвЂќ based method of running Qubes updates should work with such an imported UpdateVM cache too. Then one would just run an additional/clone online Qubes computer without holding any user data inside run all of the Qubes Dom0 & Qubes Template package updates have the UpdateVM catch/cache them inside of itself, then backup, transfer, restore this entire Qubes UpdateVM to the air-gapped Qubes computer and then on the air-gapped Qubes computer run the normal Qubes update process through this restored UpdateVM with cached metadata and package files for all Dom0 & Template packages.

UpdateVM with Offline Caching: The most straight-forward solution would theoretically be to drop a caching program inside of the Qubes UpdateVM that catches all metadata and package files in a way that can be used for updating offline after shutdown/restart of the VM.

IвЂ™ve done a bit more thinking about general approaches: Thank you all so far for the ideas and insights. Has Qubes air-gapped/net-gapped updates even been solved/implemented before by someone?ДЄny advice/insights or specific solutions/instructions you may have for implementing updates for an air-gapped/network-gapped Qubes computer would be great. IвЂ™m speculating at this point, and am not familiar with how to actually achieve this. Theoretically the Qubes updates process would use this local web server as the update server without issues? Setup an updates web server mirror on the LAN that connects to Qubes and distro update servers, rsyncs all the update files, and then somehow setup local DNS to route updates to this.

#Qubes os for macbook air install

Then backup/restore that cache/UpdateVM via something like a USB thumbdrive, and have the air-gapped Qubes computer use it to install updates from.Д¬. Implement some kind of updates caching system on another Qubes computer that stores all the update files (maybe inside of a Qubes UpdateVM?).

#Qubes os for macbook air manual

Could script this to make more convenient than manual process.Д«. Would seemingly only work for templates though, and not Dom0. Update Qubes templates on another Qubes computer and backup/restore these templates via something like a USB thumbdrive. HereвЂ™s some general potential approaches I have thought of:ДЄ. I have a secure Qubes computer that is on an isolated LAN network (network-gapped) and am wondering how would be the best way to regularly update it, including updates Qubes Dom0 and Qubes Templates (Debian, Fedora, Whonix, etc), with the stipulation that this Qubes computer cannot ever connect out to the live internet.