qubesos/qubes-issues#1029

It doesn't work with HVMs - more precisely with (ancient) qemu in
stubdomain.

Apparently even iptables-restore does not handle concurrent firewall
updates. This is especially...

The later one is present only in latest iptables version - especially
debian does not have it. B...

Do not try to enable qubes-update-check.service, it is meant to be
started by qubes-update-check...

Even when iptables.service is configured to use different file, the
service would not start when...

On Fedora 21 (and probably others) /etc/localtime is no longer file
copy, but a symlink to origi...

Instead of overriding /etc/sysconfig/ip{,6}tables, store qubes rules in
/etc/sysconfig/iptables....

Otherwise some GUI applications would not start.

Restore support for older yum: no --downloadonly option, so use
yumdownloader.
Also add some a c...

Tag for commit 0ccd2c9a98d8f5fa33a91cf8dd534aa24e266671

# gpg: Signature made Wed 10 Jun 2015 1...

Add Build-Depends: lsb-release, which is used for that.

Fixes qubesos/qubes-issues#1002

Especially when some new service was introduced in the meantime. For
example this happened betwe...

This will allow a service to be overridden per-VM.

Debian template doesn't have this directory by default.

Tag for commit 15459b0e820f66aae9a304b1ca17e69fde770d2a

# gpg: Signature made Fri 01 May 2015 1...

There is a possiblilty of the apt-get post hook getting triggered
more than once for each apt-ge...

Tag for commit 21d89335fe6243cced992e96f8cc9b1dab6e1055

# gpg: Signature made Sat Apr 25 09:44:...

A file is created in /var/lib/qubes/protected-files. Scripts can grep this file before ...

vif-route-qubes can be called simultaneously, for example in case of:
- multiple domains startu...

$(( )) is POSIX syntax for shell arithmetic operations. Especially dash
(default shell in Debian...

Hide unneeded messages.

Offline resize requires to run fsck -f first. Because we support only
growing that image, we can...

Apparently it doesn't help much with DispVM startup time, but causes a
lot of problems when such...

Especially dnf-makecache is senseless as its state will not survive VM
restart, but it takes a l...

This will probably break some user configuration. Do that only when
installing for the first tim...

This umask will be inherited by any process started directly by qrexec
(i.e. without help of for...

This way the services will be enabled/disabled regardless of its initial
state.

Especially add unmanaged-devices, otherwise NM will break vif*
configuration.

systemctl is-enabled always reports "disabled" for them (actually not a
real "disabled", but and...

misc/close-window.c requires it.

Simply forget about that connection, instead of waiting for further
messages. If that connection...

Otherwise Qubes-specific configuration will not be placed at all (in
Fedora 21, which provide so...

This is required to run sudo from qubes-rpc.

/usr/local resides in private.img, so it is possible to define per-appvm RPC

Also, with the upc...

We no longer provide this module (it looks to be a dead project).
Instead in newer kernel USBIP ...

Besides obvious profits, it also enables some additional compiler
warnings.

Additional running shell could prevent EOF from being detected.

This will allow to use some different shell/language for a service (for
example python).

This would prevent qrexec from detecting EOF.

In case of remote process exit even when some messages are still
waiting, vchan connection can b...

Child process can request to use single socket for both stdin and
stdout by sending SIGUSR1 sign...

If remote end terminates without proper protocol finish
(MSG_DATA_EXIT_CODE), terminate also loc...

This doesn't cover all the cases, because local process could want to
receive that value (curren...

This way qrexec-client-vm will have much more information, at least:
- will know whether the se...

qubesdb-daemon will handle reconnection by itself.

Also make the code more readable.

Many services depended on misc-post only because this was where /home
gets mounted. Move that to...

Closing some invisible window can cause e.g. Firefox crash. Send the
message to visible windows ...

Now gui agent support reconnecting to guid.

Do not longer rely on killing X server.

Tag for commit da2b0cde16fbe33b3ad1df26537db337414dc8d3

# gpg: Signature made Fri Feb 27 22:19:...

dpkg/rpm should handle this automatically on upgrading package

nautilus-actions was orphaned in fc21, so all nautilus context menus have
been re-written as nau...