* origin/pr/437:
Clean up network/network-manager-prepare-conf-dir
Set correct SELinux conte...

Add missing double quotes, use POSIX sed -E instead of sed -r, and call
sed once instead of twice.

This is needed for disposable sys-net to work properly. Without it
/rw is not labeled correctly...

Shell tests for file and directory existence coerce errors (I/O error,
permission denied, no mem...

evolution-data-center provides calendar support for GNOME Shell in a
default Fedora installation...

Tracker has several problems that make it ill-suited to Qubes OS:

- It parses untrusted email a...

Debian does not define default application, so the choice is a bit
random (in practice - lexicog...

Fix checking if dom0's (bdb format) rpmdb is newer than converted one
(sqlite format in either /...

* origin/pr/444:
Fix qubes-antispoof.service

* origin/pr/441:
Do not fail if address already exists

The Before= should be in the Unit section, not Service one.

It will ease upgrades, as the key will differ between versions, so
having different names allows...

It will ease upgrades, as the key will differ between versions, so
having different names allows...

This patch fixes network uplink failures on Fedora 37 and Debian 11 VMs
with only one vCPU. The...

* origin/pr/440:
Drop requirement on iptables

* origin/pr/439:
Hide ibus icon by default

iptables is not used any more.

Fixes: QubesOS/qubes-issues#5301
Fixes: QubesOS/qubes-issues#8346

Having an ibus tray icon from every (Debian bookworm) qube pollutes the
tray a lot. Disable it.
...

This is needed so that e.g. disposable VM templates imported from R4.1
work, even if the disposa...

* origin/pr/413:
Fix a few bugs in vm-file-editor

* origin/pr/432:
Use network-pre.target to order firewall before network uplink

network-pre.target is intended to be ordered after any service that sets
up a firewall and befor...

pkg.repo._repo.getMirrors() returns only mirrors from metalink, if there
is none, the return is ...

* origin/pr/414:
Remove qvm_caja_bookmark.sh
Remove an unused define
Obtain default user f...

* origin/pr/434:
(Re-)enable override-redirect windows in xfce4-notifyd

* origin/pr/433:
Ensure correct labeling of ~/QubesIncoming

SYSTEMD_WANTS= does not conflict with existing systemd jobs. Therefore,
if a stop job is in pro...

Upstream decided to not use override-redirect windows for notifications
and use _MOTIF_WM_HINTS ...

This requires using the special HOME_DIR keyword in the .fc file and
ensuring that the appropria...

It hardcoded /home/user and was never called.

The DVM_SPOOL define was not used anywhere and hard-coded /home/user as
the default user home di...

The default user is not guaranteed to be "user". Stop assuming that it
is.

User home directories are reserved for users. Modifying them from
package maintainer scripts is...

* origin/pr/422:
Jail qfile-unpacker in an SELinux sandbox

This unbreaks container networking, wireless hotspots, and much more.

Reported-by: Frédéric Pie...

* origin/pr/428:
Revert "Remount /lib/modules in early boot"
Allow kernel threads to set arb...

This is needed for labels to be properly fixed on upgrade.

They should be initrc_exec_t, but due to an incorrect regular expression
this did not happen. [...

It causes problems in practice with at least some kernel configurations,
and a51ccccead445cc2154...

kernel_t can read, write, create, and delete all files and device nodes
on the system, so preven...

* origin/pr/426:
qubes.WaitForSession: no need to specify machine

* origin/pr/425:
Remount /lib/modules in early boot

* origin/pr/424:
Include Ubuntu packages repo and its key

It doesn't have required dependencies (python-caja).

There will be repo for ubuntu packages at debu.qubes-os.org

Do not fail package installation in chroot (like during template build
or in CI) - there, system...

Closes https://github.com/QubesOS/qubes-issues/issues/8205

This unbreaks writing to /lib/modules with SELinux enforcing.

Reported-by: Marek Marczykowski-G...

* origin/pr/423:
Disable blueman applet by default
qubes-session-autostart: fix processing d...

* origin/pr/407:
Remove an unneded use of cat
Add permanent neighbor entries again
Replace...

* origin/pr/419:
Xen hotplug scripts should be initrc_exec_t

Add a generic wrapper that starts a given process only if specific
qvm-service is enabled. This ...

Consider dropins also for the actual entry startup, not only when
evaluating startup condition. ...

It is useless without bluetooth controller (most qubes), and without
loaded rfkill module (also ...

This prevents it from writing outside of ~/QubesIncoming. It would be
preferable to prevent it ...

* origin/pr/421:
Update archlinux python version dependency to <3.12

It's '@default' for a long time already.

* origin/pr/420:
Unify and improve wording on copy/move to other qube

Tiny speedup; otherwise no functional change.

Previously, neighbor discovery used ARP or NDP, both of which have
nonzero attack surface. Addi...

nftables is the modern replacement for iptables. It has more features
and is actively maintaine...

Use qube instead of VM/AppVM, use the same wording everywhere
and move from every-word-capitized...

This makes them unconfined while ensuring that programs they spawn have
the correct (possibly co...

No functional change intended.

* origin/pr/416:
archlinux: support for new packaging in legacy builder
Rework Archlinux pac...

- Do not hard-code username "user" or home directory "/home/user"
- Check for errors properly

The issue is fixed upstream already.

This reverts commit 0707922bb4a6aa5475289905ce37e8b0cbd8b635.

https://about.codecov.io/blog/message-regarding-the-pypi-package/

Workaround for https://bugzilla.redhat.com/show_bug.cgi?id=2185490

QubesOS/qubes-issues#8069

Trigger qubes.PostInstall not only when desktop file gets
installed/changed, but also when qrexe...

This is especially relevant for older dom0 (in R4.1) - otherwise once
converted rpmdb won't be u...

* origin/pr/380:
Update debian rules file to include pythonver for caja
Update rpm spec to i...

This allows GUI tools to warn about outdated version (for example template imported
from older i...

Let dom0 know which services are supported without trying to call them.
This allows better error...

* origin/pr/408:
Add -h and --help to qvm-copy

* origin/pr/404:
qvm-connect-tcp: print usage on invalid parameters

* origin/pr/403:
Do not install SELinux-related services on Debian

* origin/pr/383:
Enable IPv6 Privacy Extension by default

Fixes: QubesOS/qubes-issues#8023

This will ease setting dependencies so the group is created before
installing packages with file...

When dom0 gets updated to newer Fedora, its rpmdb is in
/usr/lib/sysimage/rpm. Handle this case ...

In init/functions line 153:
x=${1%%$3*}
^-- SC2295 (info): Expansions inside ${.....