decide availability of Kicksecure, and Whonix 18 (Debian trixie based) on Qubes R4.2 versus R4.3

[adrelanos]

Kicksecure, and Whonix 18 (Debian trixie based) are in development. As a developer, I guesstimate that hopefully a release can be made within the next approximately 2 weeks. (Please don't quote me on it.)

Would it be sufficient if Kicksecure, and Whonix 18 are made available for Qubes R4.3 only?

I.e. would be it be OK if Kicksecure, and Whonix 18 would not be made available for Qubes R4.2?

That would simplify development, maintenance, testing.

Primarily, pull request QubesOS/qubes-core-admin-addon-whonix#21 has been merged for Qubes R4.3 but we didn't backport it to Qubes R4.2 yet.

This would cause qrexec sdwdate.ConnectCheck denied messages on Qubes R4.2.

What's the guestimate for the Qubes R4.3 release date?

Related tickets:

• Add qubes-core-admin-addon-kicksecure to Qubes repositories #10020
• Kicksecure inside Debian Template sdwdate qrexec Denied message #7447

Related:

• Kicksecure Support Schedule
• Whonix Support Schedule

[adrelanos]

Another reason for R4.3 only:

• add IPv6 support to Qubes-Whonix #9267

[marmarek]

tl;dr: should be okay depending on Whonix 17 security support.

What's the guestimate for the Qubes R4.3 release date?

We are at -rc1, with -rc2 planned early next week. Based on bug reports, I guess there will be also -rc3, but probably not more than that. Which means final release in about 7-8 weeks.

After final R4.3 release, R4.2 is going to be still supported for 6 months. Can we arrange to have security support for Whonix 17 (and Kicksecure 17) until that? Ideally it would be normal support, but IMO it should be okay to limit it to security only too. Historically I think there weren't many security issues (in Whonix/Kicksecure specific packages) that would need to be backported, so hopefully this doesn't mean much work for you.

[adrelanos]

Alright, the goal is to provide support until Qubes R4.2 is deprecated.

The full wording in the wiki has been updated:

• Kicksecure: Support Schedule
• Whonix: Support Schedule

As for security support:

• Version 17: The goal is to provide support as long as Qubes R4.2 receives security support from Qubes and Debian.
• Version 18: Will be recommended as soon as it is available, even if Qubes R4.3 is only available as RC (release candidate).

Responsible for:

• Debian security issues -> Debian project
• Qubes security issues -> Qubes project
• Kicksecure security issues -> Kicksecure project
• Whonix security issues -> Whonix project

(That is in the footnote.)

As for "support", which can mean many things:
We'll need to keep instructions on wiki pages such as Qubes/Install functional for users for Qubes R4.2.

I am not worried about security support. Remote (or locally) exploitable security issues found in Kicksecure/Whonix source code hasn't happened in the past so is not expected to happen a lot in the future for oldstable support.

Major complication, work might result from maintaining documentation for both Qubes R4.2 and Qubes R4.3 and maybe from replying to user questions in the forums.

Release upgrade (upgrading version 17 on Qubes R4.2 in-place) using our release-upgrade script may also be complicated as it would require upgrading to version 18 and Qubes R4.3 at the same time.

[adrelanos]

This has been decided. Closing.

Follow-up ticket:

• Update Kicksecure and Whonix builds for Qubes R4.3 to Kicksecure and Whonix 18 #10253