Upgrading to f43 fails if protonVPN is installed via ujust

[upper arrow]

I'm running silverblue-nvidia-open-hardened and have protonvpn installed via ujust. rpm-ostree upgrade results in the following error message:

 Problem: package proton-vpn-gnome-desktop-0.9.0-1.fc43.noarch from protonvpn-fedora-stable requires proton-vpn-daemon, but none of the providers can be installed
  - conflicting requests
  - package proton-vpn-daemon-0.13.4-1.fc43.noarch from protonvpn-fedora-stable is filtered out by exclude filtering```

@mighty laurel

sorry, pinged the wrong person. @real wolf

[real wolf]

So I tried uninstalling Proton VPN before upgrading, and it did actually work, I'm on Fedora 43 now. However, now, I cannot reinstall Proton VPN (same issue seemingly?).

[dense sphinx]

what's the issue

oh

[torn juniper]

It looks like they had an exclusive package list in the secureblue 42 version then removed it in 43

[dense sphinx]

filtered out by exclude filtering

[torn juniper]

Redo the ujust commands for the repo

[dense sphinx]

@real wolf can you run grep exclude /etc/yum.repos.d/*.repo

[torn juniper]

This is the 42 config which didn't include the daemon.

gpgcheck = 1
repo_gpgcheck = 1
gpgkey = https://repo.protonvpn.com/fedora-$releasever-stable/public_key.asc
includepkgs = proton-vpn-gnome-desktop,proton-vpn-gtk-app,protonvpn-stable-release,python3-proton-core,python3-proton-keyring-linux,python3-proton-vpn-api-core,python3-proton-vpn-local-agent,python3-proton-vpn-network-manager

Removing includepkgs and the lines after should fix it right?

[dense sphinx]

?

@real wolf is still seeing the issue after upgrading

so there's something deeper

[torn juniper]

The repo config would not have been automatically updated

It would still keep the fedora 42 repo config before you fixed it?

[dense sphinx]

the repo files are updated

which file are you referring to

[torn juniper]

etc/yum.repos.d/protonvpn-stable.repo

[dense sphinx]

yeah it's fine on f43

#
# ProtonVPN stable release
#
[protonvpn-fedora-stable]
name = ProtonVPN Fedora Stable repository
baseurl = https://repo.protonvpn.com/fedora-$releasever-stable
enabled = 0
gpgcheck = 1
repo_gpgcheck = 1
gpgkey = https://repo.protonvpn.com/fedora-$releasever-stable/public_key.asc

[torn juniper]

I know

I'm saying it may have kept from 42 or they are running 42

[dense sphinx]

@torn juniper they said they are on f43

it would only retain the old file if it was modified

@real wolf did you modify it

and can you cat the file please

[torn juniper]

That's what I am thinking

Sorry didn't convey it well

[upper arrow]

I haven't tried to uninstall, upgrade, and reinstall the vpn yet. Should I? What command should I run to uninstall protonvpn?

[dense sphinx]

no reason not to imo

pretty normal need during major version changes

[upper arrow]

I uninstalled the vpn using rpm-ostree uninstall proton-vpn-gnome-desktop, ran ostree upgrade and am now on f43. will try installing the vpn again in a sec

same error when running ujust install-vpn

Resolving dependencies... done
error: Could not depsolve transaction; 1 problem detected:
 Problem: package proton-vpn-gnome-desktop-0.9.0-1.fc43.noarch from protonvpn-fedora-stable requires proton-vpn-daemon, but none of the providers can be installed
  - conflicting requests
  - package proton-vpn-daemon-0.13.4-1.fc43.noarch from protonvpn-fedora-stable is filtered out by exclude filtering
Error: The installation didn't complete successfully, aborting...
error: Recipe `install-vpn` failed with exit code 1

[torn juniper]

Can you run:
cat /etc/yum.repos.d/protonvpn-stable.repo

[upper arrow]

#
# ProtonVPN stable release
#
[protonvpn-fedora-stable]
name = ProtonVPN Fedora Stable repository
baseurl = https://repo.protonvpn.com/fedora-$releasever-stable
enabled=1
gpgcheck = 1
repo_gpgcheck = 1
gpgkey = https://repo.protonvpn.com/fedora-$releasever-stable/public_key.asc
includepkgs = proton-vpn-gnome-desktop,proton-vpn-gtk-app,protonvpn-stable-release,python3-proton-core,python3-proton-keyring-linux,python3-proton-vpn-api-core,python3-proton-vpn-local-agent,python3-proton-vpn-network-manager

[torn juniper]

@dense sphinx knew it, still retaining old repo config.

[dense sphinx]

this will fix it run0 cp /usr/etc/yum.repos.d/protonvpn-stable.repo /etc/yum.repos.d/protonvpn-stable.repo

[dense sphinx]

yeah mustve been modified

[upper arrow]

Ran the command and then re-ran ujust install-vpn. works now 👍

[torn juniper]

Yeah not sure on the cause either

[dense sphinx]

potentially the ujust itself

[torn juniper]

I think so

Looks like bazzite may have had similar problems in the past

I think it only gets reapplied when run but there needs to be some sort of undo first or something idk. Its 5am I need to look into it after sleep.

[upper arrow]

I also see these errors upon booting after upgrading to f43

Still able to boot fine after a second or two though

[dense sphinx]

weird. we saw this but fixed it... or so I thought

@dense garden fyi

[upper arrow]

the desktop background also disappeared when I first upgraded to f43, but that's an easy fix lol

[dense garden]

yeah that's weird, that issue should be fixed already

the error is harmless though

[dense garden]

also yes, this is the issue, if someone's enabled a VPN using the ujust script then that VPN's repo gets modified

[dense sphinx]

what was the fix? there were so many.... lol

we did this https://github.com/secureblue/secureblue/pull/1498/files but that's for hardened_malloc

oh wait but that has both

[dense garden]

there was something with LD_PRELOADs accidentally getting pulled into the initramfs, you removed it

[dense sphinx]

yeah and now i don't see this anymore

do you?

[dense garden]

I don't see it either

[dense sphinx]

why is it just on @upper arrow 's machine

[dense sphinx]

lol

[upper arrow]

😂

I'll do another restart to see if I see it again, then I'll make a separate support thread

[young moss]

I have an issue with the fedora 43 update as well related to proton. I used the secureblue recommended way for installing proton.

[dense garden]

run this

or just delete the includepkgs line from the repo file

[upper arrow]

the steps I took to fix:

1. rpm-ostree uninstall proton-vpn-gnome-desktop
2. reboot
3. rpm-ostree upgrade
4. reboot
5. run0 cp /usr/etc/yum.repos.d/protonvpn-stable.repo /etc/yum.repos.d/protonvpn-stable.repo
6. ujust install-vpn
7. reboot

[dense garden]

just fyi you can combine two steps and cut out a reboot there

rpm-ostree upgrade --uninstall=proton-vpn-gnome-desktop

[young moss]

running run0 cp /usr/etc/yum.repos.d/protonvpn-stable.repo /etc/yum.repos.d/protonvpn-stable.repo did not work. I recieved error: Packages not found: proton-vpn-gnome-desktop

[dense garden]

did you run ujust install-vpn to reinstall Proton VPN?

[young moss]

I am trying the steps @upper arrow mentioned above now. but running the line by itself did not work for me

[upper arrow]

You may need to try running ujust install-vpn at least once after upgrading to Fedora 43?

[torn juniper]

gnome or kde?

kde just kinda tends to do that on version updates it replaces the default distro wallpaper with the kde one

[upper arrow]

I'm on gnome. Disappearing desktop background took seconds to fix though lol

[rocky fox]

I though the problem was only on my machine. I removed it anyways because it's so bad.

[real wolf]

Probably too late, but the command does/says nothing

[real wolf]

# ProtonVPN stable release
#
[protonvpn-fedora-stable]
name = ProtonVPN Fedora Stable repository
baseurl = https://repo.protonvpn.com/fedora-$releasever-stable
enabled=1
gpgcheck = 1
repo_gpgcheck = 1
gpgkey = https://repo.protonvpn.com/fedora-$releasever-stable/public_key.asc
includepkgs = proton-vpn-gnome-desktop,proton-vpn-gtk-app,protonvpn-stable-release,python3-proton-core,python3-proton-keyring-linux,python3-proton-vpn-api-core,python3-proton-vpn-local-agent,python3-proton-vpn-network-manager

[real wolf]

Okay, I will try this soon

[torn juniper]

yeah you also have the old broken version

[real wolf]

Okay it worked

[lyric stratus]

This steps solved it for me! Thanks everyone for the suggestions

[drifting gyro]

Why does it need to be removed, though?

It worked before and was suggested as an additional security measure, what changed with F43 that we omit it now?

I'm on F43 with the old mullvad repo file that still has includepkgs and I have no issue.

[dense garden]

apparently proton added a new package that wasn't in the list

[drifting gyro]

...then why don't we add that into the list as well?

Instead of removing that attribute from all three repo files, lol

Which is imo a downgrade, even if its not that significant. I see no reason to not have it.

[dense garden]

I'm honestly not sure how it's a useful security measure though. if you're using a VPN then you're already trusting the VPN provider with quite a bit more than the ability to have packages indexed in your rpm repo database. like, what exactly is the threat that it's meant to protect against?

[drifting gyro]

The repo being able to provide other packages that are not expected, I guess. It was recommended by SkewedZeppelin from divested.

[drifting gyro]

I agree that you're already trusting the VPN and that the packages that are whitelisted itself could just be malicious instead of extraneous packages, but it's still limiting the scope and I don't see big arguments against it either. At best it can improve security somewhat or possibly even prevent accidental installation of unwanted packages, at worst it just does nothing, I guess.

[dense garden]

I'm just having a hard time picturing a plausible scenario where it would actually protect against an attack... but feel free to make a PR adding the includepkgs lines back if you want, I don't feel strongly about it either way lol

[drifting gyro]

I was just surprised it was dropped altogether instead of adding the missing package to the list.

@dense sphinx thoughts?

I'd say its better to have it than not, but I agree that its security benefit is uncertain as far as I can think of it.

[dense sphinx]

it did cause breakages on upgrade 😅

i guess if we test this scenario thoroughly next time we could add it back

[honest depot]

Had the same error as you when trying to update with protonvpn. I uninstalled it, but now I'm getting an error when trying to update to fedora 43.

rpm-ostree upgrade note: automatic updates (stage) are enabled Pulling manifest: ostree-image-signed: docker: //ghcr.io/secureblue/silverblue-nvidia-open-hardened:latest error: Preparing import: Fetching manifest: failed to invoke method OpenImage: pinging container registry gher.io: Get "https://ghcr.io/v2/": dial tcp: lookup ghcr.io: Temporary failure in name resolution

[dense garden]

Temporary failure in name resolution
that's just a transient network issue, try again

[honest depot]

I figured, its been on and off throughout me messing with proton when the update first came out

Thanks

[honest depot]

The issue still remains, it seems to be on my end. I reset my DNS settings. I'm thinking it might be because I left 'block connections without vpn' on before I deleted the app??

Found the commands to remove VPN firewall: https://protonvpn.com/support/official-linux-vpn-fedora/