Merge branch 'QubesOS:main' into patch-2

developer/system/gui.md

@@ -90,9 +90,10 @@ Clipboard sharing implementation
 Certainly, it would be insecure to allow AppVM to read/write the clipboards of other AppVMs unconditionally.
 Therefore, the following mechanism is used:
 
-- there is a "qubes clipboard" in dom0 - its contents are stored in a regular file in dom0.
+- there is a "qubes clipboard" in dom0 - its contents are stored in a regular file in dom0 as `/run/qubes/qubes-clipboard.bin`.
 - if the user wants to copy local AppVM clipboard to qubes clipboard, she must focus on any window belonging to this AppVM, and press **Ctrl-Shift-C**. This combination is trapped by `qubes-guid`, and `CLIPBOARD_REQ` message is sent to AppVM. `qubes-gui` responds with `CLIPBOARD_DATA` message followed by clipboard contents.
 - the user focuses on other AppVM window, presses **Ctrl-Shift-V**. This combination is trapped by `qubes-guid`, and `CLIPBOARD_DATA` message followed by qubes clipboard contents is sent to AppVM; `qubes-gui` copies data to the local clipboard, and then user can paste its contents to local applications normally.
+- a supplementary JSON metadata file will be saved as `/run/qubes/qubes-clipboard.bin.metadata` on global clipboard copy or paste actions. Explanation of each field is available in `xside.h` header file of `qubes-guid` under `clipboard_metadata` structure. While the output from `qubes-guid` is fully JSON compatible, the `qubes-guid` parser is limited. It expects line breaks after each key-value pair and only one key-value pair per line. Opening and closing curly braces should be on their own lines. There should be no leading white-space.
 
 This way, the user can quickly copy clipboards between AppVMs.
 This action is fully controlled by the user, it cannot be triggered/forced by any AppVM.

developer/system/template-implementation.md

@@ -73,19 +73,9 @@ When TemplateVM is stopped, the xen script moves root-cow.img to root-cow.img.ol
 
 #### Rollback template changes
 
-There is possibility to rollback last template changes. Saved root-cow.img.old contains all changes made during last TemplateVM run. Rolling back changes is done by reverting this "binary patch".
+There is possibility to rollback last template changes. Using the automatic snapshot that is normally saved every time the template is shutdown.
 
-This is done using snapshot-merge device-mapper target (available from 2.6.34 kernel). It requires that no other snapshot device uses underlying block devices (root.img, root-cow.img via loop device). Because of this all AppVMs based on this template must be halted during this operation.
-
-Steps performed by **qvm-revert-template-changes**:
-
-1. Ensure that no other VMs uses this template.
-2. Prepare snapshot device with ***root-cow.img.old*** instead of *root-cow.img* (*/etc/xen/scripts/block-snapshot prepare*).
-3. Replace *snapshot* device-mapper target with *snapshot-merge*, other parameters (chunk size etc) remains untouched. Now kernel starts merging changes stored in *root-cow.img.old* into *root.img*. d-m device can be used normally (if needed).
-4. Waits for merge completed: *dmsetup status* shows used snapshot blocks – it should be equal to metadata size when completed.
-5. Replace *snapshot-merge* d-m target back to *snapshot*.
-6. Cleanup snapshot device (if nobody uses it at the moment).
-7. Move *root-cow.img.old* to *root-cow.img* (overriding existing file).
+Refer to volume backup and revert [documentation](/doc/volume-backup-revert) for more information.
 
 ### Snapshot device in AppVM
 

introduction/intro.md

@@ -19,7 +19,7 @@ title: Introduction
     <p>
       Qubes OS is a free and open-source, security-oriented operating system for
       single-user desktop computing. Qubes OS leverages
-      <a href="https://wiki.xen.org/wiki/Xen_Project_Software_Overview">
+      <a href="https://wiki.xenproject.org/wiki/Xen_Project_Software_Overview">
       Xen-based virtualization</a> to allow for the creation and management of
       isolated compartments called <a href="/doc/glossary#qube">qubes</a>.
     </p>

introduction/issue-tracking.md

@@ -41,7 +41,7 @@ Great! Thank you for taking the time and effort to help improve Qubes! To ensure
  1. Carefully read our issue tracking [guidelines](#guidelines). If your issue would violate any of the guidelines, **stop**. Please do not submit it.
  2. [Search through the existing issues](#search-tips), both open and closed, to see if your issue already exists. If it does, **stop**. [Do not open a duplicate.](/doc/issue-tracking/#new-issues-should-not-be-duplicates-of-existing-issues) Instead, comment on the existing issue.
  3. Go [here](https://github.com/QubesOS/qubes-issues/issues/new/choose).
- 4. Select the [type](#type) of issue you want to open.
+ 4. Select the [type](#types) of issue you want to open.
  5. Enter a descriptive title.
  6. Do not delete the provided issue template. Fill out every applicable section.
  7. Make sure to mention any relevant documentation and other issues you've already seen. We don't know what you've seen unless you tell us. If you don't list it, we'll assume you haven't seen it.
@@ -51,36 +51,36 @@ Great! Thank you for taking the time and effort to help improve Qubes! To ensure
 
 Eventually, your issue may be closed. See [how issues get closed](/doc/issue-tracking/#how-issues-get-closed) for details about when, why, and how this occurs.
 
-## Labels and projects
+## How issues are organized
 
-Labels and projects are features of GitHub's issue tracking system that we use to keep [qubes-issues](https://github.com/QubesOS/qubes-issues/issues) organized.
+Issues can have several different properties and be organized in various ways. This section explains how we use labels, issue types, projects, and other features of GitHub's issue tracking system in order to keep [qubes-issues](https://github.com/QubesOS/qubes-issues/issues) organized.
 
 ### Labels
 
-When an issue is first created, certain [labels](https://github.com/QubesOS/qubes-issues/labels) may automatically be applied to it based on the type of issue the reporter selected. For example, if someone selects the "Bug report" template, then the `T: bug` label will automatically be applied to that issue. After that, only Qubes team members have permission to modify labels. Many labels have descriptions on them that can be viewed by hovering over them or on the [list of labels](https://github.com/QubesOS/qubes-issues/labels). Let's go over some of the most important ones.
-
-#### Type
-
-There are three issue **types**: `T: bug`, `T: enhancement`, and `T: task`.
-
-- `T: bug` --- Type: bug report. A problem or defect resulting in unintended behavior in something that exists.
-- `T: enhancement` --- Type: enhancement. A new feature that does not yet exist **or** improvement of existing functionality.
-- `T: task` --- Type: task. An action item that is neither a bug nor an enhancement.
-
-Every open issue should have **exactly one** type. An open issue should not have more than one type, and it should not lack a type entirely. Bug reports are for problems in things that already exist. If something doesn't exist yet, but you think it ought to exist, then use `T: enhancement` instead. If something already exists, but you think it could be improved in some way, you should again use `T: enhancement`. `T: task` is for issues that fall under neither `T: bug` nor `T: enhancement`.
+When an issue is first created, it will receive the `P: default` (i.e., default priority) [label](https://github.com/QubesOS/qubes-issues/labels) automatically. After an issue has been created, only Qubes team members have permission to modify labels. Many labels have descriptions on them that can be viewed by hovering over them or on the [list of labels](https://github.com/QubesOS/qubes-issues/labels). Let's go over some of the most important ones.
 
 #### Priority
 
-There are several issue **priority** levels ranging from `P: minor` to `P: blocker` (see [here](https://github.com/QubesOS/qubes-issues/labels?q=P%3A) for the full list). Every open issue should have **exactly one** priority. An open issue should not have more than one priority, and it should not lack a priority entirely. See [here](/doc/version-scheme/#bug-priorities) for details about how the developers use these priorities.
+There are several issue **priority** levels ranging from `P: minor` to `P: blocker` (see [here](https://github.com/QubesOS/qubes-issues/labels?q=P%3A) for the full list). Every open issue should have exactly one priority. An open issue should not have more than one priority, and it should not lack a priority entirely. See [here](/doc/version-scheme/#bug-priorities) for details about how the developers use these priorities.
 
 #### Component
 
-There are many **component** labels, each beginning with `C:` (see [here](https://github.com/QubesOS/qubes-issues/labels?q=C%3A) for the full list). Every open issue should have **at least one** component. An open issue may have more than one component, but it should not lack a component entirely. When no other component applies, use `C: other`.
+There are many **component** labels, each beginning with `C:` (see [here](https://github.com/QubesOS/qubes-issues/labels?q=C%3A) for the full list). Every open issue should have at least one component. An open issue may have more than one component, but it should not lack a component entirely. When no other component applies, use `C: other`.
 
 #### Affected release
 
 A label of the form `affects-<RELEASE_NUMBER>` indicates that an issue affects the corresponding Qubes OS release. An issue can have more than one of these labels if it affects multiple releases.
 
+### Types
+
+There are three issue [types](https://docs.github.com/en/issues/tracking-your-work-with-issues/configuring-issues/managing-issue-types-in-an-organization): Bug, Feature, and Task.
+
+- **Bug** --- An unexpected problem or behavior
+- **Feature** --- A request, idea, or new functionality
+- **Task** --- A specific piece of work
+
+Every open issue should have exactly one type. **Bug** reports are for problems in things that already exist. If something doesn't exist yet, but you think it ought to exist, then that issue should instead be a **Feature** request. If something already exists, but you think it could be improved in some way, that also qualifies as a **Feature** request. The **Task** type is for issues that are actionable but that fall under neither the **Bug** nor **Feature** types.
+
 ### Projects
 
 According to GitHub, a [project](https://docs.github.com/en/issues/planning-and-tracking-with-projects/learning-about-projects/about-projects) is "an adaptable spreadsheet, task-board, and road map that integrates with your issues and pull requests on GitHub to help you plan and track your work effectively." The issue tracker has several [projects](https://github.com/QubesOS/qubes-issues/projects). Github projects allows more detailed issue states, and also attaching more metadata to issues. They also allow more focused view.
@@ -89,21 +89,11 @@ There is a special project in Qubes OS project: the [Current team tasks project]
 
 ### Meta-issues
 
-A meta-issue is an issue that serves to collect and organize a group of other issues. We use meta-issues when we need a way to track work on specific features. We cannot use [projects](#projects) for this, because we already use a project for tracking the work of the Qubes team as a whole, and projects cannot contain milestones or other projects.
+A meta-issue is an issue that serves primarily to collect and organize a group of other issues. This group of other issues typically exists in a hierarchy of [sub-issues](https://docs.github.com/en/issues/tracking-your-work-with-issues/using-issues/adding-sub-issues), usually with the meta-issue at the top. (For example, we use meta-issues when we need a way to track work on specific features. We cannot use [projects](#projects) for this, because we already use a project for tracking the work of the Qubes team as a whole, and projects cannot contain milestones or other projects.)
 
-Meta-issues must abide by the following rules:
+Meta-issues should have informative descriptions, not just lists of issues. In particular, each meta-issue should explain its goal, what is in scope, and what the relevant categories and priorities are.
 
-- Only members of the core team may create meta-issues (or convert existing issues into meta-issues).
-
-  Rationale: The purpose of meta-issues is to track the development of certain features that fit into the overall goals of the Qubes OS Project, which requires making informed project-management decisions with the approval of the project lead.
-
-- Meta-issues must be [locked](https://docs.github.com/en/communities/moderating-comments-and-conversations/locking-conversations).
-
-  Rationale: One of the historical problems we've experienced with meta-issues (and one of the reasons they were discouraged for a long time) is that each meta-issue tends to turn into a discussion thread that becomes hopelessly long to the point where the person who is supposed to work on it has no idea what is supposed to be done or where to start, and it eventually just gets closed. Locking is intended to prevent that from happening again.
-
-- Meta-issues must have informative descriptions, not just lists of issues. In particular, each meta-issue should explain its goal, what is in scope, and what the relevant categories and priorities are.
-
-- Meta-issues must have clear, concrete, and actionable criteria for when they will be closed. Meta-issues should never be "open-ended" or expected to stay open indefinitely. If this ever becomes unclear, the meta-issue should be closed until it becomes clear.
+In addition, meta-issues should have clear, concrete, and actionable criteria for when they will be closed. Meta-issues should never be "open-ended" or expected to stay open indefinitely. If this ever becomes unclear, the meta-issue should be closed until it becomes clear.
 
 ## Search tips
 

user/advanced-topics/config-files.md

@@ -11,8 +11,7 @@ ref: 180
 title: Config files
 ---
 
-Qubes-specific VM config files
-------------------------------
+## Qubes-specific VM config files
 
 These files are placed in `/rw`, which survives a VM restart.
 That way, they can be used to customize a single VM instead of all VMs based on the same template.
@@ -76,8 +75,7 @@ Note that scripts need to be executable (`chmod +x`) to be used.
 
 Also, take a look at [bind-dirs](/doc/bind-dirs) for instructions on how to easily modify arbitrary system files in an app qube and have those changes persist.
 
-GUI and audio configuration in dom0
------------------------------------
+## GUI and audio configuration in dom0
 
 The GUI configuration file `/etc/qubes/guid.conf` in one of a few not managed by `qubes-prefs` or the Qubes Manager tool.
 Sample config (included in default installation):

user/advanced-topics/resize-disk-image.md

@@ -32,7 +32,8 @@ In most cases, the GUI tool Qube Settings (available for every qube from the Sta
 
 ![vm-settings-disk-image.png](/attachment/doc/r4.0-vm-settings-disk-image.png)
 
-In case of standalone qubes and templates, just change the Disk Storage settings above.
+In case of standalone qubes and templates, just change the Disk Storage settings above. If the standalone fails to start, temporarily increase the `qrexec_timeout`, [as described here](https://github.com/QubesOS/qubes-issues/issues/9251#issuecomment-2121596415).
+
 In case of template-based qubes, the private storage (the /home directory and user files) can be changed in the qube's own settings, but the system root image is [inherited from the template](/doc/getting-started/), and so it must be changed in the template settings.
 If you are increasing the disk image size for Linux-based qubes installed from Qubes OS repositories in Qubes 4.0 or later, changing the settings above is all you need to do - in other cases, you may need to do more, according to instructions below.
 See also the OS-specific follow-up instructions below.

user/advanced-topics/volume-backup-revert.md

@@ -31,7 +31,7 @@ qvm-volume info vmname:private
 
 The output of the above command will also display the "Available revisions
 (for revert)" at the bottom. For a very large volume in a small pool,
-revisions_to_keep should probably be set to the minimum value of 1 to minimize
+revisions_to_keep should probably be set to the maximum value of 1 to minimize
 the possibility of the pool being accidentally filled up by snapshots. For a
 smaller volume for which you would like to have the future option of reverting,
 revisions_to_keep should probably be set to at least 2. To set

user/downloading-installing-upgrading/installation-guide.md

@@ -43,7 +43,7 @@ Even on supported hardware, you must ensure that [IOMMU-based virtualization](ht
 
 ### Copying the ISO onto the installation medium
 
-Pick the most secure existing computer and OS you have available for downloading and copying the Qubes ISO onto the installation medium. [Download](/downloads/) a Qubes ISO.
+Pick the most secure existing computer and OS you have available for downloading and copying the Qubes ISO onto the installation medium. [Download](/downloads/) a Qubes ISO. If your Internet connection is unstable and the download is interrupted, you could resume the partial download with `wget --continue` in case you are currently using wget for downloading or use a download-manager with resume capability. Alternatively you can download installation ISO via BitTorrent that sometimes enables higher download speeds and more reliable downloads of large files.
 
 <div class="alert alert-danger" role="alert">
   <i class="fa fa-exclamation-triangle"></i>

user/hardware/system-requirements.md

@@ -37,9 +37,9 @@ title: System requirements
   - [Intel VT-x](https://en.wikipedia.org/wiki/X86_virtualization#Intel_virtualization_.28VT-x.29) with [EPT](https://en.wikipedia.org/wiki/Second_Level_Address_Translation#Extended_Page_Tables)
   - [Intel VT-d](https://en.wikipedia.org/wiki/X86_virtualization#Intel-VT-d)
   - For security, we recommend processors that are recent enough to still be
-    receiving microcode updates (see [below](#important-updates) for details).
+    receiving microcode updates (see [below](#important-notes) for details).
   - AMD processors are not recommended due to inconsistent security support on
-    client platforms (see [below](#important-updates) for details).
+    client platforms (see [below](#important-notes) for details).
 
 - **Memory:** 16 GB RAM
 

user/how-to-guides/how-to-enter-fullscreen-mode.md

@@ -11,20 +11,17 @@ ref: 205
 title: How to enter fullscreen mode
 ---
 
-What is fullscreen mode?
--------------------------
+## What is fullscreen mode?
 
 Normally, the Qubes GUI virtualization daemon restricts the VM from "owning" the full screen, ensuring that there are always clearly marked decorations drawn by the trusted Window Manager around each of the VMs window.
 This allows the user to easily realize to which domain a specific window belongs.
 See the [screenshots](/doc/QubesScreenshots/) page for examples.
 
-Why is fullscreen mode potentially dangerous?
-----------------------------------------------
+## Why is fullscreen mode potentially dangerous?
 
 If one allowed one of the VMs to "own" the full screen, e.g. to show a movie on a full screen, it might not be possible for the user to know if the applications/VM really "released" the full screen, or if it has started emulating the whole desktop and is pretending to be the trusted Window Manager, drawing shapes on the screen that look e.g. like other windows, belonging to other domains (e.g. to trick the user into entering a secret passphrase into a window that looks like belonging to some trusted domain).
 
-Secure use of fullscreen mode
-------------------------------
+## Secure use of fullscreen mode
 
 However, it is possible to deal with fullscreen mode in a secure way assuming there are mechanisms that can be used at any time to switch between windows or show the full desktop and that cannot be intercepted by the VM.
 The simplest example is the use of Alt+Tab for switching between windows, which is a shortcut handled by dom0.
@@ -33,8 +30,7 @@ Other examples such mechanisms are the KDE "Present Windows" and "Desktop Grid"
 Those effects are enabled by default in KDE once Compositing gets enabled in KDE (System Settings -\> Desktop -\> Enable Desktop Effects), which is recommended anyway.
 By default, they are triggered by Ctrl-F8 and Ctrl-F9 key combinations, but can also be reassigned to other shortcuts.
 
-Enabling fullscreen mode for select VMs
-----------------------------------------
+## Enabling fullscreen mode for select VMs
 
 You can always put a window into fullscreen mode in Xfce4 using the trusted window manager by right-clicking on a window's title bar and selecting "Fullscreen" or pressing `alt` + `f11`.
 This functionality should still be considered safe, since a VM window still can't voluntarily enter fullscreen mode.

user/how-to-guides/how-to-install-software.md

@@ -429,7 +429,7 @@ these in an app qube you need to take the following steps:
    When the install is complete you can close the terminal window.
 
 3. Refresh the Applications list for the app qube. In the Qubes Menu for the
-   **app qube*** launch the Qube Settings. Then go to the Applications tab and
+   **app qube** launch the Qube Settings. Then go to the Applications tab and
    click "Refresh Applications"
 
    The refresh will take a few minutes; after it's complete the Snap app will

user/how-to-guides/how-to-update.md

@@ -26,24 +26,26 @@ Security updates are an extremely important part of keeping your Qubes installat
 
 By default, the **Qubes Update** tool will appear as an icon in the Notification Area when updates are available.
 
-[![Qube Updates Available](/attachment/doc/r4.0-qube-updates-available.png)](/attachment/doc/r4.0-qube-updates-available.png)
+[![Qube Updates Available](/attachment/doc/r4.2-qube-updates-available.png)](/attachment/doc/r4.2-qube-updates-available.png)
 
-However, you can also start the tool manually by selecting it in the Applications Menu under "Qubes Tools." Even if no updates have been detected, you can use this tool to check for updates manually at any time by selecting "Enable updates for qubes without known available updates," then selecting all desired items from the list and clicking "Next."
+However, you can also start the tool manually by selecting it in the Applications Menu under "Qubes Tools." Even if no updates have been detected, you can use this tool to check for updates manually at any time by selecting all desired items from the list and clicking "Update".
 
 <div class="alert alert-info" role="alert">
   <i class="fa fa-question-circle"></i>
   For information about how templates download updates, please see <a href="/doc/how-to-install-software/#why-dont-templates-have-network-access">Why don't templates have network access?</a> and the <a href="/doc/how-to-install-software/#updates-proxy">Updates proxy</a>.
 </div>
 
-By default, most qubes that are connected to the internet will periodically check for updates for their parent templates. If updates are available, you will receive a notification as described above. However, if you have any templates that do *not* have any online child qubes, you will *not* receive update notifications for them. Therefore, you should regularly update such templates manually instead.
+By default, most qubes that are connected to the internet will periodically check for updates for their parent templates. You can check the date of the last update check in the "last checked" column. If updates are available for any qube, you will receive a notification as described above, and in the "Updates available" column you will see "YES" for that qube(s). If the update check did not find any new updates, "NO" will appear in the column. Respectively, for qubes that are no longer supported, "OBSOLETE" will be displayed. However, if you have any templates that do *not* have any online child qubes, you will *not* receive update notifications for them. By default, after a week, if updates for a given qube have not been checked, the value in the "Updates available" column will be set to "MAYBE". 
 
 ## Installing updates
 
 The standard way to install updates is with the **Qubes Update** tool. (However, you can also perform the same action via the [command-line interface](#command-line-interface).)
 
-[![Qubes Update](/attachment/doc/r4.0-software-update.png)](/attachment/doc/r4.0-software-update.png)
+[![Qubes Update](/attachment/doc/r4.2-software-update.png)](/attachment/doc/r4.2-software-update.png)
 
-Simply follow the on-screen instructions, and the tool will download and install all available updates for you. Note that if you are downloading updates over Tor (`sys-whonix`), this can take a very long time, especially if there are a lot of updates available.
+You can easily decide which qubes to update by clicking on the checkbox in the column header. At startup, only the qubes for which updates are known are selected for updating, but clicking on the mentioned checkbox will also select all qubes with the "MAYBE" status. It is recommended to update all qubes with the statuses "YES" and "MAYBE".
+
+Then simply follow the on-screen instructions, and the tool will download and install all available updates for you. Note that if you are downloading updates over Tor (`sys-whonix`), this can take a very long time, especially if there are a lot of updates available.
 
 ## Restarting after updating
 
@@ -53,7 +55,7 @@ Certain updates require certain components to be restarted in order for the upda
 - Dom0 should be restarted after all **Xen** and **kernel** updates.
 - On Intel systems, dom0 should be restarted after all `microcode_ctl` updates.
 - On AMD systems, dom0 should be restarted after all `linux-firmware` updates.
-- After updating a template, first shut down the template, then restart all running qubes based on that template.
+- After updating a template, first shut down the template, then restart all running qubes based on that template. The updater will try to do this for you automatically in the last step of updating. Remember to save all your data before restarting!
 
 ## AEM resealing after updating
 
@@ -63,15 +65,10 @@ If you use [Anti Evil Maid (AEM)](/doc/anti-evil-maid/), you'll have to "reseal"
 
 <div class="alert alert-danger" role="alert">
   <i class="fa fa-exclamation-triangle"></i>
-  <b>Warning:</b> Updating with direct commands such as <code>qubes-dom0-update</code>, <code>dnf update</code>, and <code>apt update</code> is <b>not</b> recommended, since these bypass built-in Qubes OS update security measures. Instead, we strongly recommend using the <b>Qubes Update</b> tool or its command-line equivalents, as described below. (By contrast, <a href="/doc/how-to-install-software/">installing</a> packages using direct package manager commands is fine.)
+  <b>Warning:</b> Updating with direct commands such as <code>dnf update</code>, and <code>apt update</code> is <b>not</b> recommended, since these bypass built-in Qubes OS update security measures. Instead, we strongly recommend using the <b>Qubes Update</b> tool or its command-line equivalents, as described below. (By contrast, <a href="/doc/how-to-install-software/">installing</a> packages using direct package manager commands is fine.)
 </div>
 
-Advanced users may wish to perform updates via the command-line interface. The recommended way to do this is by applying the following two Salt states. **Applying these two Salt states is the same as updating via the Qubes Update tool.**
-
- - [update.qubes-dom0](/doc/salt/#updatequbes-dom0)
- - [update.qubes-vm](/doc/salt/#updatequbes-vm)
-
-In your update qube, a terminal window opens that displays the progress of operations and output as it is logged. At the end of the process, logs are sent back to dom0. You answer any yes/no prompts in your dom0 terminal window.
+Advanced users may wish to perform updates via the command-line interface. To update templates and standalones non-interactively, use the command `qubes-vm-update`, and to update dom0, use `qubes-dom0-update`. If you want to perform an update with more advanced user-configurable options (e.g., custom pre- or post-update scripts, custom workarounds), see: [update.qubes-dom0](/doc/salt/#updatequbes-dom0) and [update.qubes-vm](/doc/salt/#updatequbes-vm).
 
 Advanced users may also be interested in learning [how to enable the testing repos](/doc/testing/).
 

user/security-in-qubes/ctap-proxy.md

@@ -85,7 +85,7 @@ $ sudo qubes-dom0-update qubes-ctap-dom0
 $ qvm-service --enable work qubes-ctap-proxy
 ```
 
-The above assumes a `work` qube in which you would like to enable ctap. Repeat the `qvm-service` command for all qubes that should have the proxy enabled.  Alternatively, you can add `qubes-ctap-proxy` in VM settings -> Services in the Qube Manager of each qube you would like to enable the service.
+The above assumes a `work` qube in which you would like to enable ctap. Repeat the `qvm-service` command for all qubes that should have the client proxy enabled.  Alternatively, you can add `qubes-ctap-proxy` in VM settings -> Services in the Qube Manager of each qube you would like to enable the service. Attempting to start the `qubes-ctap-proxy` service in the device-hosting qube (`sys-usb`) will fail.
 
 In Fedora templates: