--- lang: en layout: doc permalink: /doc/software-update-domu/ redirect_from: - /doc/software-update-vm/ - /en/doc/software-update-vm/ - /doc/SoftwareUpdateVM/ - /wiki/SoftwareUpdateVM/ ref: 189 title: Installing and updating software in domUs --- Updating [domUs](/doc/glossary/#domu), especially [TemplateVMs](/doc/templates/) and [StandaloneVMs](/doc/standalone-and-hvm/) are important steps in [Updating Qubes OS](/doc/updating-qubes-os/). It is very import to keep domUs up-to-date with the latest [security](/security/) updates. Updating these VMs also allows you to receive various non-security bug fixes and enhancements both from the Qubes OS Project and from your upstream distro maintainer. ## Installing software in TemplateVMs To permanently install new software in a TemplateVM: 1. Start the TemplateVM. 2. Start either a terminal (e.g. `gnome-terminal`) or a dedicated software management application, such as `gpk-application`. 3. Install software as normally instructed inside that operating system (e.g. `sudo dnf install ` on Fedora, `sudo apt install ` on Debian). 4. Shut down the TemplateVM. 5. Restart all [TemplateBasedVMs](/doc/glossary/#templatebasedvm) based on the TemplateVM so the changes can take effect. 6. (Optional) In the relevant [TemplateBasedVMs](/doc/glossary/#templatebasedvm)' **Qube Settings**, go to the **Applications** tab, select the new application(s) from the list, and press OK. These new shortcuts will appear in the Applications Menu. (If you encounter problems, see [here](/doc/managing-appvm-shortcuts/) for troubleshooting.) ![[The Applications tab in Qube Settings](/attachment/wiki/ManagingAppVmShortcuts/r4.1-dom0-appmenu-select.png)](/attachment/wiki/ManagingAppVmShortcuts/r4.1-dom0-appmenu-select.png) ## Updating software in TemplateVMs See [Updating Qubes OS](/doc/updating-qubes-os/). ## Testing repositories If you wish to install updates that are still in [testing](/doc/testing), you must enable the appropriate testing repositories. ### Fedora There are three Qubes VM testing repositories (where `*` denotes the Release): - `qubes-vm-*-current-testing` -- testing packages that will eventually land in the stable (`current`) repository - `qubes-vm-*-security-testing` -- a subset of `qubes-vm-*-current-testing` that contains packages that qualify as security fixes - `qubes-vm-*-unstable` -- packages that are not intended to land in the stable (`qubes-vm-*-current`) repository; mostly experimental debugging packages To temporarily enable any of these repos, use the `--enablerepo=` option. Example commands: ~~~ sudo dnf upgrade --enablerepo=qubes-vm-*-current-testing sudo dnf upgrade --enablerepo=qubes-vm-*-security-testing sudo dnf upgrade --enablerepo=qubes-vm-*-unstable ~~~ To enable or disable any of these repos permanently, change the corresponding `enabled` value to `1` in `/etc/yum.repos.d/qubes-*.repo`. ### Debian Debian also has three Qubes VM testing repositories (where `*` denotes the Release): - `*-testing` -- testing packages that will eventually land in the stable (`current`) repository - `*-securitytesting` -- a subset of `*-testing` that contains packages that qualify as security fixes - `*-unstable` -- packages that are not intended to land in the stable repository; mostly experimental debugging packages To enable or disable any of these repos permanently, uncomment the corresponding `deb` line in `/etc/apt/sources.list.d/qubes-r*.list`. ## Contributed package repository Please see [installing contributed packages](/doc/installing-contributed-packages/). ## StandaloneVMs When you create a [StandaloneVM](/doc/standalone-and-hvm/) from a TemplateVM, the StandaloneVM is a complete clone of the TemplateVM, including the entire filesystem. After the moment of creation, the StandaloneVM is completely independent from the TemplateVM. Therefore, it will not be updated when the TemplateVM is updated. Rather, it must be updated individually. The process for installing and updating software in StandaloneVMs is the same as described above for TemplateVMs. ## Advanced The following sections cover advanced topics pertaining to installing and updating software in domUs. ### RPMFusion for Fedora TemplateVMs If you would like to enable the [RPM Fusion](https://rpmfusion.org/) repositories, open a Terminal of the TemplateVM and type the following commands, depending on which RPM Fusion repositories you wish to enable (see [RPM Fusion](https://rpmfusion.org/) for details): ~~~ sudo dnf config-manager --set-enabled rpmfusion-free sudo dnf config-manager --set-enabled rpmfusion-free-updates sudo dnf config-manager --set-enabled rpmfusion-nonfree sudo dnf config-manager --set-enabled rpmfusion-nonfree-updates sudo dnf upgrade --refresh ~~~ This will permanently enable the RPM Fusion repos. If you install software from here, it's important to keep these repos enabled so that you can receiving future updates. If you only enable these repos temporarily to install a package the Qubes update mechanism may persistently notify you that updates are available, since it cannot download them. ### Reverting changes to a TemplateVM Perhaps you've just updated your TemplateVM, and the update broke your template. Or perhaps you've made a terrible mistake, like accidentally confirming the installation of an unsigned package that could be malicious. If you want to undo changes to a TemplateVM, there are three basic methods: 1. **Root revert.** This is appropriate for misconfigurations, but not for security concerns. It will preserve your customizations. 2. **Reinstall the template.** This is appropriate for both misconfigurations and security concerns, but you will lose all customizations. 3. **Full revert.** This is appropriate for both misconfigurations and security concerns, and it can preserve your customizations. However, it is a bit more complex. #### Root revert **Important:** This command will roll back any changes made *during the last time the TemplateVM was run, but **not** before.* This means that if you have already restarted the TemplateVM, using this command is unlikely to help, and you'll likely want to reinstall it from the repository instead. On the other hand, if the template is already broken or compromised, it won't hurt to try reverting first. Just make sure to **back up** all of your data and changes first! 1. Shut down `