We’re pleased to announce the stable release of Qubes OS 4.3.2! This patch release aims to consolidate all the security updates and bug fixes that have occurred since the previous stable release. Our goal is to provide a secure and convenient way for users to install (or reinstall) the latest stable Qubes release with an up-to-date ISO. The ISO and associated verification files are available on the downloads page. ## Announcements * Qubes OS Summit 2026 is coming up soon! This year’s Summit will take place from October 30 to November 1 in Berlin. * As a reminder, Qubes 4.2 has reached end of life (EOL). If you’re still using Qubes 4.2, we urge you to upgrade to Qubes 4.3 immediately. ## What’s new in Qubes 4.3.2? * Default Fedora template upgraded to Fedora 44 * `kernel-latest` upgraded to Linux 7.2 * Security updates * Numerous bug fixes For an overview of what’s new in Qubes 4.3, see the Qubes 4.3 release notes. ## How to get Qubes 4.3.2 * If you’d like to install Qubes for the first time or perform a clean reinstallation on an existing system, there’s never been a better time to do so! Simply download the Qubes 4.3.2 ISO and follow our installation guide. * If you’re currently on Qubes 4.3 (including 4.3.0, 4.3.1, and 4.3.2-rc1), update normally (which includes upgrading any EOL templates and standalones you might have) in order to make your system essentially equivalent to the stable Qubes 4.3.2 release. No reinstallation or other special action is required. * If you’re still using Qubes 4.2, you should upgrade from 4.2 to 4.3 immediately, since Qubes 4.2 has already reached end of life (EOL). In all cases, we strongly recommend making a full backup beforehand. ## Known issues in Qubes 4.3.2 It’s possible that templates restored in 4.3.2 from a pre-4.3 backup may continue to target their original Qubes OS release repos (#8701). After restoring such templates in 4.3.2, enter the following additional commands in a dom0 terminal: sudo qubes-dom0-update -y qubes-dist-upgrade sudo qubes-dist-upgrade --releasever=4.3 --template-standalone-upgrade -y This will automatically choose the templates that need to be upgraded. The templates will be shut down during this process. Fresh templates on a clean 4.3.2 installation are not affected. Users who perform an in-place upgrade from 4.2 to 4.3 (instead of restoring templates from a backup) are also not affected, since the in-place upgrade process already includes the above fix in stage 4. For more information, see issue #8701. View the full list of known bugs affecting Qubes 4.3 in our issue tracker. ## What’s a patch release? The Qubes OS Project uses the semantic versioning standard. Version numbers are written as `[major].[minor].[patch]`. Hence, we refer to releases that increment the third number as “patch releases.” A patch release does not designate a separate, new major or minor release of Qubes OS. Rather, it designates its respective major or minor release (in this case, 4.3) inclusive of all updates up to a certain point. See our supported releases for a comprehensive list of major and minor releases and our version scheme documentation for more information about how Qubes OS releases are versioned.

We’re proud to announce two new Qubes OS Summit 2026 sponsorships: Freedom of the Press Foundation (FPF) as a Gold-tier sponsor and NovaCustom as a Silver-tier sponsor! The FPF is a long-standing Qubes Partner. As a nonprofit organization, it is dedicated to supporting and defending public interest journalism. It leads the development of SecureDrop, an open-source whistleblower submission platform used by more than 50 media organizations around the world to securely accept documents from anonymous sources. FPF uses Qubes OS in the development of an integrated SecureDrop Workstation. NovaCustom builds custom laptops, mini PCs, and smartphones with a focus on privacy, security, and customization. They offer the freedom of Dasharo coreboot firmware, true repairability, and a plethora of customization options. Several NovaCustom models are officially certified for Qubes OS. ## Conference schedule We’re also pleased to share the official conference schedule, including a list of sessions and speakers, which you can find here: https://pretalx.com/qubes-os-summit-2026/schedule/ (Please note that we’re still waiting on a few speakers to confirm their attendance, so this schedule is subject to change.) On-site tickets are nearly halfway sold out, so if you’d like to join us in person, we recommend getting your tickets soon! See below for details. ## When and where **Friday, October 30 @ 9:30 AM — Sunday, November 1 @ 3:00 PM (GMT+1)** Refugio Berlin Lenaustraße 3-4 12047 Berlin View on OpenStreetMap ## Attend in person or online There are three ways to attend the Summit: 1. **In person at Refugio Berlin** * Requires a paid on-site ticket * Grants access to the hackathon (including interactive workshops) and any design sessions (depending on conference schedule) * Provides the opportunity to socialize, network, and mingle with like-minded individuals who are passionate about secure computing * Grants exclusive access to any non-livestreamed, non-recorded presentations (see below) * Grants access to attend presentations and participate as a live audience member 2. **Actively participate online** * Requires a free virtual ticket * For those who are presenting remotely * For those who are attending presentations remotely and wish to ask questions or engage in active discussion in a live chat during the presentations * Does not grant access to the hackathon or any design sessions * Does not provide the opportunity to socialize, network, or mingle with like-minded individuals who are passionate about secure computing * Does not grant access to any non-livestreamed, non-recorded presentations (see below) * Does not grant access to attend presentations as a live audience member 3. **Passively view online** * No ticket or registration required * For those who simply wish to watch the presentations via the public livestream and recorded videos * Does not provide the ability to ask questions or engage in active discussion during the presentations * Does not grant access to the hackathon or any design sessions * Does not provide the opportunity to socialize, network, or mingle with like-minded individuals who are passionate about secure computing * Does not grant access to any non-livestreamed, non-recorded presentations (see below) * Does not grant access to attend presentations as a live audience member **Note:** As mentioned above, presenters have the option to request that their presentations not be recorded. If a presenter opts out of recording, there will be a “no recording” icon next to that presentation in the conference schedule. Only on-site attendees will be able to view that presentation. It will not be livestreamed or recorded for later viewing. ## Become a sponsor If you or your organization are interested in sponsoring Qubes OS Summit 2026 or becoming a Qubes Partner, please contact us at funding@qubes-os.org. ## Code of conduct This event is covered by the Qubes OS Project’s code of conduct.

The first release candidate (RC) for Qubes OS 4.3.2 is now available for testing. This patch release aims to consolidate all the security patches, bug fixes, and other updates that have occurred since the release of Qubes 4.3.1. ## What’s new in Qubes 4.3.2? * Default Fedora template upgraded to Fedora 44 * `kernel-latest` upgraded to Linux 7.2 * Numerous bug fixes ## When is the stable release? That depends on the number of bugs discovered in this RC and their severity. As explained in our release schedule documentation, our usual process after issuing a new RC is to collect bug reports, triage the bugs, and fix them. If warranted, we then issue a new RC that includes the fixes and repeat the process. We continue this iterative procedure until we’re left with an RC that’s good enough to be declared the stable release. No one can predict with certainty, at the outset, how many iterations will be required (and hence how many RCs will be needed before a stable release), but we tend to get a clearer picture of this as testing progresses. Since the changes between 4.3.1 and 4.3.2 are relatively minor, we currently don’t anticipate any major problems requiring a second RC. We currently expect to be able to publish the stable 4.3.2 release around the end of September. ## How to test Qubes 4.3.2-rc1 If you’d like to help us test this RC, the best way to do so is by performing a clean installation with the new ISO. As always, we strongly recommend making a full backup beforehand and updating Qubes OS immediately afterward in order to apply all available bug fixes. As an alternative to a clean installation, there’s also the option of performing an in-place upgrade without reinstalling. However, since Qubes 4.3.2 is a patch release, it’s essentially Qubes 4.3 inclusive of all updates to date, which largely amounts to just using a fully-updated 4.3 installation. By contrast, a clean installation covers other areas that could also benefit from testing, such as the installation procedure, which is why it’s the recommended testing method. Regardless of your testing method, please help us improve the eventual stable release by reporting any bugs you encounter. If you’re an experienced user, we encourage you to join the testing team. ## Known issues in Qubes OS 4.3.2 It is possible that templates restored in 4.3.2 from a pre-4.3 backup may continue to target their original Qubes OS release repos. This does not affect fresh templates on a clean 4.3.2 installation. For more information, see issue #8701. View the full list of known bugs affecting Qubes 4.3 in our issue tracker. ## What’s a release candidate? A release candidate (RC) is a software build that has the potential to become a stable release, unless significant bugs are discovered in testing. RCs are intended for more advanced (or adventurous!) users who are comfortable testing early versions of software that are potentially buggier than stable releases. You can read more about Qubes OS supported releases and the version scheme in our documentation. ## What’s a patch release? The Qubes OS Project uses the semantic versioning standard. Version numbers are written as `[major].[minor].[patch]`. Hence, we refer to releases that increment the third number as “patch releases.” A patch release does not designate a separate, new major or minor release of Qubes OS. Rather, it designates its respective major or minor release (in this case, 4.3) inclusive of all updates up to a certain point. See our supported releases for a comprehensive list of major and minor releases and our version scheme documentation for more information about how Qubes OS releases are versioned.

We have published Qubes Security Bulletin (QSB) 119: Potential attacker-controlled format string in qvm-open-in-vm. The text of this QSB and its accompanying cryptographic signatures are reproduced below, followed by a general explanation of this announcement and authentication instructions. ## Qubes Security Bulletin 119 ---===[ Qubes Security Bulletin 119 ]===--- 2026-09-15 Potential attacker-controlled format string in qvm-open-in-vm User action ------------ Continue to update normally [1] in order to receive the security updates described in the "Patching" section below. No other user action is required in response to this QSB. Summary -------- Under certain circumstances (see "Technical details" below), if the user invokes qvm-open-in-vm (either directly or through the "Edit in disposable qube" GUI integration) on a file with an attacker-controlled filename or path, the attacker might be able to execute code in the qube in which the user invoked qvm-open-in-vm. Impact ------- An attacker who successfully exploits this vulnerability can take control over the qube in which the user invoked qvm-open-in-vm. Affected systems ----------------- All supported Qubes OS releases are affected. Among official Qubes OS templates, only Debian templates are affected. Technical details ------------------ When qvm-open-in-vm is invoked with a file (not an URI), the source-side part of the qrexec call is handled by the qopen-in-vm helper program. After sending the file content to the other side, qopen-in-vm tries to open a temporary file alongside the original file in order to save the response in case the user has edited the file in the target qube. If creating this file fails (e.g., because the directory is read-only), qopen-in-vm creates a temporary file in /tmp and shows an error message to the user. When printing this error message, it incorrectly invokes the gui_nonfatal function, such that the original filename ends up in a printf format string, which is unsafe. For this vulnerability to be exploitable, multiple conditions must be fulfilled: 1. The attacker must trick the user into using qvm-open-in-vm to open a file that either a. has a filename (i.e., the last component of the file's path) longer than 248 bytes or b. is located in a directory that is not writable. 2. The path (but not necessarily its last component) must contain printf-style conversion specifiers (such as '%n'). 3. qvm-open-in-vm must not have been invoked with the --view-only flag. 4. The target qube must either a. send back the file content because its mtime changed (which usually happens because the user saved the file being edited, even if merely by overwriting it with the same content) or b. be compromised by the attacker. 5. The build of qvm-open-in-vm must have been compiled without _FORTIFY_SOURCE hardening enabled (or set to a level below 2). Due to an unfortunate interaction between our build script and the way Debian handles this option, this hardening was not enabled for our Debian packages. (This problem did not affect our Fedora packages, for which the hardening was correctly enabled.) With enabled hardening, the program safely aborts with an error, making the bug unexploitable. The first person to report this vulnerability tested its exploitability on his system. He found that it was successfully exploited in less than 3 % of attempts. Moreover, his demonstration required a very long path with multiple nested directories and that contained many format specifiers. In the real world, the attacker may control only the last part of the file name in most cases. And even when they do control the full path, many users would likely find such a path suspicious, which would likely make it more difficult for an attacker to successfully trick the user into opening such a path. Discussion ----------- Normally, we do not issue Qubes security bulletins for purely "in-VM" vulnerabilities (like this one) that do not involve crossing the VM security boundary. However, we have decided to make an exception in this case, since this is a bug in our code and since qvm-open-in-vm is specifically intended to operate on untrusted input. While qvm-open-in-vm is designed to be hardened, keep in mind that handling less trusted data in a more trusted VM still can be risky for other reasons, for example: - Unsafe handling of attacker-controlled paths is an easy mistake to make in the shell. - A file explorer could render the thumbnail of an untrusted file with a buggy parser. - You might accidentally open the file with an application other than qvm-open-in-vm, exposing the full attack surface of that application. Patching --------- The following package contains the security update that addresses the vulnerability described in this bulletin: For Qubes 4.3, in affected templates and standalones: - qubes-core-agent version 4.3.48 This package will migrate from the security-testing repository to the current (stable) repository over the next two weeks after being tested by the community. [2] Once available, the package should be installed via the Qubes Update tool or its command-line equivalents. [1] In order for this security update to take effect, all affected templates must be updated with the package above, then shut down. Afterward, all qubes based on these templates (including disposables) must be restarted. All affected standalones must be updated with the package above. Credits -------- This vulnerability was first reported by Giulio Berra. Shortly after, it was independently reported by Rafal Wojtczuk. References ----------- [1] https://doc.qubes-os.org/en/latest/user/how-to-guides/how-to-update.html [2] https://doc.qubes-os.org/en/latest/user/downloading-installing-upgrading/testing.html -- The Qubes Security Team https://www.qubes-os.org/security/ **Source:** qsb-119-2026.txt ## Marek Marczykowski-Górecki’s PGP signature -----BEGIN PGP SIGNATURE----- iQIzBAABCAAdFiEELRdx/k12ftx2sIn61lWk8hgw4GoFAmqpVWsACgkQ1lWk8hgw 4GqZXQ//bjrYeDHG0AF5Zute1i8YgJD1TbvLAmI3wXDe5xJKL+gNhHyguqh3qtP3 cI5xGdY/GT940IP6QO2qHDnVxfU6QMuxEfMy6VSW0GeQ/lFbLco5Edt9UpELJCG2 h1IzyTNgtSm3C6pvrefQs6DL/A39Zl2QST0xTs/ECsJXSE7pc5BL7kO4HnSvSseQ BMFDmsLFx/JcU4s8tBGPSGH7/8Oq7YYn/Ue2LaNk3z1s2l/V1H9Jpk8dpp/yA1Uh oGkRcqio93YkqBArmJd9G1xCn33dJQHd1vffMNoDTNbuZJbrtm4ZhZSVLJ3W3CA0 ZTMaO34M83aImSaTPA+a7VLhBdBDXkfn/8ZHrT51m2flQL1uCE3C8l5H+bQYMeaE EJE3I1b7v3NZoxJ6gXk/+YSWM+E7XbuSrc6f3CYpUue0B6vhHO29xXc71EiFWz1b 1zW4QSBIUd4yEl4B+tH5ZMB3pacSbTQsW1SCTU3I428meTFJW6yjN4cPNruHF2lH Jz3JQIoKdXohJxruPaCh/ZAEWon+cz7ho98cvwH/x2zi0DoT3cyT6EtTVlD4Dg5c /XiEC0ku+IARXCoYiQbMto5PiYzcoVbwv4H0iwuzOLOPwbPKhdfwJQinlMjd2ZDb OdFehXOnmM34nwBcUANGV5ygFIttVR9bRBlz/2Wrvu88+nr7TGM= =yTNV -----END PGP SIGNATURE----- **Source:** qsb-119-2026.txt.sig.marmarek ## Simon Gaiser (aka HW42)’s PGP signature -----BEGIN PGP SIGNATURE----- iQIzBAABCgAdFiEE6hjn8EDEHdrv6aoPSsGN4REuFJAFAmqpXmAACgkQSsGN4REu FJDGoQ//QmxpMyyFvnG9srj/zYaYuFcyWd7o2lqd4ugEAQVyNJOjAl0GlXnvKVWw frH+QlZXT/BlQuV6ltzmmh2W5C43JtbBF+O6+Wnc7Imc6bDFf3rjo8xWdx6sptKA wUVcFX/pO66TTMGjGsSLZNgB6HqZnokdANYpB7MkxxeV6cBPAjFwUoLvDSrba8KG k8KBdBGw+FJ3Zt4583fW3DwKVJlbtp7SEpQG8HMswU+SHQBKclR+ceye/uwMzoej HEI0Vg2Gd3lAewa34zxicNsHlHh7OKsGFI027BxdIpZoEwbLzMThfA0+TH6t/JsN UEzh9lXD0cpuJIxHe0bSGrJL7kJN5CV9kztstr+YuH3lx52Blq7UAtw/8swvxvBB 8aFSeP8aXb9ldXuNtAxf581OmHAGmrxRpCOiQb0ehfBuNd6aQb+J29bjy1fc7F9e 9yaTlVk1cFSjKWCG/24IK2zz96sdWcoJMIE1FXNuwms4MAUNUFMPFqCT0keMeiqj yaJfWvXtoAJQPGrYClbC7D+VYKFYokBbB7c1nabpCzzuJ9uFXuQfHsb7PMYnAJh4 2PLat+BiUxiO3AATHtcrl4DEwRlu7RYW99EB3ax6WUDyxBAVWHnZ8NVoRLgj4bfr 7FJjE0wu8mKT3on0o6RLlifo7mXl1lmXZM6YcB1QD0+/zod0Q6c= =Zo3p -----END PGP SIGNATURE----- **Source:** qsb-119-2026.txt.sig.simon ## What is the purpose of this announcement? The purpose of this announcement is to inform the Qubes community that a new Qubes security bulletin (QSB) has been published. ## What is a Qubes security bulletin (QSB)? A Qubes security bulletin (QSB) is a security announcement issued by the Qubes security team. A QSB typically provides a summary and impact analysis of one or more recently-discovered software vulnerabilities, including details about patching to address them. ## Why should I care about QSBs? QSBs tell you what actions you must take in order to protect yourself from recently-discovered security vulnerabilities. In most cases, security vulnerabilities are addressed by updating normally. However, in some cases, special user action is required. In all cases, the required actions are detailed in QSBs. ## What are the PGP signatures that accompany QSBs? A PGP signature is a cryptographic digital signature made in accordance with the OpenPGP standard. PGP signatures can be cryptographically verified with programs like GNU Privacy Guard (GPG). The Qubes security team cryptographically signs all QSBs so that Qubes users have a reliable way to check whether QSBs are genuine. The only way to be certain that a QSB is authentic is by verifying its PGP signatures. ## Why should I care whether a QSB is authentic? A forged QSB could deceive you into taking actions that adversely affect the security of your Qubes OS system, such as installing malware or making configuration changes that render your system vulnerable to attack. Falsified QSBs could sow fear, uncertainty, and doubt about the security of Qubes OS or the status of the Qubes OS Project. ## How do I verify the PGP signatures on a QSB? The following command-line instructions assume a Linux system with `git` and `gpg` installed. (For Windows and Mac options, see OpenPGP software.) 1. Obtain the Qubes Master Signing Key (QMSK), e.g.: $ gpg --fetch-keys https://keys.qubes-os.org/keys/qubes-master-signing-key.asc gpg: directory '/home/user/.gnupg' created gpg: keybox '/home/user/.gnupg/pubring.kbx' created gpg: requesting key from 'https://keys.qubes-os.org/keys/qubes-master-signing-key.asc' gpg: /home/user/.gnupg/trustdb.gpg: trustdb created gpg: key DDFA1A3E36879494: public key "Qubes Master Signing Key" imported gpg: Total number processed: 1 gpg: imported: 1 (For more ways to obtain the QMSK, see How to import and authenticate the Qubes Master Signing Key.) 2. View the fingerprint of the PGP key you just imported. (Note: `gpg>` indicates a prompt inside of the GnuPG program. Type what appears after it when prompted.) $ gpg --edit-key 0x427F11FD0FAA4B080123F01CDDFA1A3E36879494 gpg (GnuPG) 2.2.27; Copyright (C) 2021 Free Software Foundation, Inc. This is free software: you are free to change and redistribute it. There is NO WARRANTY, to the extent permitted by law. pub rsa4096/DDFA1A3E36879494 created: 2010-04-01 expires: never usage: SC trust: unknown validity: unknown [ unknown] (1). Qubes Master Signing Key gpg> fpr pub rsa4096/DDFA1A3E36879494 2010-04-01 Qubes Master Signing Key Primary key fingerprint: 427F 11FD 0FAA 4B08 0123 F01C DDFA 1A3E 3687 9494 3. **Important:** At this point, you still don’t know whether the key you just imported is the genuine QMSK or a forgery. In order for this entire procedure to provide meaningful security benefits, you _must_ authenticate the QMSK out-of-band. **Do not skip this step!** The standard method is to obtain the QMSK fingerprint from _multiple independent sources in several different ways_ and check to see whether they match the key you just imported. For more information, see How to import and authenticate the Qubes Master Signing Key. **Tip:** After you have authenticated the QMSK out-of-band to your satisfaction, record the QMSK fingerprint in a safe place (or several) so that you don’t have to repeat this step in the future. 4. Once you are satisfied that you have the genuine QMSK, set its trust level to 5 (“ultimate”), then quit GnuPG with `q`. gpg> trust pub rsa4096/DDFA1A3E36879494 created: 2010-04-01 expires: never usage: SC trust: unknown validity: unknown [ unknown] (1). Qubes Master Signing Key Please decide how far you trust this user to correctly verify other users' keys (by looking at passports, checking fingerprints from different sources, etc.) 1 = I don't know or won't say 2 = I do NOT trust 3 = I trust marginally 4 = I trust fully 5 = I trust ultimately m = back to the main menu Your decision? 5 Do you really want to set this key to ultimate trust? (y/N) y pub rsa4096/DDFA1A3E36879494 created: 2010-04-01 expires: never usage: SC trust: ultimate validity: unknown [ unknown] (1). Qubes Master Signing Key Please note that the shown key validity is not necessarily correct unless you restart the program. gpg> q 5. Use Git to clone the qubes-secpack repo. $ git clone https://github.com/QubesOS/qubes-secpack.git Cloning into 'qubes-secpack'... remote: Enumerating objects: 4065, done. remote: Counting objects: 100% (1474/1474), done. remote: Compressing objects: 100% (742/742), done. remote: Total 4065 (delta 743), reused 1413 (delta 731), pack-reused 2591 Receiving objects: 100% (4065/4065), 1.64 MiB | 2.53 MiB/s, done. Resolving deltas: 100% (1910/1910), done. 6. Import the included PGP keys. (See our PGP key policies for important information about these keys.) $ gpg --import qubes-secpack/keys/*/* gpg: key 063938BA42CFA724: public key "Marek Marczykowski-Górecki (Qubes OS signing key)" imported gpg: qubes-secpack/keys/core-devs/retired: read error: Is a directory gpg: no valid OpenPGP data found. gpg: key 8C05216CE09C093C: 1 signature not checked due to a missing key gpg: key 8C05216CE09C093C: public key "HW42 (Qubes Signing Key)" imported gpg: key DA0434BC706E1FCF: public key "Simon Gaiser (Qubes OS signing key)" imported gpg: key 8CE137352A019A17: 2 signatures not checked due to missing keys gpg: key 8CE137352A019A17: public key "Andrew David Wong (Qubes Documentation Signing Key)" imported gpg: key AAA743B42FBC07A9: public key "Brennan Novak (Qubes Website & Documentation Signing)" imported gpg: key B6A0BB95CA74A5C3: public key "Joanna Rutkowska (Qubes Documentation Signing Key)" imported gpg: key F32894BE9684938A: public key "Marek Marczykowski-Górecki (Qubes Documentation Signing Key)" imported gpg: key 6E7A27B909DAFB92: public key "Hakisho Nukama (Qubes Documentation Signing Key)" imported gpg: key 485C7504F27D0A72: 1 signature not checked due to a missing key gpg: key 485C7504F27D0A72: public key "Sven Semmler (Qubes Documentation Signing Key)" imported gpg: key BB52274595B71262: public key "unman (Qubes Documentation Signing Key)" imported gpg: key DC2F3678D272F2A8: 1 signature not checked due to a missing key gpg: key DC2F3678D272F2A8: public key "Wojtek Porczyk (Qubes OS documentation signing key)" imported gpg: key FD64F4F9E9720C4D: 1 signature not checked due to a missing key gpg: key FD64F4F9E9720C4D: public key "Zrubi (Qubes Documentation Signing Key)" imported gpg: key DDFA1A3E36879494: "Qubes Master Signing Key" not changed gpg: key 1848792F9E2795E9: public key "Qubes OS Release 4 Signing Key" imported gpg: qubes-secpack/keys/release-keys/retired: read error: Is a directory gpg: no valid OpenPGP data found. gpg: key D655A4F21830E06A: public key "Marek Marczykowski-Górecki (Qubes security pack)" imported gpg: key ACC2602F3F48CB21: public key "Qubes OS Security Team" imported gpg: qubes-secpack/keys/security-team/retired: read error: Is a directory gpg: no valid OpenPGP data found. gpg: key 4AC18DE1112E1490: public key "Simon Gaiser (Qubes Security Pack signing key)" imported gpg: Total number processed: 17 gpg: imported: 16 gpg: unchanged: 1 gpg: marginals needed: 3 completes needed: 1 trust model: pgp gpg: depth: 0 valid: 1 signed: 6 trust: 0-, 0q, 0n, 0m, 0f, 1u gpg: depth: 1 valid: 6 signed: 0 trust: 6-, 0q, 0n, 0m, 0f, 0u 7. Verify signed Git tags. $ cd qubes-secpack/ $ git tag -v `git describe` object 266e14a6fae57c9a91362c9ac784d3a891f4d351 type commit tag marmarek_sec_266e14a6 tagger Marek Marczykowski-Górecki 1677757924 +0100 Tag for commit 266e14a6fae57c9a91362c9ac784d3a891f4d351 gpg: Signature made Thu 02 Mar 2023 03:52:04 AM PST gpg: using RSA key 2D1771FE4D767EDC76B089FAD655A4F21830E06A gpg: Good signature from "Marek Marczykowski-Górecki (Qubes security pack)" [full] The exact output will differ, but the final line should always start with `gpg: Good signature from...` followed by an appropriate key. The `[full]` indicates full trust, which this key inherits in virtue of being validly signed by the QMSK. 8. Verify PGP signatures, e.g.: $ cd QSBs/ $ gpg --verify qsb-087-2022.txt.sig.marmarek qsb-087-2022.txt gpg: Signature made Wed 23 Nov 2022 04:05:51 AM PST gpg: using RSA key 2D1771FE4D767EDC76B089FAD655A4F21830E06A gpg: Good signature from "Marek Marczykowski-Górecki (Qubes security pack)" [full] $ gpg --verify qsb-087-2022.txt.sig.simon qsb-087-2022.txt gpg: Signature made Wed 23 Nov 2022 03:50:42 AM PST gpg: using RSA key EA18E7F040C41DDAEFE9AA0F4AC18DE1112E1490 gpg: Good signature from "Simon Gaiser (Qubes Security Pack signing key)" [full] $ cd ../canaries/ $ gpg --verify canary-034-2023.txt.sig.marmarek canary-034-2023.txt gpg: Signature made Thu 02 Mar 2023 03:51:48 AM PST gpg: using RSA key 2D1771FE4D767EDC76B089FAD655A4F21830E06A gpg: Good signature from "Marek Marczykowski-Górecki (Qubes security pack)" [full] $ gpg --verify canary-034-2023.txt.sig.simon canary-034-2023.txt gpg: Signature made Thu 02 Mar 2023 01:47:52 AM PST gpg: using RSA key EA18E7F040C41DDAEFE9AA0F4AC18DE1112E1490 gpg: Good signature from "Simon Gaiser (Qubes Security Pack signing key)" [full] Again, the exact output will differ, but the final line of output from each `gpg --verify` command should always start with `gpg: Good signature from...` followed by an appropriate key. For this announcement (QSB-119), the commands are: $ gpg --verify qsb-119-2026.txt.sig.marmarek qsb-119-2026.txt $ gpg --verify qsb-119-2026.txt.sig.simon qsb-119-2026.txt You can also verify the signatures directly from this announcement in addition to or instead of verifying the files from the qubes-secpack. Simply copy and paste the QSB-119 text into a plain text file and do the same for both signature files. Then, perform the same authentication steps as listed above, substituting the filenames above with the names of the files you just created.

We have published Qubes Canary 048. The text of this canary and its accompanying cryptographic signatures are reproduced below. For an explanation of this announcement and instructions for authenticating this canary, please see the end of this announcement. ## Qubes Canary 048 ---===[ Qubes Canary 048 ]===--- Statements ----------- The Qubes security team members who have digitally signed this file [1] state the following: 1. The date of issue of this canary is September 09, 2026. 2. There have been 118 Qubes security bulletins published so far. 3. The Qubes Master Signing Key fingerprint is: 427F 11FD 0FAA 4B08 0123 F01C DDFA 1A3E 3687 9494 4. No warrants have ever been served to us with regard to the Qubes OS Project (e.g. to hand out the private signing keys or to introduce backdoors). 5. We plan to publish the next of these canary statements in the first fourteen days of December 2026. Special note should be taken if no new canary is published by that time or if the list of statements changes without plausible explanation. Special announcements ---------------------- None. Disclaimers and notes ---------------------- We would like to remind you that Qubes OS has been designed under the assumption that all relevant infrastructure is permanently compromised. This means that we assume NO trust in any of the servers or services which host or provide any Qubes-related data, in particular, software updates, source code repositories, and Qubes ISO downloads. This canary scheme is not infallible. Although signing the declaration makes it very difficult for a third party to produce arbitrary declarations, it does not prevent them from using force or other means, like blackmail or compromising the signers' laptops, to coerce us to produce false declarations. The proof of freshness provided below serves to demonstrate that this canary could not have been created prior to the date stated. It shows that a series of canaries was not created in advance. This declaration is merely a best effort and is provided without any guarantee or warranty. It is not legally binding in any way to anybody. None of the signers should be ever held legally responsible for any of the statements made here. Proof of freshness ------------------- Wed, 09 Sep 2026 06:09:30 +0000 Source: DER SPIEGEL - International (https://www.spiegel.de/international/index.rss) Fake Jewish Lineage: The Passport Scheme that Exploited Germany’s Nazi History BYD, Geely, Xpeng: Germany’s Vaunted Auto Industry in Dire Straits Amid Chinese Surge Amodei vs. Altman: How the Race for AI Dominance Is Increasing the Risks Boats from Eastern Libya: How Europe Is Bowing to a Libyan Warlord on Migration Moaning for the Mainland: How Taiwan Satisfies China's Lust for Pornography Source: NYT > World News (https://rss.nytimes.com/services/xml/rss/nyt/World.xml) AfD’s Far Right Win Puts New Pressure on Germany’s Leader Merz Chinese Ship Takes Arctic Shortcut: Smart Business? Or a Political Flex? Israeli Allies Ban Trade With Settlements as U.K. Cites ‘Ethnic Cleansing’ Saudi Arabia and Yemen’s Houthis Edge Back to the Brink of War Carney Says Retaliation Against U.S. Tariffs Was Unavoidable Source: BBC News (https://feeds.bbci.co.uk/news/world/rss.xml) US strikes Iranian oil tankers as Tehran targets American base in Jordan Paul Adams: British-Israeli relations at lowest ebb in decades US slaps import ban on Canadian alcohol, motorbikes and other goods 'Constantly on my mind' - 9/11 agony endures for bereaved, 25 years on South Park creators rename show 'South America' in apparent dig at Trump Source: Blockchain.info 000000000000000000017721d9b2add64d85980a3bb8587851798bb854c3d514 Footnotes ---------- [1] This file should be signed in two ways: (1) via detached PGP signatures by each of the signers, distributed together with this canary in the qubes-secpack.git repo, and (2) via digital signatures on the corresponding qubes-secpack.git repo tags. [2] [2] Don't just trust the contents of this file blindly! Verify the digital signatures! Instructions for doing so are documented here: https://doc.qubes-os.org/en/latest/project-security/security-pack.html -- The Qubes Security Team https://www.qubes-os.org/security/ Source: canary-048-2026.txt ## Marek Marczykowski-Górecki’s PGP signature -----BEGIN PGP SIGNATURE----- iQIzBAABCAAdFiEELRdx/k12ftx2sIn61lWk8hgw4GoFAmqhJaEACgkQ1lWk8hgw 4GpAUA//dvesbc30xLrZ5hRrJgPBBOaMIXjLZk2il/EljKLAMLdPOk5Y01kNLLGS nvnLU0M5U8y1Oqlfj7WybABht8SrPSBg9gI1CrRvA69urz5V6VHDUsqAMhXozdLK FgT4+SuQfiAvlXOdjPljcZO4jWXWcQMWjecYTTiQdnMNC90VkrncYjNeioh6rhaL oCim2t5ynb9wpyo7zzG9KNDtDUzPSAphSZoJhb3PJXNOxHV6RLsyoz9b1wa1c3xp IJdS1EzMf/1/bmlZwg9FnLcGVOO/TdyOSKxP4d54SVt/JmYfpk2qAVfn/NWjlzVc LqcwebzGHQ56A4kyvc04PEuMzryneYDmxboKtwKUnOyMdnOxHtpbqh/jX6T/GodA wO8oJdoT5l1ugLfFK/sGluSx6FnFoczgukFxk+cIn3l38mEUAQLshWRNL3gk8LkW cKTFBBntwlV2XfmJBFhOM4s6N74RTrNhxWlsgT4LyOCcFRIT8CCLicmvmxSgjWJo v3p+pKqLNFe0GU64KUlt3Fvc0m4hyvxPZbmzA/UOevMzssX5BHkRXQDJaknLppy+ yZp/gfBX575wlgWn+khXPYQSIcHyEuZifZoMaGnfU0OgjPMcmC4SY9xQf2cH/dN+ gTyhd0+s9RfyWDdA2l1ZvG10t1Pz5SIJecPXHFMk+F6qHEpjezI= =wcFj -----END PGP SIGNATURE----- Source: canary-048-2026.txt.sig.marmarek ## Simon Gaiser (aka HW42)’s PGP signature -----BEGIN PGP SIGNATURE----- iQIzBAABCgAdFiEE6hjn8EDEHdrv6aoPSsGN4REuFJAFAmqhK+QACgkQSsGN4REu FJCzHQ//ejKjw9KcCp8EKE/pMMSeCHmIOBDqZFsM0Ifo4rzyCVc2TqLZ6K0JviuQ 5otz/lor5rI4Z1wCR4fZO7YwWHewaX7w7yILp6tRV+9el22lhWPJMl7BavjBK92d 8WUiuab0DrlxROUDtm62mgzQ5dHcqQjj/bZZhSeq/69e/L3OJsWclOdAOt+LjSUa rXYD+bB23PZh3FGdvW0znTLbs/0XpH+RmDld8LbQvbZP6LH1+751Xxz6qe7sFOIa iIxDuUlqo9ZU43enZhN0Vug+wGltiZk3njzpPvvURKNGWyrZKo4m8tR1BdoJ+8Qy KasUPBOWrZh99IFonBCAUY5dFJScujtOWh/nihbX531nnV7X1XkUc2rieaW7zGye brxjG4s3h4/r6IfH3K38cCLw3m5luvSmOm0F1zt9xthnUp7PnNK+qOOkPNzWptsA upPVS/rjPlfAm01GDU+aqWVpv4kF74TGTMnQj112eRz+LyEnrx9LWqJZ4YsrvgYP OsrCPnfCPF0fgNsKKbMJ12b17rIXGXw/aKEqL/V3XVJUKbaGTlJU8GbBsQG7a1oD JpEWdU7I7RR40UXwGHNUnS5bSCVdAhlNEs/tnyWW2zEScAkZXu/wJTGaPA6wcTkd l1Um8S7H4Q2rRTCMGziJHjTUjdlMegcjrkEmHOzM3r78fCsZJgY= =vexT -----END PGP SIGNATURE----- Source: canary-048-2026.txt.sig.simon ## What is the purpose of this announcement? The purpose of this announcement is to inform the Qubes community that a new Qubes canary has been published. ## What is a Qubes canary? A Qubes canary is a security announcement periodically issued by the Qubes security team consisting of several statements to the effect that the signers of the canary have not been compromised. The idea is that, as long as signed canaries including such statements continue to be published, all is well. However, if the canaries should suddenly cease, if one or more signers begin declining to sign them, or if the included statements change significantly without plausible explanation, then this may indicate that something has gone wrong. The name originates from the practice in which miners would bring caged canaries into coal mines. If the level of methane gas in the mine reached a dangerous level, the canary would die, indicating to miners that they should evacuate. (See the Wikipedia article on warrant canaries for more information, but bear in mind that Qubes Canaries are not strictly limited to legal warrants.) ## Why should I care about canaries? Canaries provide an important indication about the security status of the project. If the canary is healthy, it’s a strong sign that things are running normally. However, if the canary is unhealthy, it could mean that the project or its members are being coerced in some way. ## What are some signs of an unhealthy canary? Here is a non-exhaustive list of examples: * **Dead canary.** In each canary, we state a window of time during which you should expect the next canary to be published. If no canary is published within that window of time and no good explanation is provided for missing the deadline, then the canary has died. * **Missing statement(s).** Canaries include a set of numbered statements at the top. These statements are generally the same across canaries, except for specific numbers and dates that have changed since the previous canary. If an important statement was present in older canaries but suddenly goes missing from new canaries with no correction or explanation, then this may be an indication that the signers can no longer truthfully make that statement. * **Missing signature(s).** Qubes canaries are signed by the members of the Qubes security team (see below). If one of them has been signing all canaries but suddenly and permanently stops signing new canaries without any explanation, then this may indicate that this person is under duress or can no longer truthfully sign the statements contained in the canary. ## Does every unexpected or unusual occurrence related to a canary indicate something bad? No, there are many canary-related possibilities that should _not_ worry you. Here is a non-exhaustive list of examples: * **Unusual reposts.** The only canaries that matter are the ones that are validly signed in the Qubes security pack (qubes-secpack). Reposts of canaries (like the one in this announcement) do not have any authority (except insofar as they reproduce validly-signed text from the qubes-secpack). If the actual canary in the qubes-secpack is healthy, but reposts are late, absent, or modified on the website, mailing lists, forum, or social media platforms, you should not be concerned about the canary. * **Last-minute signature(s).** If the canary is signed at the last minute but before the deadline, that’s okay. (People get busy and procrastinate sometimes.) * **Signatures at different times.** If one signature is earlier or later than the other, but both are present within a reasonable period of time, that’s okay. (For example, sometimes one signer is out of town, but we try to plan the deadlines around this.) * **Permitted changes.** If something about a canary changes without violating any of the statements in prior canaries, that’s okay. (For example, canaries are usually scheduled for the first fourteen days of a given month, but there’s no rule that says they have to be.) * **Unusual but planned changes.** If something unusual happens, but it was announced in advance, and the appropriate statements are signed, that’s okay (e.g., when Joanna left the security team and Simon joined it). In general, it would not be realistic for an organization to exist that never changed, had zero turnover, and never made mistakes. Therefore, it would be reasonable to expect such events to occur periodically, and it would be unreasonable to regard _every_ unusual or unexpected canary-related event as a sign of compromise. For example, if something usual happens with a canary, and we say it was a mistake and correct it (with valid signatures), you will have to decide for yourself whether it’s more likely that it really was just a mistake or that something is wrong and that this is how we chose to send you a subtle signal about it. This will require you to think carefully about which among many possible scenarios is most likely given the evidence available to you. Since this is fundamentally a matter of judgment, canaries are ultimately a _social_ scheme, not a technical one. ## What are the PGP signatures that accompany canaries? A PGP signature is a cryptographic digital signature made in accordance with the OpenPGP standard. PGP signatures can be cryptographically verified with programs like GNU Privacy Guard (GPG). The Qubes security team cryptographically signs all canaries so that Qubes users have a reliable way to check whether canaries are genuine. The only way to be certain that a canary is authentic is by verifying its PGP signatures. ## Why should I care whether a canary is authentic? If you fail to notice that a canary is unhealthy or has died, you may continue to trust the Qubes security team even after they have signaled via the canary (or lack thereof) that they been compromised or coerced. Alternatively, an adversary could fabricate a canary in an attempt to deceive the public. Such a canary would not be validly signed, but users who neglect to check the signatures on the fake canary would not be aware of this, so they may mistakenly believe it to be genuine, especially if it closely mimics the language of authentic canaries. Such falsified canaries could include manipulated text designed to sow fear, uncertainty, and doubt about the security of Qubes OS or the status of the Qubes OS Project. ## How do I verify the PGP signatures on a canary? The following command-line instructions assume a Linux system with `git` and `gpg` installed. (For Windows and Mac options, see OpenPGP software.) 1. Obtain the Qubes Master Signing Key (QMSK), e.g.: $ gpg --fetch-keys https://keys.qubes-os.org/keys/qubes-master-signing-key.asc gpg: directory '/home/user/.gnupg' created gpg: keybox '/home/user/.gnupg/pubring.kbx' created gpg: requesting key from 'https://keys.qubes-os.org/keys/qubes-master-signing-key.asc' gpg: /home/user/.gnupg/trustdb.gpg: trustdb created gpg: key DDFA1A3E36879494: public key "Qubes Master Signing Key" imported gpg: Total number processed: 1 gpg: imported: 1 (For more ways to obtain the QMSK, see How to import and authenticate the Qubes Master Signing Key.) 2. View the fingerprint of the PGP key you just imported. (Note: `gpg>` indicates a prompt inside of the GnuPG program. Type what appears after it when prompted.) $ gpg --edit-key 0x427F11FD0FAA4B080123F01CDDFA1A3E36879494 gpg (GnuPG) 2.2.27; Copyright (C) 2021 Free Software Foundation, Inc. This is free software: you are free to change and redistribute it. There is NO WARRANTY, to the extent permitted by law. pub rsa4096/DDFA1A3E36879494 created: 2010-04-01 expires: never usage: SC trust: unknown validity: unknown [ unknown] (1). Qubes Master Signing Key gpg> fpr pub rsa4096/DDFA1A3E36879494 2010-04-01 Qubes Master Signing Key Primary key fingerprint: 427F 11FD 0FAA 4B08 0123 F01C DDFA 1A3E 3687 9494 3. **Important:** At this point, you still don’t know whether the key you just imported is the genuine QMSK or a forgery. In order for this entire procedure to provide meaningful security benefits, you _must_ authenticate the QMSK out-of-band. **Do not skip this step!** The standard method is to obtain the QMSK fingerprint from _multiple independent sources in several different ways_ and check to see whether they match the key you just imported. For more information, see How to import and authenticate the Qubes Master Signing Key. **Tip:** After you have authenticated the QMSK out-of-band to your satisfaction, record the QMSK fingerprint in a safe place (or several) so that you don’t have to repeat this step in the future. 4. Once you are satisfied that you have the genuine QMSK, set its trust level to 5 (“ultimate”), then quit GnuPG with `q`. gpg> trust pub rsa4096/DDFA1A3E36879494 created: 2010-04-01 expires: never usage: SC trust: unknown validity: unknown [ unknown] (1). Qubes Master Signing Key Please decide how far you trust this user to correctly verify other users' keys (by looking at passports, checking fingerprints from different sources, etc.) 1 = I don't know or won't say 2 = I do NOT trust 3 = I trust marginally 4 = I trust fully 5 = I trust ultimately m = back to the main menu Your decision? 5 Do you really want to set this key to ultimate trust? (y/N) y pub rsa4096/DDFA1A3E36879494 created: 2010-04-01 expires: never usage: SC trust: ultimate validity: unknown [ unknown] (1). Qubes Master Signing Key Please note that the shown key validity is not necessarily correct unless you restart the program. gpg> q 5. Use Git to clone the qubes-secpack repo. $ git clone https://github.com/QubesOS/qubes-secpack.git Cloning into 'qubes-secpack'... remote: Enumerating objects: 4065, done. remote: Counting objects: 100% (1474/1474), done. remote: Compressing objects: 100% (742/742), done. remote: Total 4065 (delta 743), reused 1413 (delta 731), pack-reused 2591 Receiving objects: 100% (4065/4065), 1.64 MiB | 2.53 MiB/s, done. Resolving deltas: 100% (1910/1910), done. 6. Import the included PGP keys. (See our PGP key policies for important information about these keys.) $ gpg --import qubes-secpack/keys/*/* gpg: key 063938BA42CFA724: public key "Marek Marczykowski-Górecki (Qubes OS signing key)" imported gpg: qubes-secpack/keys/core-devs/retired: read error: Is a directory gpg: no valid OpenPGP data found. gpg: key 8C05216CE09C093C: 1 signature not checked due to a missing key gpg: key 8C05216CE09C093C: public key "HW42 (Qubes Signing Key)" imported gpg: key DA0434BC706E1FCF: public key "Simon Gaiser (Qubes OS signing key)" imported gpg: key 8CE137352A019A17: 2 signatures not checked due to missing keys gpg: key 8CE137352A019A17: public key "Andrew David Wong (Qubes Documentation Signing Key)" imported gpg: key AAA743B42FBC07A9: public key "Brennan Novak (Qubes Website & Documentation Signing)" imported gpg: key B6A0BB95CA74A5C3: public key "Joanna Rutkowska (Qubes Documentation Signing Key)" imported gpg: key F32894BE9684938A: public key "Marek Marczykowski-Górecki (Qubes Documentation Signing Key)" imported gpg: key 6E7A27B909DAFB92: public key "Hakisho Nukama (Qubes Documentation Signing Key)" imported gpg: key 485C7504F27D0A72: 1 signature not checked due to a missing key gpg: key 485C7504F27D0A72: public key "Sven Semmler (Qubes Documentation Signing Key)" imported gpg: key BB52274595B71262: public key "unman (Qubes Documentation Signing Key)" imported gpg: key DC2F3678D272F2A8: 1 signature not checked due to a missing key gpg: key DC2F3678D272F2A8: public key "Wojtek Porczyk (Qubes OS documentation signing key)" imported gpg: key FD64F4F9E9720C4D: 1 signature not checked due to a missing key gpg: key FD64F4F9E9720C4D: public key "Zrubi (Qubes Documentation Signing Key)" imported gpg: key DDFA1A3E36879494: "Qubes Master Signing Key" not changed gpg: key 1848792F9E2795E9: public key "Qubes OS Release 4 Signing Key" imported gpg: qubes-secpack/keys/release-keys/retired: read error: Is a directory gpg: no valid OpenPGP data found. gpg: key D655A4F21830E06A: public key "Marek Marczykowski-Górecki (Qubes security pack)" imported gpg: key ACC2602F3F48CB21: public key "Qubes OS Security Team" imported gpg: qubes-secpack/keys/security-team/retired: read error: Is a directory gpg: no valid OpenPGP data found. gpg: key 4AC18DE1112E1490: public key "Simon Gaiser (Qubes Security Pack signing key)" imported gpg: Total number processed: 17 gpg: imported: 16 gpg: unchanged: 1 gpg: marginals needed: 3 completes needed: 1 trust model: pgp gpg: depth: 0 valid: 1 signed: 6 trust: 0-, 0q, 0n, 0m, 0f, 1u gpg: depth: 1 valid: 6 signed: 0 trust: 6-, 0q, 0n, 0m, 0f, 0u 7. Verify signed Git tags. $ cd qubes-secpack/ $ git tag -v `git describe` object 266e14a6fae57c9a91362c9ac784d3a891f4d351 type commit tag marmarek_sec_266e14a6 tagger Marek Marczykowski-Górecki 1677757924 +0100 Tag for commit 266e14a6fae57c9a91362c9ac784d3a891f4d351 gpg: Signature made Thu 02 Mar 2023 03:52:04 AM PST gpg: using RSA key 2D1771FE4D767EDC76B089FAD655A4F21830E06A gpg: Good signature from "Marek Marczykowski-Górecki (Qubes security pack)" [full] The exact output will differ, but the final line should always start with `gpg: Good signature from...` followed by an appropriate key. The `[full]` indicates full trust, which this key inherits in virtue of being validly signed by the QMSK. 8. Verify PGP signatures, e.g.: $ cd QSBs/ $ gpg --verify qsb-087-2022.txt.sig.marmarek qsb-087-2022.txt gpg: Signature made Wed 23 Nov 2022 04:05:51 AM PST gpg: using RSA key 2D1771FE4D767EDC76B089FAD655A4F21830E06A gpg: Good signature from "Marek Marczykowski-Górecki (Qubes security pack)" [full] $ gpg --verify qsb-087-2022.txt.sig.simon qsb-087-2022.txt gpg: Signature made Wed 23 Nov 2022 03:50:42 AM PST gpg: using RSA key EA18E7F040C41DDAEFE9AA0F4AC18DE1112E1490 gpg: Good signature from "Simon Gaiser (Qubes Security Pack signing key)" [full] $ cd ../canaries/ $ gpg --verify canary-034-2023.txt.sig.marmarek canary-034-2023.txt gpg: Signature made Thu 02 Mar 2023 03:51:48 AM PST gpg: using RSA key 2D1771FE4D767EDC76B089FAD655A4F21830E06A gpg: Good signature from "Marek Marczykowski-Górecki (Qubes security pack)" [full] $ gpg --verify canary-034-2023.txt.sig.simon canary-034-2023.txt gpg: Signature made Thu 02 Mar 2023 01:47:52 AM PST gpg: using RSA key EA18E7F040C41DDAEFE9AA0F4AC18DE1112E1490 gpg: Good signature from "Simon Gaiser (Qubes Security Pack signing key)" [full] Again, the exact output will differ, but the final line of output from each `gpg --verify` command should always start with `gpg: Good signature from...` followed by an appropriate key. For this announcement (Qubes Canary 048), the commands are: $ gpg --verify canary-048-2026.txt.sig.marmarek canary-048-2026.txt $ gpg --verify canary-048-2026.txt.sig.simon canary-048-2026.txt You can also verify the signatures directly from this announcement in addition to or instead of verifying the files from the qubes-secpack. Simply copy and paste the Qubes Canary 048 text into a plain text file and do the same for both signature files. Then, perform the same authentication steps as listed above, substituting the filenames above with the names of the files you just created.

The Xen Project has released one or more Xen security advisories (XSAs). The security of Qubes OS is **not** affected. ## XSAs that DO affect the security of Qubes OS The following XSAs **do affect** the security of Qubes OS: * (none) ## XSAs that DO NOT affect the security of Qubes OS The following XSAs **do not affect** the security of Qubes OS, and no user action is necessary: * XSA-509: Denial of service only. * XSA-510: Denial of service only. * XSA-511: Qubes OS does not use XSM silo. * XSA-512: Qubes OS does not use oxenstored. * XSA-513: Qubes OS does not use tapdisk. ## About this announcement Qubes OS uses the Xen hypervisor as part of its architecture. When the Xen Project publicly discloses a vulnerability in the Xen hypervisor, they issue a notice called a Xen security advisory (XSA). Vulnerabilities in the Xen hypervisor sometimes have security implications for Qubes OS. When they do, we issue a notice called a Qubes security bulletin (QSB). (QSBs are also issued for non-Xen vulnerabilities.) However, QSBs can provide only _positive_ confirmation that certain XSAs _do_ affect the security of Qubes OS. QSBs cannot provide _negative_ confirmation that other XSAs do _not_ affect the security of Qubes OS. Therefore, we also maintain an XSA tracker, which is a comprehensive list of all XSAs publicly disclosed to date, including whether each one affects the security of Qubes OS. When new XSAs are published, we add them to the XSA tracker and publish a notice like this one in order to inform Qubes users that a new batch of XSAs has been released and whether each one affects the security of Qubes OS.

We have published Qubes Security Bulletin (QSB) 118: Dom0 arbitrary code execution in qvm-copy-to-vm error reporting. The text of this QSB and its accompanying cryptographic signatures are reproduced below, followed by a general explanation of this announcement and authentication instructions. ## Qubes Security Bulletin 118 ---===[ Qubes Security Bulletin 118 ]===--- 2026-08-28 Dom0 arbitrary code execution in qvm-copy-to-vm error reporting User action ------------ Continue to update normally [1] in order to receive the security updates described in the "Patching" section below. No other user action is required in response to this QSB. Summary -------- If `qvm-copy-to-vm` is used to copy a file from dom0 to a malicious qube, that qube can inject an arbitrary command into dom0. Impact ------- If an attacker has compromised a qube, and if the user initiates a `qvm-copy-to-vm` call from dom0 to the compromised qube, then the attacker can exploit this vulnerability in order to inject an arbitrary command into dom0, which allows the attacker to take control of Qubes OS. Technical details ------------------ The `qvm-copy-to-vm` tool allows copying files from dom0 to a specified qube. It uses the "qfile" protocol, which is a simplified archive format, including simple file metadata (much simpler than `tar` or `cpio`). The protocol also includes transfer confirmation at the end, which is sent by the target back to the source. This confirmation includes a checksum of all the transferred files, an error code (if any), and the name of the last received file. In the case of an error, as reported by the error code field, dom0 displays a GUI message that includes the error information and the name of the affected file, as reported by the target qube. The vulnerability exists in the processing of that file name: 1. The `wait_for_result()` function calls `sanitize_remote_filename()` on the received name before passing it to the error handler: linux-utils/qrexec-lib/pack.c: 55 static void sanitize_remote_filename(char *untrusted_filename) 56 { 57 for (; *untrusted_filename; ++untrusted_filename) { 58 if (*untrusted_filename < ' ' || 59 *untrusted_filename > '~' || 60 *untrusted_filename == '"') 61 *untrusted_filename = '_'; 62 } 63 } 64 65 void wait_for_result(void) 66 { ... 98 /* sanitize the remote filename */ 99 sanitize_remote_filename(last_filename); 100 101 errno = hdr.error_code; 102 if (hdr.error_code != 0) { 103 switch (hdr.error_code) { 104 case EEXIST: 105 call_error_handler("A file named \"%s\" already exists in QubesIncoming dir", last_filename); 106 break; ... 2. Then, `call_error_handler()` calls the dom0 variant of the error reporting function -- `gui_fatal()` -> `display_error()`, which uses `system()` to launch the actual error dialog: core-admin-linux/file-copy-vm/qfile-dom0-agent.c: 15 void display_error(const char *fmt, va_list args) { 16 char *dialog_cmd; 17 char buf[1024]; 18 struct stat st_buf; 19 int ret; 20 21 (void) vsnprintf(buf, sizeof(buf), fmt, args); 22 ret = stat("/usr/bin/kdialog", &st_buf); 23 #define KDIALOG_CMD "kdialog --title 'File copy/move error' --sorry " 24 #define ZENITY_CMD "zenity --title 'File copy/move error' --warning --text " 25 if (asprintf(&dialog_cmd, "%s '%s: %s (error type: %s)'", 26 ret==0 ? KDIALOG_CMD : ZENITY_CMD, 27 program_invocation_short_name, buf, strerror(errno)) < 0) { 28 fprintf(stderr, "Failed to allocate memory for error message :(\n"); 29 return; 30 } 31 #undef KDIALOG_CMD 32 #undef ZENITY_CMD 33 fprintf(stderr, "%s\n", buf); 34 system(dialog_cmd); 35 } 36 37 _Noreturn void gui_fatal(const char *fmt, ...) { 38 va_list args; 39 va_start(args, fmt); 40 display_error(fmt, args); 41 va_end(args); 42 exit(1); 43 } The problem is that `sanitize_remote_filename()` removes only non-ASCII characters (and double quotation marks) but leaves shell meta-characters in place. Then, `system()` runs the constructed command, including the attacker-controlled name via the shell. Note that the VM variant of `qvm-copy-to-vm` is not affected, as its version of the error reporting function does not use `system()`: core-agent-linux/qubes-rpc/gui-fatal.c: 16 static void produce_message(const char *type, const char *fmt, va_list args) 17 { ... 31 if (progress_type && !strcmp(progress_type, "gui")) 32 { 33 switch (fork()) 34 { 35 case -1: 36 exit(1); // what else 37 case 0: 38 if (geteuid() == 0) { 39 if (setuid(getuid()) != 0) { 40 perror("setuid failed, not calling zenity/kdialog"); 41 exit(1); 42 } 43 } 44 fix_display(); 45 execlp("/usr/bin/zenity", "zenity", "--error", "--text", dialog_msg, NULL); 46 execlp("/usr/bin/kdialog", "kdialog", "--sorry", dialog_msg, NULL); 47 exit(1); 48 default:; 49 } 50 } 51 free(dialog_msg); 52 } 53 54 void gui_fatal(const char *fmt, ...) 55 { 56 va_list args; 57 va_start(args, fmt); 58 produce_message("Fatal error", fmt, args); 59 va_end(args); 60 exit(1); 61 } Affected systems ----------------- All Qubes OS releases are affected. Patching --------- The following package contains the security update that addresses the vulnerability described in this bulletin: For Qubes 4.3, in dom0: - qubes-core-dom0-linux, version 4.3.22 This package will migrate from the security-testing repository to the current (stable) repository after a short period of testing by the community. [2] Once available, the package should be installed via the Qubes Update tool or its command-line equivalents. [1] Credits -------- The vulnerability was discovered by Tim C. References ----------- [1] https://doc.qubes-os.org/en/latest/user/how-to-guides/how-to-update.html [2] https://doc.qubes-os.org/en/latest/user/downloading-installing-upgrading/testing.html -- The Qubes Security Team https://www.qubes-os.org/security/ **Source:** qsb-118-2026.txt ## Marek Marczykowski-Górecki’s PGP signature -----BEGIN PGP SIGNATURE----- iQIzBAABCAAdFiEELRdx/k12ftx2sIn61lWk8hgw4GoFAmqSIHAACgkQ1lWk8hgw 4GoFoQ/+PavdhVipF8/C2uLvBrYcdUmPA8FraC89p4DLzAoh2EUOerSjzPSqyTwJ S50jPNVHYiP6GaHsHoBNuRd8S9IN1GhyHfSRabjgcV/TfhXLXk8LrPVegq2IRMY6 FzkbBdpIUNn0gILeBJXyDhF50weRvrg7SZuwmjYvKUPHb4mA6wHEw01cuj54wVYW iL/byB7ULnvlQWnsvKSYmSM3u+b9gOz2+jinNh2qRNg3pP3MUv1gQMFKH9CN5wE1 BiPn1bIn5v9V5RcG4nB6qgtqSE1JgB5a9KYJ3gNhGKA0N3Mnf+wS3LfWeU+0xmjW PtWjMF+d1ZppT3yEeQj1jyyAemmwkB5zl+c/6FcEX8zvWGO2aYT/xe5yTbW7kVsM js+FiF4opVMRx3t85WfbkN6Pu0F/bNP0OsE2IJ2G7T6v9gfzb4RfuLYdb01p9Mw2 RBZVP+tcQb7gtXdysapkLsIO+ST8AcewocokiPF3st+QeB6v/3pl+aab2NojXoUk UzoJvRRd3e/KtAV1k1EAtajG5O8HFerW9LaULOGs6nPbVDBRLhJp0nlec5ZuRbpX jaJGgXzD/QntiNiWH1iaB7NxeZJPzKGg8O7MPUvQV4Cn02uoE5J5EY8XZrGhNPVl D4HHrQb+dMrwImEAGovHMdqVPJIiTGRFm5umwpKK8NRVWGjpsu8= =fHjz -----END PGP SIGNATURE----- **Source:** qsb-118-2026.txt.sig.marmarek ## Simon Gaiser (aka HW42)’s PGP signature -----BEGIN PGP SIGNATURE----- iQIzBAABCgAdFiEE6hjn8EDEHdrv6aoPSsGN4REuFJAFAmqSRk0ACgkQSsGN4REu FJC8wQ//UOa2EdMZpIDLaYropqMHyt7cVlm3Ad4zpgqmteWOUSS2z6Y3DLA2b0Ng xVDsmgJcoxqMt0tbzU9awSB/v41CKPQlXnevEFucwZWgeoQIhnZwr7c6zo2unngv wc2eMMsIL/7QX2DPotoieshryTUB6kbb1hKwiXojWOJKTwVvQPRZmU6hWLAXtg7G F4Ar/XMm2DR+KstIHFpvP+IWdS41+SWjIgjJJraUl5BE7mDF51M8vR4IvVM9Td8w bb1ENAFO2W/ZnYnqGJpMmzWVhDzxjkikH9TT3CZmdulXa7ggK2V2EgBDJ681XtW+ jOC9f5OJjoVHc5LtPsAMZxL3sGbfOBfogK5Fwpi6lmzjcG3oCB6MMvEkveZRaSiO H8vPl4H1dEIUKSA1LGZWEgY8RjuX0N4pnNOLzbn86tMpqYLtNBqGZ2/r8WkJSfXS fYWyVAtF9kcy8scb4lYlsdfD7gZ8wH7dl/iUKikiS3NyFdAlYvb0OZd6c7BZwD2C +YLHlo03he9WE1GbLoPPzqTN8VnunJ9eyyCs56SsHL5CYLfLnT95kMssAd+uJypo 7QZj3+xz7i2kaqK4osEL+5WUR47DyJEgKP8bMPeCV5ZZFC85eVKAn4BzYULx6tff wVin+t9uZ2kwur7IyG+8Bb1PUgr+vATsVW1QcrfcRT6ujY4VDDs= =1/K/ -----END PGP SIGNATURE----- **Source:** qsb-118-2026.txt.sig.simon ## What is the purpose of this announcement? The purpose of this announcement is to inform the Qubes community that a new Qubes security bulletin (QSB) has been published. ## What is a Qubes security bulletin (QSB)? A Qubes security bulletin (QSB) is a security announcement issued by the Qubes security team. A QSB typically provides a summary and impact analysis of one or more recently-discovered software vulnerabilities, including details about patching to address them. ## Why should I care about QSBs? QSBs tell you what actions you must take in order to protect yourself from recently-discovered security vulnerabilities. In most cases, security vulnerabilities are addressed by updating normally. However, in some cases, special user action is required. In all cases, the required actions are detailed in QSBs. ## What are the PGP signatures that accompany QSBs? A PGP signature is a cryptographic digital signature made in accordance with the OpenPGP standard. PGP signatures can be cryptographically verified with programs like GNU Privacy Guard (GPG). The Qubes security team cryptographically signs all QSBs so that Qubes users have a reliable way to check whether QSBs are genuine. The only way to be certain that a QSB is authentic is by verifying its PGP signatures. ## Why should I care whether a QSB is authentic? A forged QSB could deceive you into taking actions that adversely affect the security of your Qubes OS system, such as installing malware or making configuration changes that render your system vulnerable to attack. Falsified QSBs could sow fear, uncertainty, and doubt about the security of Qubes OS or the status of the Qubes OS Project. ## How do I verify the PGP signatures on a QSB? The following command-line instructions assume a Linux system with `git` and `gpg` installed. (For Windows and Mac options, see OpenPGP software.) 1. Obtain the Qubes Master Signing Key (QMSK), e.g.: $ gpg --fetch-keys https://keys.qubes-os.org/keys/qubes-master-signing-key.asc gpg: directory '/home/user/.gnupg' created gpg: keybox '/home/user/.gnupg/pubring.kbx' created gpg: requesting key from 'https://keys.qubes-os.org/keys/qubes-master-signing-key.asc' gpg: /home/user/.gnupg/trustdb.gpg: trustdb created gpg: key DDFA1A3E36879494: public key "Qubes Master Signing Key" imported gpg: Total number processed: 1 gpg: imported: 1 (For more ways to obtain the QMSK, see How to import and authenticate the Qubes Master Signing Key.) 2. View the fingerprint of the PGP key you just imported. (Note: `gpg>` indicates a prompt inside of the GnuPG program. Type what appears after it when prompted.) $ gpg --edit-key 0x427F11FD0FAA4B080123F01CDDFA1A3E36879494 gpg (GnuPG) 2.2.27; Copyright (C) 2021 Free Software Foundation, Inc. This is free software: you are free to change and redistribute it. There is NO WARRANTY, to the extent permitted by law. pub rsa4096/DDFA1A3E36879494 created: 2010-04-01 expires: never usage: SC trust: unknown validity: unknown [ unknown] (1). Qubes Master Signing Key gpg> fpr pub rsa4096/DDFA1A3E36879494 2010-04-01 Qubes Master Signing Key Primary key fingerprint: 427F 11FD 0FAA 4B08 0123 F01C DDFA 1A3E 3687 9494 3. **Important:** At this point, you still don’t know whether the key you just imported is the genuine QMSK or a forgery. In order for this entire procedure to provide meaningful security benefits, you _must_ authenticate the QMSK out-of-band. **Do not skip this step!** The standard method is to obtain the QMSK fingerprint from _multiple independent sources in several different ways_ and check to see whether they match the key you just imported. For more information, see How to import and authenticate the Qubes Master Signing Key. **Tip:** After you have authenticated the QMSK out-of-band to your satisfaction, record the QMSK fingerprint in a safe place (or several) so that you don’t have to repeat this step in the future. 4. Once you are satisfied that you have the genuine QMSK, set its trust level to 5 (“ultimate”), then quit GnuPG with `q`. gpg> trust pub rsa4096/DDFA1A3E36879494 created: 2010-04-01 expires: never usage: SC trust: unknown validity: unknown [ unknown] (1). Qubes Master Signing Key Please decide how far you trust this user to correctly verify other users' keys (by looking at passports, checking fingerprints from different sources, etc.) 1 = I don't know or won't say 2 = I do NOT trust 3 = I trust marginally 4 = I trust fully 5 = I trust ultimately m = back to the main menu Your decision? 5 Do you really want to set this key to ultimate trust? (y/N) y pub rsa4096/DDFA1A3E36879494 created: 2010-04-01 expires: never usage: SC trust: ultimate validity: unknown [ unknown] (1). Qubes Master Signing Key Please note that the shown key validity is not necessarily correct unless you restart the program. gpg> q 5. Use Git to clone the qubes-secpack repo. $ git clone https://github.com/QubesOS/qubes-secpack.git Cloning into 'qubes-secpack'... remote: Enumerating objects: 4065, done. remote: Counting objects: 100% (1474/1474), done. remote: Compressing objects: 100% (742/742), done. remote: Total 4065 (delta 743), reused 1413 (delta 731), pack-reused 2591 Receiving objects: 100% (4065/4065), 1.64 MiB | 2.53 MiB/s, done. Resolving deltas: 100% (1910/1910), done. 6. Import the included PGP keys. (See our PGP key policies for important information about these keys.) $ gpg --import qubes-secpack/keys/*/* gpg: key 063938BA42CFA724: public key "Marek Marczykowski-Górecki (Qubes OS signing key)" imported gpg: qubes-secpack/keys/core-devs/retired: read error: Is a directory gpg: no valid OpenPGP data found. gpg: key 8C05216CE09C093C: 1 signature not checked due to a missing key gpg: key 8C05216CE09C093C: public key "HW42 (Qubes Signing Key)" imported gpg: key DA0434BC706E1FCF: public key "Simon Gaiser (Qubes OS signing key)" imported gpg: key 8CE137352A019A17: 2 signatures not checked due to missing keys gpg: key 8CE137352A019A17: public key "Andrew David Wong (Qubes Documentation Signing Key)" imported gpg: key AAA743B42FBC07A9: public key "Brennan Novak (Qubes Website & Documentation Signing)" imported gpg: key B6A0BB95CA74A5C3: public key "Joanna Rutkowska (Qubes Documentation Signing Key)" imported gpg: key F32894BE9684938A: public key "Marek Marczykowski-Górecki (Qubes Documentation Signing Key)" imported gpg: key 6E7A27B909DAFB92: public key "Hakisho Nukama (Qubes Documentation Signing Key)" imported gpg: key 485C7504F27D0A72: 1 signature not checked due to a missing key gpg: key 485C7504F27D0A72: public key "Sven Semmler (Qubes Documentation Signing Key)" imported gpg: key BB52274595B71262: public key "unman (Qubes Documentation Signing Key)" imported gpg: key DC2F3678D272F2A8: 1 signature not checked due to a missing key gpg: key DC2F3678D272F2A8: public key "Wojtek Porczyk (Qubes OS documentation signing key)" imported gpg: key FD64F4F9E9720C4D: 1 signature not checked due to a missing key gpg: key FD64F4F9E9720C4D: public key "Zrubi (Qubes Documentation Signing Key)" imported gpg: key DDFA1A3E36879494: "Qubes Master Signing Key" not changed gpg: key 1848792F9E2795E9: public key "Qubes OS Release 4 Signing Key" imported gpg: qubes-secpack/keys/release-keys/retired: read error: Is a directory gpg: no valid OpenPGP data found. gpg: key D655A4F21830E06A: public key "Marek Marczykowski-Górecki (Qubes security pack)" imported gpg: key ACC2602F3F48CB21: public key "Qubes OS Security Team" imported gpg: qubes-secpack/keys/security-team/retired: read error: Is a directory gpg: no valid OpenPGP data found. gpg: key 4AC18DE1112E1490: public key "Simon Gaiser (Qubes Security Pack signing key)" imported gpg: Total number processed: 17 gpg: imported: 16 gpg: unchanged: 1 gpg: marginals needed: 3 completes needed: 1 trust model: pgp gpg: depth: 0 valid: 1 signed: 6 trust: 0-, 0q, 0n, 0m, 0f, 1u gpg: depth: 1 valid: 6 signed: 0 trust: 6-, 0q, 0n, 0m, 0f, 0u 7. Verify signed Git tags. $ cd qubes-secpack/ $ git tag -v `git describe` object 266e14a6fae57c9a91362c9ac784d3a891f4d351 type commit tag marmarek_sec_266e14a6 tagger Marek Marczykowski-Górecki 1677757924 +0100 Tag for commit 266e14a6fae57c9a91362c9ac784d3a891f4d351 gpg: Signature made Thu 02 Mar 2023 03:52:04 AM PST gpg: using RSA key 2D1771FE4D767EDC76B089FAD655A4F21830E06A gpg: Good signature from "Marek Marczykowski-Górecki (Qubes security pack)" [full] The exact output will differ, but the final line should always start with `gpg: Good signature from...` followed by an appropriate key. The `[full]` indicates full trust, which this key inherits in virtue of being validly signed by the QMSK. 8. Verify PGP signatures, e.g.: $ cd QSBs/ $ gpg --verify qsb-087-2022.txt.sig.marmarek qsb-087-2022.txt gpg: Signature made Wed 23 Nov 2022 04:05:51 AM PST gpg: using RSA key 2D1771FE4D767EDC76B089FAD655A4F21830E06A gpg: Good signature from "Marek Marczykowski-Górecki (Qubes security pack)" [full] $ gpg --verify qsb-087-2022.txt.sig.simon qsb-087-2022.txt gpg: Signature made Wed 23 Nov 2022 03:50:42 AM PST gpg: using RSA key EA18E7F040C41DDAEFE9AA0F4AC18DE1112E1490 gpg: Good signature from "Simon Gaiser (Qubes Security Pack signing key)" [full] $ cd ../canaries/ $ gpg --verify canary-034-2023.txt.sig.marmarek canary-034-2023.txt gpg: Signature made Thu 02 Mar 2023 03:51:48 AM PST gpg: using RSA key 2D1771FE4D767EDC76B089FAD655A4F21830E06A gpg: Good signature from "Marek Marczykowski-Górecki (Qubes security pack)" [full] $ gpg --verify canary-034-2023.txt.sig.simon canary-034-2023.txt gpg: Signature made Thu 02 Mar 2023 01:47:52 AM PST gpg: using RSA key EA18E7F040C41DDAEFE9AA0F4AC18DE1112E1490 gpg: Good signature from "Simon Gaiser (Qubes Security Pack signing key)" [full] Again, the exact output will differ, but the final line of output from each `gpg --verify` command should always start with `gpg: Good signature from...` followed by an appropriate key. For this announcement (QSB-118), the commands are: $ gpg --verify qsb-118-2026.txt.sig.marmarek qsb-118-2026.txt $ gpg --verify qsb-118-2026.txt.sig.simon qsb-118-2026.txt You can also verify the signatures directly from this announcement in addition to or instead of verifying the files from the qubes-secpack. Simply copy and paste the QSB-118 text into a plain text file and do the same for both signature files. Then, perform the same authentication steps as listed above, substituting the filenames above with the names of the files you just created.

We have published Qubes Security Bulletin (QSB) 117: Intel CPU firmware vulnerabilities. The text of this QSB and its accompanying cryptographic signatures are reproduced below, followed by a general explanation of this announcement and authentication instructions. ## Qubes Security Bulletin 117 ---===[ Qubes Security Bulletin 117 ]===--- 2026-08-28 Intel CPU firmware vulnerabilities User action ------------ Continue to update normally [1] in order to receive the security updates described in the "Patching" section below. No other user action is required in response to this QSB. Summary -------- On 2026-08-11, Intel published "microcode-20260811 Release," [3] which is associated with several Intel security advisories. Among these security advisories, we suspect the following may apply to Qubes OS: - "2026.3 IPU, Intel Processor Load Value Injection Zero Data Advisory" (INTEL-SA-01423) [4] - "Intel Processor Firmware Advisory - 01428" (INTEL-SA-01428) [5] - "Intel Processor Firmware Advisory - 01435" (INTEL-SA-01435) [6] - "2026.3 IPU, Intel Processor Firmware Advisory" (INTEL-SA-01441) [7] - "2026.3 IPU, Intel Xeon Processor Firmware Advisory" (INTEL-SA-01442) [8] Unfortunately, these advisories do not provide sufficient information for us to make a definitive assessment about the extent to which these vulnerabilities affect the security of Qubes OS. Based on the limited information available, we cannot exclude possibility of a cross-qube attack. Impact ------- On affected systems, an attacker who has managed to compromise one qube can attempt to exploit these vulnerabilities in order to infer data belonging to other qubes or escalate their privileges. Affected systems ----------------- Only systems with one of the following Intel CPUs are affected by at least some of the advisories: - 10th Generation Intel Core - 11th Generation Intel Core - Intel Core Ultra, Series 1 to 3 - various Xeon variants For a more detailed list of affected products see Intel's advisories. Note: As of this writing, Intel has withdrawn the relevant update for Meteor Lake (Intel Core Ultra Series 2) CPUs "due to functional issues" [9]. Due to limited information, the impact of the vulnerabilities discussed in this bulletin on systems without the relevant update is unclear. Patching --------- The following package contains the security update that addresses the vulnerability described in this bulletin: For Qubes 4.3, in dom0: - microcode_ctl version 2.1.20260812 Note: This package has already finished migrating from the security-testing repository to the current (stable) repository after being tested by the community. [2] (This QSB is being published later than usual.) The package, which is already available to all users, should be installed via the Qubes Update tool or its command-line equivalents. [1] Dom0 must be restarted afterward in order for the update to take effect. If you use Anti Evil Maid, you will need to reseal your secret passphrase to new PCR values, as PCR18+19 will change due to the new microcode updates. Credits -------- See Intel's advisories. References ----------- [1] https://doc.qubes-os.org/en/latest/user/how-to-guides/how-to-update.html [2] https://doc.qubes-os.org/en/latest/user/downloading-installing-upgrading/testing.html [3] https://github.com/intel/Intel-Linux-Processor-Microcode-Data-Files/blob/main/releasenote.md#microcode-20260811 [4] https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01423.html [5] https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01428.html [6] https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01435.html [7] https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01441.html [8] https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01442.html [9] https://github.com/intel/Intel-Linux-Processor-Microcode-Data-Files/blob/main/releasenote.md#microcode-20260812 -- The Qubes Security Team https://www.qubes-os.org/security/ **Source:** qsb-117-2026.txt ## Marek Marczykowski-Górecki’s PGP signature -----BEGIN PGP SIGNATURE----- iQIzBAABCAAdFiEELRdx/k12ftx2sIn61lWk8hgw4GoFAmqSEC8ACgkQ1lWk8hgw 4Go3Xw/+LdLu3Dx+S1iH8YDpk2Ef2WJwXNl+Msmt+cTntk/wdEvsAeRWc0/t85fZ ySfiYIAq+PvED2G7rSbVmgqWp3sPNCaSS89Penr3praoLfxRxLc23HbLQrabnKgK 2TNRiFlk+OSqvjqvItn/y+kyxB4TZAnNtDHu9Eins/B0gVAz+P//aSFVOb42UTo9 7gLNWpW1CxflQqKfNnEqxah5m2iH72pMzir6F8fXC9JFMp1PWcvn1cRfKHrAs3lw qw7kUz2mByT1qHIMs/iQ6PA4bOhlo0km1M+z+sFhyXNvsdz2JlAnlViX7ZOCCxrb YoJd/VPnaH9xtUUh++iDmtIyylxTlx7vmOb/WEefucD+EH7zM5x3BdKb7M0vpKgy vJU3a5+pY90opla7hT8GWVuIpzhBSLQlhR4RNLWSdu+pQeWqUPG2rapww0B3/Hia t98H76iMMCDvy74Bj+hChrO95wgY35JJveSXF51WiJmOjofxFeyxgTBrlcjlmpkb kUybNm8fm9LZAOG6zFJIYJN0q0+tKu0qc4Z1cU+EIIL6G5msMUIMKXV3Tg/KpUW/ Yo3dGYUUTVCsmKtaXw9ASRvnaHS3ADC6wRZK5XSkqsXNVoQI0sWkik5vn0VvS+LW VdOSWdoQGJRAAEpRmM/grsxgqq3Sn+Tck2g3IcgK+aRysClb6z8= =Xehb -----END PGP SIGNATURE----- **Source:** qsb-117-2026.txt.sig.marmarek ## Simon Gaiser (aka HW42)’s PGP signature -----BEGIN PGP SIGNATURE----- iQIzBAABCgAdFiEE6hjn8EDEHdrv6aoPSsGN4REuFJAFAmqSEywACgkQSsGN4REu FJDCww//aucPqi/Fujn0/aVD2zSwNw9+b+8KulNRODaP86MaNu9kUs6+TNIOvGOx egeJim/vCIbdehCzd2x1+GKonmtlQzHTFE3VKCJXQ7u74/fa2cSIZwmjjwdjhbgs 78m4grmdsW4UtQGBEku6M4Nl4vYDjbw3orCwONf4rqOG8dsHK0REJnBnXTeq6aAo Q/3NfuE5bBMQkl4FCnLuEKw1ZgC89gFLtYT5A2B2cQlvyEdNqe7tiMV7bczxQUEY tiPnfcSSnRvT7+wrZ3n4XG1e2IfLX7icMsMqknLD8kla1qf5NpvV2YoRwsWBc6C2 jIGpOjuw/I9XVUHOuWe2+PCSVZswC2AZYJ7Y/sD/8G7eM4YLB7c65EwUCz/YhdU+ 4l6MuC94A9UMI8NLx0DiRqTeDkadgJby1IoJOkBKurM6zoi0fyF7FQwvmNosMAIA vEwESYdUUr4j5gLzmRb7kMyr93XCeMk9Iqzuwe3f5081NCT5Th/tWLjsBa0Dnw4b JeFjvtPO6W2dBR2MezQ+v/VlcIxOgwPOeS/EhnNx6ykPmEbZMVjR7JHe5CO6npq7 /M6vFvrXoVahDn4QQTTcYpvu6NUcAagrGJQGwLaaOpc7Z03jZOAQMMx1SPjPmsP3 /KDsXFWblRYq7kNAqhmgAqJt/XQcDSp7MnPdZ1jQbvnurRHmJX4= =XApt -----END PGP SIGNATURE----- **Source:** qsb-117-2026.txt.sig.simon ## What is the purpose of this announcement? The purpose of this announcement is to inform the Qubes community that a new Qubes security bulletin (QSB) has been published. ## What is a Qubes security bulletin (QSB)? A Qubes security bulletin (QSB) is a security announcement issued by the Qubes security team. A QSB typically provides a summary and impact analysis of one or more recently-discovered software vulnerabilities, including details about patching to address them. ## Why should I care about QSBs? QSBs tell you what actions you must take in order to protect yourself from recently-discovered security vulnerabilities. In most cases, security vulnerabilities are addressed by updating normally. However, in some cases, special user action is required. In all cases, the required actions are detailed in QSBs. ## What are the PGP signatures that accompany QSBs? A PGP signature is a cryptographic digital signature made in accordance with the OpenPGP standard. PGP signatures can be cryptographically verified with programs like GNU Privacy Guard (GPG). The Qubes security team cryptographically signs all QSBs so that Qubes users have a reliable way to check whether QSBs are genuine. The only way to be certain that a QSB is authentic is by verifying its PGP signatures. ## Why should I care whether a QSB is authentic? A forged QSB could deceive you into taking actions that adversely affect the security of your Qubes OS system, such as installing malware or making configuration changes that render your system vulnerable to attack. Falsified QSBs could sow fear, uncertainty, and doubt about the security of Qubes OS or the status of the Qubes OS Project. ## How do I verify the PGP signatures on a QSB? The following command-line instructions assume a Linux system with `git` and `gpg` installed. (For Windows and Mac options, see OpenPGP software.) 1. Obtain the Qubes Master Signing Key (QMSK), e.g.: $ gpg --fetch-keys https://keys.qubes-os.org/keys/qubes-master-signing-key.asc gpg: directory '/home/user/.gnupg' created gpg: keybox '/home/user/.gnupg/pubring.kbx' created gpg: requesting key from 'https://keys.qubes-os.org/keys/qubes-master-signing-key.asc' gpg: /home/user/.gnupg/trustdb.gpg: trustdb created gpg: key DDFA1A3E36879494: public key "Qubes Master Signing Key" imported gpg: Total number processed: 1 gpg: imported: 1 (For more ways to obtain the QMSK, see How to import and authenticate the Qubes Master Signing Key.) 2. View the fingerprint of the PGP key you just imported. (Note: `gpg>` indicates a prompt inside of the GnuPG program. Type what appears after it when prompted.) $ gpg --edit-key 0x427F11FD0FAA4B080123F01CDDFA1A3E36879494 gpg (GnuPG) 2.2.27; Copyright (C) 2021 Free Software Foundation, Inc. This is free software: you are free to change and redistribute it. There is NO WARRANTY, to the extent permitted by law. pub rsa4096/DDFA1A3E36879494 created: 2010-04-01 expires: never usage: SC trust: unknown validity: unknown [ unknown] (1). Qubes Master Signing Key gpg> fpr pub rsa4096/DDFA1A3E36879494 2010-04-01 Qubes Master Signing Key Primary key fingerprint: 427F 11FD 0FAA 4B08 0123 F01C DDFA 1A3E 3687 9494 3. **Important:** At this point, you still don’t know whether the key you just imported is the genuine QMSK or a forgery. In order for this entire procedure to provide meaningful security benefits, you _must_ authenticate the QMSK out-of-band. **Do not skip this step!** The standard method is to obtain the QMSK fingerprint from _multiple independent sources in several different ways_ and check to see whether they match the key you just imported. For more information, see How to import and authenticate the Qubes Master Signing Key. **Tip:** After you have authenticated the QMSK out-of-band to your satisfaction, record the QMSK fingerprint in a safe place (or several) so that you don’t have to repeat this step in the future. 4. Once you are satisfied that you have the genuine QMSK, set its trust level to 5 (“ultimate”), then quit GnuPG with `q`. gpg> trust pub rsa4096/DDFA1A3E36879494 created: 2010-04-01 expires: never usage: SC trust: unknown validity: unknown [ unknown] (1). Qubes Master Signing Key Please decide how far you trust this user to correctly verify other users' keys (by looking at passports, checking fingerprints from different sources, etc.) 1 = I don't know or won't say 2 = I do NOT trust 3 = I trust marginally 4 = I trust fully 5 = I trust ultimately m = back to the main menu Your decision? 5 Do you really want to set this key to ultimate trust? (y/N) y pub rsa4096/DDFA1A3E36879494 created: 2010-04-01 expires: never usage: SC trust: ultimate validity: unknown [ unknown] (1). Qubes Master Signing Key Please note that the shown key validity is not necessarily correct unless you restart the program. gpg> q 5. Use Git to clone the qubes-secpack repo. $ git clone https://github.com/QubesOS/qubes-secpack.git Cloning into 'qubes-secpack'... remote: Enumerating objects: 4065, done. remote: Counting objects: 100% (1474/1474), done. remote: Compressing objects: 100% (742/742), done. remote: Total 4065 (delta 743), reused 1413 (delta 731), pack-reused 2591 Receiving objects: 100% (4065/4065), 1.64 MiB | 2.53 MiB/s, done. Resolving deltas: 100% (1910/1910), done. 6. Import the included PGP keys. (See our PGP key policies for important information about these keys.) $ gpg --import qubes-secpack/keys/*/* gpg: key 063938BA42CFA724: public key "Marek Marczykowski-Górecki (Qubes OS signing key)" imported gpg: qubes-secpack/keys/core-devs/retired: read error: Is a directory gpg: no valid OpenPGP data found. gpg: key 8C05216CE09C093C: 1 signature not checked due to a missing key gpg: key 8C05216CE09C093C: public key "HW42 (Qubes Signing Key)" imported gpg: key DA0434BC706E1FCF: public key "Simon Gaiser (Qubes OS signing key)" imported gpg: key 8CE137352A019A17: 2 signatures not checked due to missing keys gpg: key 8CE137352A019A17: public key "Andrew David Wong (Qubes Documentation Signing Key)" imported gpg: key AAA743B42FBC07A9: public key "Brennan Novak (Qubes Website & Documentation Signing)" imported gpg: key B6A0BB95CA74A5C3: public key "Joanna Rutkowska (Qubes Documentation Signing Key)" imported gpg: key F32894BE9684938A: public key "Marek Marczykowski-Górecki (Qubes Documentation Signing Key)" imported gpg: key 6E7A27B909DAFB92: public key "Hakisho Nukama (Qubes Documentation Signing Key)" imported gpg: key 485C7504F27D0A72: 1 signature not checked due to a missing key gpg: key 485C7504F27D0A72: public key "Sven Semmler (Qubes Documentation Signing Key)" imported gpg: key BB52274595B71262: public key "unman (Qubes Documentation Signing Key)" imported gpg: key DC2F3678D272F2A8: 1 signature not checked due to a missing key gpg: key DC2F3678D272F2A8: public key "Wojtek Porczyk (Qubes OS documentation signing key)" imported gpg: key FD64F4F9E9720C4D: 1 signature not checked due to a missing key gpg: key FD64F4F9E9720C4D: public key "Zrubi (Qubes Documentation Signing Key)" imported gpg: key DDFA1A3E36879494: "Qubes Master Signing Key" not changed gpg: key 1848792F9E2795E9: public key "Qubes OS Release 4 Signing Key" imported gpg: qubes-secpack/keys/release-keys/retired: read error: Is a directory gpg: no valid OpenPGP data found. gpg: key D655A4F21830E06A: public key "Marek Marczykowski-Górecki (Qubes security pack)" imported gpg: key ACC2602F3F48CB21: public key "Qubes OS Security Team" imported gpg: qubes-secpack/keys/security-team/retired: read error: Is a directory gpg: no valid OpenPGP data found. gpg: key 4AC18DE1112E1490: public key "Simon Gaiser (Qubes Security Pack signing key)" imported gpg: Total number processed: 17 gpg: imported: 16 gpg: unchanged: 1 gpg: marginals needed: 3 completes needed: 1 trust model: pgp gpg: depth: 0 valid: 1 signed: 6 trust: 0-, 0q, 0n, 0m, 0f, 1u gpg: depth: 1 valid: 6 signed: 0 trust: 6-, 0q, 0n, 0m, 0f, 0u 7. Verify signed Git tags. $ cd qubes-secpack/ $ git tag -v `git describe` object 266e14a6fae57c9a91362c9ac784d3a891f4d351 type commit tag marmarek_sec_266e14a6 tagger Marek Marczykowski-Górecki 1677757924 +0100 Tag for commit 266e14a6fae57c9a91362c9ac784d3a891f4d351 gpg: Signature made Thu 02 Mar 2023 03:52:04 AM PST gpg: using RSA key 2D1771FE4D767EDC76B089FAD655A4F21830E06A gpg: Good signature from "Marek Marczykowski-Górecki (Qubes security pack)" [full] The exact output will differ, but the final line should always start with `gpg: Good signature from...` followed by an appropriate key. The `[full]` indicates full trust, which this key inherits in virtue of being validly signed by the QMSK. 8. Verify PGP signatures, e.g.: $ cd QSBs/ $ gpg --verify qsb-087-2022.txt.sig.marmarek qsb-087-2022.txt gpg: Signature made Wed 23 Nov 2022 04:05:51 AM PST gpg: using RSA key 2D1771FE4D767EDC76B089FAD655A4F21830E06A gpg: Good signature from "Marek Marczykowski-Górecki (Qubes security pack)" [full] $ gpg --verify qsb-087-2022.txt.sig.simon qsb-087-2022.txt gpg: Signature made Wed 23 Nov 2022 03:50:42 AM PST gpg: using RSA key EA18E7F040C41DDAEFE9AA0F4AC18DE1112E1490 gpg: Good signature from "Simon Gaiser (Qubes Security Pack signing key)" [full] $ cd ../canaries/ $ gpg --verify canary-034-2023.txt.sig.marmarek canary-034-2023.txt gpg: Signature made Thu 02 Mar 2023 03:51:48 AM PST gpg: using RSA key 2D1771FE4D767EDC76B089FAD655A4F21830E06A gpg: Good signature from "Marek Marczykowski-Górecki (Qubes security pack)" [full] $ gpg --verify canary-034-2023.txt.sig.simon canary-034-2023.txt gpg: Signature made Thu 02 Mar 2023 01:47:52 AM PST gpg: using RSA key EA18E7F040C41DDAEFE9AA0F4AC18DE1112E1490 gpg: Good signature from "Simon Gaiser (Qubes Security Pack signing key)" [full] Again, the exact output will differ, but the final line of output from each `gpg --verify` command should always start with `gpg: Good signature from...` followed by an appropriate key. For this announcement (QSB-117), the commands are: $ gpg --verify qsb-117-2026.txt.sig.marmarek qsb-117-2026.txt $ gpg --verify qsb-117-2026.txt.sig.simon qsb-117-2026.txt You can also verify the signatures directly from this announcement in addition to or instead of verifying the files from the qubes-secpack. Simply copy and paste the QSB-117 text into a plain text file and do the same for both signature files. Then, perform the same authentication steps as listed above, substituting the filenames above with the names of the files you just created.

As previously announced, the call for proposals for Qubes OS Summit 2026 will end on 2026-08-31. If you’d like to present at the Summit, please submit your proposal soon! As a reminder: * You may present either on site or virtually from anywhere in the world. * If your proposal is accepted and you wish to present in person, you’ll be issued an on-site ticket free of charge, no purchase necessary. * If you select “Don’t record this session” when submitting your proposal, your presentation will not be livestreamed or recorded. Online attendees will not be able to view it. ## When and where **Friday, October 30 @ 9:30 AM — Sunday, November 1 @ 3:00 PM (GMT+1)** (A more specific schedule will be published after the speaker lineup is finalized.) Refugio Berlin Lenaustraße 3-4 12047 Berlin View on OpenStreetMap ## Attend in person or online There are three ways to attend the Summit: 1. **In person at Refugio Berlin** * Requires a paid on-site ticket * Grants access to the hackathon (including interactive workshops) and any design sessions (depending on conference schedule) * Provides the opportunity to socialize, network, and mingle with like-minded individuals who are passionate about secure computing * Grants exclusive access to any non-livestreamed, non-recorded presentations (see below) * Grants access to attend presentations and participate as a live audience member 2. **Actively participate online** * Requires a free virtual ticket * For those who are presenting remotely * For those who are attending presentations remotely and wish to ask questions or engage in active discussion in a live chat during the presentations * Does not grant access to the hackathon or any design sessions * Does not provide the opportunity to socialize, network, or mingle with like-minded individuals who are passionate about secure computing * Does not grant access to any non-livestreamed, non-recorded presentations (see below) * Does not grant access to attend presentations as a live audience member 3. **Passively view online** * No ticket or registration required * For those who simply wish to watch the presentations via the public livestream and recorded videos * Does not provide the ability to ask questions or engage in active discussion during the presentations * Does not grant access to the hackathon or any design sessions * Does not provide the opportunity to socialize, network, or mingle with like-minded individuals who are passionate about secure computing * Does not grant access to any non-livestreamed, non-recorded presentations (see below) * Does not grant access to attend presentations as a live audience member **Note:** As mentioned above, presenters have the option to request that their presentations not be recorded. If a presenter opts out of recording, there will be a “no recording” icon next to that presentation in the conference schedule. Only on-site attendees will be able to view that presentation. It will not be livestreamed or recorded for later viewing. ## Conference schedule We’re still reviewing proposals from prospective presenters, so the list of talks has not been decided yet. We’ll publish a detailed conference schedule after the speaker lineup has been finalized. ## Become a sponsor If you or your organization are interested in sponsoring Qubes OS Summit 2026 or becoming a Qubes Partner, please contact us at funding@qubes-os.org. ## Code of conduct This event is covered by the Qubes OS Project’s code of conduct.

We have published Qubes Security Bulletin (QSB) 116: Multiple Xen issues (XSA-500, XSA-505, XSA-506, XSA-507). The text of this QSB and its accompanying cryptographic signatures are reproduced below, followed by a general explanation of this announcement and authentication instructions. ## Qubes Security Bulletin 116 ---===[ Qubes Security Bulletin 116 ]===--- 2026-07-28 Multiple Xen issues (XSA-500, XSA-505, XSA-506, XSA-507) User action ------------ Continue to update normally [1] in order to receive the security updates described in the "Patching" section below. No other user action is required in response to this QSB. Summary -------- On 2026-07-28, the Xen Project published the security advisories below. XSA-500 [3] "grant-table: type confusion in grant-copy": | When grant-copy operations are processed, the respective grant may or | may not already be in use by another operation (a mapping or another | copy). For all copy operations the referenced guest frame is looked | up. When another operation is already active for the grant (the grant | is "pinned"), what is being supplied back to actually carry out | permission checks and copy operation may not be consistent: The | permission check may be carried out on a page different from the one | involved in the copy. XSA-505 [4] "evtchn: Race between FIFO expand and reset": | The EVTCHNOP_expand_array hypercall checks for whether FIFO event | channels are enabled, but without holding the correct lock. It can | race with EVTCHNOP_reset, resulting in deferencing a NULL pointer. XSA-506 [5] "correct buffer checks for DM_OP hypercalls": | Parts of the DM_OP handling code assumes the caller has provided the | required number of buffers for the given operation without any | checking being done. As a result, certain operations might access | stack rubble as structures are possibly uninitialized. XSA-507 [6] "PoD: Don't try to reclaim special pages": | A guest started with Populated on Demand enabled (PoD) can attempt to | reclaim pages which aren't regular guest RAM. This can cause | corruption of memory management state in Xen. Impact ------- XSA-500 and XSA-507: A malicious qube may be able to compromise Qubes OS. XSA-505: A malicious PV qube [7] may be able to compromise Qubes OS. The same impact applies to stubdomains for HVM qubes [8], but in this case an attacker would first have to discover and exploit an independent vulnerability (in QEMU) in order to gain access to the stubdomain. XSA-506: The stubdomain for an HVM qube may be able to leak data from other qubes in the system. In order to exploit this vulnerability, an attacker would first have to discover and exploit an independent vulnerability (in QEMU) in order to gain access to the stubdomain. Affected systems ----------------- XSA-500: All systems are affected. XSA-505: Systems with either PV qubes or stubdomains for HVM qubes (or both) are affected, but the vulnerability is easier to exploit on systems with PV qubes. In the default Qubes OS configuration, there are no PV qubes, but sys-net and sys-usb are HVM qubes that have stubdomains. This means that the vulnerability is more difficult to exploit in the default Qubes OS configuration, but if a user has manually created PV qubes in a particular system, the vulnerability will be easier to exploit on that system. XSA-506: Systems with untrusted HVM qubes are affected. In the default configuration of Qubes OS, sys-net and sys-usb are HVM qubes and are considered to be untrusted. XSA-507: Systems are affected if they have qubes that are included in memory balancing but that don't advertise memory hotplug support. This includes malicious HVM qubes with memory balancing enabled, as well as templates and standalones that use in-qube kernels and that have memory balancing enabled. The default Qubes OS configuration is not affected, nor are commonly-used HVM qubes like Windows, since they don't have memory balancing enabled. Patching --------- The following packages contain security updates that address the vulnerabilities described in this bulletin: For Qubes 4.3, in dom0: - Xen packages, version 4.19.5-2 These packages will migrate from the security-testing repository to the current (stable) repository over the next two weeks after being tested by the community. [2] Once available, the packages should be installed via the Qubes Update tool or its command-line equivalents. [1] Dom0 must be restarted afterward in order for the updates to take effect. If you use Anti Evil Maid, you will need to reseal your secret passphrase to new PCR values, as PCR18+19 will change due to the new Xen binaries. Credits -------- See the original Xen Security Advisories. [3][4][5][6] References ----------- [1] https://doc.qubes-os.org/en/latest/user/how-to-guides/how-to-update.html [2] https://doc.qubes-os.org/en/latest/user/downloading-installing-upgrading/testing.html [3] https://xenbits.xen.org/xsa/advisory-500.html [4] https://xenbits.xen.org/xsa/advisory-505.html [5] https://xenbits.xen.org/xsa/advisory-506.html [6] https://xenbits.xen.org/xsa/advisory-507.html [7] A PV qube is a qube that is running with virt_mode set to "pv." [8] For each qube that is running with virt_mode set to "hvm," there's a small Xen-internal helper VM running alongside it, in which QEMU is executed to provide device emulation for that qube. This helper VM runs in PV mode and is called a "stubdomain." -- The Qubes Security Team https://www.qubes-os.org/security/ **Source:** qsb-116-2026.txt ## Marek Marczykowski-Górecki’s PGP signature -----BEGIN PGP SIGNATURE----- iQIzBAABCAAdFiEELRdx/k12ftx2sIn61lWk8hgw4GoFAmpoeyMACgkQ1lWk8hgw 4GqUjw//brO4x3oOygOpewPqcjgYqohh4qPu5Dpm6JBvtxiIZQWEv9UZg0RqfMVc omoalUCQhoTPu8QYnXu3HKo87LGcrUKKf2KeRx4CyT8LsZCQufA25uWD3Sr6eVsA 38Q/Znq3VyUpa5tMQm28JIIA9m2PMAMaXu5ElZVAw5kvcRncwRh8WDOrkVOO97ll gSfBo3SJ0OfSUDcQvGa8f5+4Jx/SPoJn5zLo3Ott4tT7Tz2NAfE2Xlxl7karasY/ vCY+Lo8ACN+0ShELslGKYZnNdwLuwkz3lVN+FqDbLrHauBUjDLH7+yTXJvO9ZoXq 3LTpHopzv8oSJJyhq0YeO4XlKt+USn2HbIMqhJ9ON8aHHVE3/YhVJume4RuxSlHx WAStN0bYH/NqSywYB3wWmGEho9wRw8bxLrOBIuZO3V63HpMJnCL412F7RFA2/9iS muq3Iix9YpqfI/Q1Q18JSnYYLlWaphMtc/OJki5FAzp1B5DtQtPcQtg/vcy9tsrX P9zrK4j3Dj/vPzZd6DwDmTBPxuiLQX79TQojl7NClVatkULfdHQGDKogfPmsJng9 IpKMBkMZ85QVv+DG/XFtXpynBdeg/6eTeWiexC7WF3HgILkhy2RadQz0eHsEwCmp fIeVYQ2Es3eVH7aNaPHwaAcklNP+7yppgw5O81PGOlbD3Z9a15Y= =vPOZ -----END PGP SIGNATURE----- **Source:** qsb-116-2026.txt.sig.marmarek ## Simon Gaiser (aka HW42)’s PGP signature -----BEGIN PGP SIGNATURE----- iQIzBAABCgAdFiEE6hjn8EDEHdrv6aoPSsGN4REuFJAFAmpoh00ACgkQSsGN4REu FJCSVhAApAdVntLjACF7SJ9h7SF4M1IiDKKUQRnUhwEa06d/qDjFg/aVlsL6LghW +cKpPdjSDWwGPhAsJhbxTeiSSAkX300qJuqX3/K0h6iw7jaQkqb6kmwaAhK7J8Ym 9F5LvcP8Vvx3G0Gi4YogNzrwA+AMlfCgKLgp7MsHKumE1TY0pp5dI6DMqz2/EasV ODrppsfXkMMmES5aR8C6Pxe51pfBbXVqVmffjYxaz/C9VvcfGbHja8OdnOuNeqmo yzR2pP6BGdIl2KGfq1GzuuYWtitIcrG8aEnYfcmhiHbHkTIObNwHo7MOwBT2Q9H4 ALJfuBfC1ChBvmmzRIPgOzPbiz0MLIWcjFvKRmXW8azTTQOyRQQbG5lDGeu+aJm0 ZRdyXPQh2294MmmL3r+xtyFJTFw5WABdxjZa10nlB5B5JQ8FrV7koNc4quXhCS4U ceAwpvCuRKTX1Lg+NDaPFtxAmYX98QkLT09V34vyqksOcMR+DY7stHol8T+hYIMM 8DXZDBdndUMkU/DU5xfj4Z/wtgkB66eLKBypxqibiPx33vkBZOIAYtNYK7zFnrTk HnrHAGpm0sLlNdLzNA4XQ7yMTdDwzxW6GeYacYWxDT3t9Qc9vroGVju3CExQtljs 4znS5FAHrlPSv4xi7aWiypVwB/MsMbrdNcd0/g9px6RbszpNGpA= =BjeB -----END PGP SIGNATURE----- **Source:** qsb-116-2026.txt.sig.simon ## What is the purpose of this announcement? The purpose of this announcement is to inform the Qubes community that a new Qubes security bulletin (QSB) has been published. ## What is a Qubes security bulletin (QSB)? A Qubes security bulletin (QSB) is a security announcement issued by the Qubes security team. A QSB typically provides a summary and impact analysis of one or more recently-discovered software vulnerabilities, including details about patching to address them. ## Why should I care about QSBs? QSBs tell you what actions you must take in order to protect yourself from recently-discovered security vulnerabilities. In most cases, security vulnerabilities are addressed by updating normally. However, in some cases, special user action is required. In all cases, the required actions are detailed in QSBs. ## What are the PGP signatures that accompany QSBs? A PGP signature is a cryptographic digital signature made in accordance with the OpenPGP standard. PGP signatures can be cryptographically verified with programs like GNU Privacy Guard (GPG). The Qubes security team cryptographically signs all QSBs so that Qubes users have a reliable way to check whether QSBs are genuine. The only way to be certain that a QSB is authentic is by verifying its PGP signatures. ## Why should I care whether a QSB is authentic? A forged QSB could deceive you into taking actions that adversely affect the security of your Qubes OS system, such as installing malware or making configuration changes that render your system vulnerable to attack. Falsified QSBs could sow fear, uncertainty, and doubt about the security of Qubes OS or the status of the Qubes OS Project. ## How do I verify the PGP signatures on a QSB? The following command-line instructions assume a Linux system with `git` and `gpg` installed. (For Windows and Mac options, see OpenPGP software.) 1. Obtain the Qubes Master Signing Key (QMSK), e.g.: $ gpg --fetch-keys https://keys.qubes-os.org/keys/qubes-master-signing-key.asc gpg: directory '/home/user/.gnupg' created gpg: keybox '/home/user/.gnupg/pubring.kbx' created gpg: requesting key from 'https://keys.qubes-os.org/keys/qubes-master-signing-key.asc' gpg: /home/user/.gnupg/trustdb.gpg: trustdb created gpg: key DDFA1A3E36879494: public key "Qubes Master Signing Key" imported gpg: Total number processed: 1 gpg: imported: 1 (For more ways to obtain the QMSK, see How to import and authenticate the Qubes Master Signing Key.) 2. View the fingerprint of the PGP key you just imported. (Note: `gpg>` indicates a prompt inside of the GnuPG program. Type what appears after it when prompted.) $ gpg --edit-key 0x427F11FD0FAA4B080123F01CDDFA1A3E36879494 gpg (GnuPG) 2.2.27; Copyright (C) 2021 Free Software Foundation, Inc. This is free software: you are free to change and redistribute it. There is NO WARRANTY, to the extent permitted by law. pub rsa4096/DDFA1A3E36879494 created: 2010-04-01 expires: never usage: SC trust: unknown validity: unknown [ unknown] (1). Qubes Master Signing Key gpg> fpr pub rsa4096/DDFA1A3E36879494 2010-04-01 Qubes Master Signing Key Primary key fingerprint: 427F 11FD 0FAA 4B08 0123 F01C DDFA 1A3E 3687 9494 3. **Important:** At this point, you still don’t know whether the key you just imported is the genuine QMSK or a forgery. In order for this entire procedure to provide meaningful security benefits, you _must_ authenticate the QMSK out-of-band. **Do not skip this step!** The standard method is to obtain the QMSK fingerprint from _multiple independent sources in several different ways_ and check to see whether they match the key you just imported. For more information, see How to import and authenticate the Qubes Master Signing Key. **Tip:** After you have authenticated the QMSK out-of-band to your satisfaction, record the QMSK fingerprint in a safe place (or several) so that you don’t have to repeat this step in the future. 4. Once you are satisfied that you have the genuine QMSK, set its trust level to 5 (“ultimate”), then quit GnuPG with `q`. gpg> trust pub rsa4096/DDFA1A3E36879494 created: 2010-04-01 expires: never usage: SC trust: unknown validity: unknown [ unknown] (1). Qubes Master Signing Key Please decide how far you trust this user to correctly verify other users' keys (by looking at passports, checking fingerprints from different sources, etc.) 1 = I don't know or won't say 2 = I do NOT trust 3 = I trust marginally 4 = I trust fully 5 = I trust ultimately m = back to the main menu Your decision? 5 Do you really want to set this key to ultimate trust? (y/N) y pub rsa4096/DDFA1A3E36879494 created: 2010-04-01 expires: never usage: SC trust: ultimate validity: unknown [ unknown] (1). Qubes Master Signing Key Please note that the shown key validity is not necessarily correct unless you restart the program. gpg> q 5. Use Git to clone the qubes-secpack repo. $ git clone https://github.com/QubesOS/qubes-secpack.git Cloning into 'qubes-secpack'... remote: Enumerating objects: 4065, done. remote: Counting objects: 100% (1474/1474), done. remote: Compressing objects: 100% (742/742), done. remote: Total 4065 (delta 743), reused 1413 (delta 731), pack-reused 2591 Receiving objects: 100% (4065/4065), 1.64 MiB | 2.53 MiB/s, done. Resolving deltas: 100% (1910/1910), done. 6. Import the included PGP keys. (See our PGP key policies for important information about these keys.) $ gpg --import qubes-secpack/keys/*/* gpg: key 063938BA42CFA724: public key "Marek Marczykowski-Górecki (Qubes OS signing key)" imported gpg: qubes-secpack/keys/core-devs/retired: read error: Is a directory gpg: no valid OpenPGP data found. gpg: key 8C05216CE09C093C: 1 signature not checked due to a missing key gpg: key 8C05216CE09C093C: public key "HW42 (Qubes Signing Key)" imported gpg: key DA0434BC706E1FCF: public key "Simon Gaiser (Qubes OS signing key)" imported gpg: key 8CE137352A019A17: 2 signatures not checked due to missing keys gpg: key 8CE137352A019A17: public key "Andrew David Wong (Qubes Documentation Signing Key)" imported gpg: key AAA743B42FBC07A9: public key "Brennan Novak (Qubes Website & Documentation Signing)" imported gpg: key B6A0BB95CA74A5C3: public key "Joanna Rutkowska (Qubes Documentation Signing Key)" imported gpg: key F32894BE9684938A: public key "Marek Marczykowski-Górecki (Qubes Documentation Signing Key)" imported gpg: key 6E7A27B909DAFB92: public key "Hakisho Nukama (Qubes Documentation Signing Key)" imported gpg: key 485C7504F27D0A72: 1 signature not checked due to a missing key gpg: key 485C7504F27D0A72: public key "Sven Semmler (Qubes Documentation Signing Key)" imported gpg: key BB52274595B71262: public key "unman (Qubes Documentation Signing Key)" imported gpg: key DC2F3678D272F2A8: 1 signature not checked due to a missing key gpg: key DC2F3678D272F2A8: public key "Wojtek Porczyk (Qubes OS documentation signing key)" imported gpg: key FD64F4F9E9720C4D: 1 signature not checked due to a missing key gpg: key FD64F4F9E9720C4D: public key "Zrubi (Qubes Documentation Signing Key)" imported gpg: key DDFA1A3E36879494: "Qubes Master Signing Key" not changed gpg: key 1848792F9E2795E9: public key "Qubes OS Release 4 Signing Key" imported gpg: qubes-secpack/keys/release-keys/retired: read error: Is a directory gpg: no valid OpenPGP data found. gpg: key D655A4F21830E06A: public key "Marek Marczykowski-Górecki (Qubes security pack)" imported gpg: key ACC2602F3F48CB21: public key "Qubes OS Security Team" imported gpg: qubes-secpack/keys/security-team/retired: read error: Is a directory gpg: no valid OpenPGP data found. gpg: key 4AC18DE1112E1490: public key "Simon Gaiser (Qubes Security Pack signing key)" imported gpg: Total number processed: 17 gpg: imported: 16 gpg: unchanged: 1 gpg: marginals needed: 3 completes needed: 1 trust model: pgp gpg: depth: 0 valid: 1 signed: 6 trust: 0-, 0q, 0n, 0m, 0f, 1u gpg: depth: 1 valid: 6 signed: 0 trust: 6-, 0q, 0n, 0m, 0f, 0u 7. Verify signed Git tags. $ cd qubes-secpack/ $ git tag -v `git describe` object 266e14a6fae57c9a91362c9ac784d3a891f4d351 type commit tag marmarek_sec_266e14a6 tagger Marek Marczykowski-Górecki 1677757924 +0100 Tag for commit 266e14a6fae57c9a91362c9ac784d3a891f4d351 gpg: Signature made Thu 02 Mar 2023 03:52:04 AM PST gpg: using RSA key 2D1771FE4D767EDC76B089FAD655A4F21830E06A gpg: Good signature from "Marek Marczykowski-Górecki (Qubes security pack)" [full] The exact output will differ, but the final line should always start with `gpg: Good signature from...` followed by an appropriate key. The `[full]` indicates full trust, which this key inherits in virtue of being validly signed by the QMSK. 8. Verify PGP signatures, e.g.: $ cd QSBs/ $ gpg --verify qsb-087-2022.txt.sig.marmarek qsb-087-2022.txt gpg: Signature made Wed 23 Nov 2022 04:05:51 AM PST gpg: using RSA key 2D1771FE4D767EDC76B089FAD655A4F21830E06A gpg: Good signature from "Marek Marczykowski-Górecki (Qubes security pack)" [full] $ gpg --verify qsb-087-2022.txt.sig.simon qsb-087-2022.txt gpg: Signature made Wed 23 Nov 2022 03:50:42 AM PST gpg: using RSA key EA18E7F040C41DDAEFE9AA0F4AC18DE1112E1490 gpg: Good signature from "Simon Gaiser (Qubes Security Pack signing key)" [full] $ cd ../canaries/ $ gpg --verify canary-034-2023.txt.sig.marmarek canary-034-2023.txt gpg: Signature made Thu 02 Mar 2023 03:51:48 AM PST gpg: using RSA key 2D1771FE4D767EDC76B089FAD655A4F21830E06A gpg: Good signature from "Marek Marczykowski-Górecki (Qubes security pack)" [full] $ gpg --verify canary-034-2023.txt.sig.simon canary-034-2023.txt gpg: Signature made Thu 02 Mar 2023 01:47:52 AM PST gpg: using RSA key EA18E7F040C41DDAEFE9AA0F4AC18DE1112E1490 gpg: Good signature from "Simon Gaiser (Qubes Security Pack signing key)" [full] Again, the exact output will differ, but the final line of output from each `gpg --verify` command should always start with `gpg: Good signature from...` followed by an appropriate key. For this announcement (QSB-116), the commands are: $ gpg --verify qsb-116-2026.txt.sig.marmarek qsb-116-2026.txt $ gpg --verify qsb-116-2026.txt.sig.simon qsb-116-2026.txt You can also verify the signatures directly from this announcement in addition to or instead of verifying the files from the qubes-secpack. Simply copy and paste the QSB-116 text into a plain text file and do the same for both signature files. Then, perform the same authentication steps as listed above, substituting the filenames above with the names of the files you just created.

The following new Fedora 44 templates are now available for Qubes OS 4.3: * `fedora-44-xfce` — default Fedora template with the Xfce desktop environment * `fedora-44-gnome` — alternative Fedora template with the GNOME desktop environment * `fedora-44-minimal` — minimal template for advanced users There are two ways to upgrade a template to a new Fedora release: 1. **Recommended:** Install a fresh template to replace an existing one. This option is simpler for less experienced users, but it won’t preserve any modifications you’ve made to your template. After you install the new template, you’ll have to redo your desired template modifications (if any) and switch everything that was set to the old template to the new template. If you choose to modify your template, you may wish to write those modifications down so that you remember what to redo on each fresh install. To see a log of package manager actions, open a terminal in the template and use the `dnf history` command. 2. **Advanced:** Perform an in-place upgrade of an existing Fedora template. This option will preserve any modifications you’ve made to the template, but it may be more complicated for less experienced users. **Note:** No user action is required regarding the OS version in dom0 (see our note on dom0 and EOL).

The Xen Project has released one or more Xen security advisories (XSAs). The security of Qubes OS is **not** affected. ## XSAs that DO affect the security of Qubes OS The following XSAs **do affect** the security of Qubes OS: * (none) ## XSAs that DO NOT affect the security of Qubes OS The following XSAs **do not affect** the security of Qubes OS, and no user action is necessary: * XSA-498: Qubes OS does not use XAPI. ## About this announcement Qubes OS uses the Xen hypervisor as part of its architecture. When the Xen Project publicly discloses a vulnerability in the Xen hypervisor, they issue a notice called a Xen security advisory (XSA). Vulnerabilities in the Xen hypervisor sometimes have security implications for Qubes OS. When they do, we issue a notice called a Qubes security bulletin (QSB). (QSBs are also issued for non-Xen vulnerabilities.) However, QSBs can provide only _positive_ confirmation that certain XSAs _do_ affect the security of Qubes OS. QSBs cannot provide _negative_ confirmation that other XSAs do _not_ affect the security of Qubes OS. Therefore, we also maintain an XSA tracker, which is a comprehensive list of all XSAs publicly disclosed to date, including whether each one affects the security of Qubes OS. When new XSAs are published, we add them to the XSA tracker and publish a notice like this one in order to inform Qubes users that a new batch of XSAs has been released and whether each one affects the security of Qubes OS.

As previously announced, Qubes OS User Survey 2026 will close on 2026-07-13. If you still wish to take the survey and haven’t completed it yet, please do so now. Whether you’re a long-time Qubes user or haven’t even installed it yet, we want to hear about your experiences and about what matters to you. Help us make Qubes the best reasonably secure operating system it can be. If you’ve ever wanted to influence the development of Qubes, now is your chance. Make your voice heard! Qubes OS User Survey 2026 _This survey is fully anonymous. We do not collect any data except for the answers you provide._

As previously announced, Qubes OS User Survey 2026 is currently live! The survey will remain open for two more weeks, until 2026-07-13. Whether you’re a long-time Qubes user or haven’t even installed it yet, we want to hear about your experiences and about what matters to you. Help us make Qubes the best reasonably secure operating system it can be. If you’ve ever wanted to influence the development of Qubes, now is your chance. Make your voice heard! Qubes OS User Survey 2026 _This survey is fully anonymous. We do not collect any data except for the answers you provide._

As previously announced, the Qubes OS 4.2 release series has officially reached end of life (EOL) as of today, 2026-06-21. We strongly urge any remaining Qubes 4.2 users to upgrade to Qubes 4.3 immediately. ## Recommended actions If you’re already using Qubes 4.3, then you don’t have to do anything. This announcement doesn’t apply to you. If you’re still using Qubes 4.2, then you should upgrade to Qubes 4.3 as soon as possible. There are two ways to do this: * Perform a clean installation of Qubes 4.3 using the latest stable Qubes OS 4.3.1 ISO. This involves backing up your current system, replacing your current installation with a fresh Qubes 4.3 installation, then restoring from your backup. Many users find this option to be simpler, easier, and less error-prone. However, if you’ve made extensive customizations in dom0, they may need to be redone. * Perform an in-place upgrade from Qubes 4.2 to Qubes 4.3. Instead of replacing your existing installation, this method involves installing a special command-line tool in dom0, then using it to upgrade your existing Qubes 4.2 installation to Qubes 4.3. This is a more complex multi-stage process, which makes it most suitable for advanced users. This method preserves your qubes and all the customizations you’ve made in dom0 that are compatible with the in-place upgrade process. While not strictly required, we still strongly recommend making a full backup before attempting an in-place upgrade. This way, if anything goes wrong, your data is still safe, and you always have the option of falling back to performing a clean installation. If you need help, please consult our help and support page. ## What does end of life (EOL) mean? When an operating system reaches end of life (EOL), it is no longer supported. This means that it will no longer receive security updates, bug fixes, or new features. An OS that does not receive security updates will not be protected against new vulnerabilities, which is why it’s critically important to upgrade to a supported release. ## What about patch releases? The Qubes OS Project uses the semantic versioning standard. Version numbers are written as `[major].[minor].[patch]`. When a major or minor release reaches EOL, all of its patch releases also reach EOL. In this case, when we say that “Qubes 4.2” (without specifying a `[patch]` number) has reached EOL, we’re specifying a particular minor release inclusive of all patch releases within it. This means that Qubes 4.2.0, 4.2.1, 4.2.2, 4.2.3, and 4.2.4 have all reached EOL, since they’re all patch releases of the same minor release. ## How are EOL dates determined? According to our release support policy, stable Qubes OS releases are supported for six months after each subsequent major or minor release. This means that the EOL date for Qubes 4.2 was set at the time Qubes 4.3 was released by adding six months to the Qubes 4.3 release date. Qubes 4.3.0 was released on 2025-12-21. Adding six months to this date gives us 2026-06-21, which is Qubes 4.2’s EOL date. Since the EOL date of 4.2 was determined at the time 4.3 was released, we also included this information in the 4.3.0 release announcement.

We’re pleased to announce the stable release of Qubes OS 4.3.1! This patch release aims to consolidate all the security updates and bug fixes that have occurred since the previous stable release. Our goal is to provide a secure and convenient way for users to install (or reinstall) the latest stable Qubes release with an up-to-date ISO. The ISO and associated verification files are available on the downloads page. ## Announcements * Qubes 4.2 will reach end of life (EOL) on 2026-06-21. If you’re a current 4.2 user who’s been waiting to upgrade to 4.3, the release of Qubes 4.3.1 is the perfect opportunity to do so. * Qubes OS User Survey 2026 is now live! Whether you’re a long-time Qubes user or haven’t even installed it yet, we want to hear about your experiences and about what matters to you. Help us make Qubes the best reasonably secure operating system it can be. The survey takes 10-20 minutes and is fully anonymous. We do not collect any data except for the answers you provide. If you’ve ever wanted to influence the development of Qubes, now is your chance. Make your voice heard! ## What’s new in Qubes 4.3.1? * Security updates * Bug fixes * Included Fedora template upgraded to Fedora 43. (Reminder: Fedora 42 has reached end of life.) If you’re upgrading from Qubes 4.2, also see the Qubes 4.3 release notes. ## How to get Qubes 4.3.1 * If you’d like to install Qubes for the first time or perform a clean reinstallation on an existing system, there’s never been a better time to do so! Simply download the Qubes 4.3.1 ISO and follow our installation guide. * If you’re currently using Qubes 4.2, make sure to upgrade from 4.2 to 4.3 no later than 2026-06-21, which is when 4.2 will reach EOL. * If you’re currently on Qubes 4.3 (4.3.0 or 4.3.1-rc1), update normally (which includes upgrading any EOL templates and standalones you might have) in order to make your system essentially equivalent to the stable Qubes 4.3.1 release. No reinstallation or other special action is required. In all cases, we strongly recommend making a full backup beforehand. ## Known issues in Qubes 4.3.1 It’s possible that templates restored in 4.3.1 from a pre-4.3 backup may continue to target their original Qubes OS release repos (#8701). After restoring such templates in 4.3.1, enter the following additional commands in a dom0 terminal: sudo qubes-dom0-update -y qubes-dist-upgrade sudo qubes-dist-upgrade --releasever=4.3 --template-standalone-upgrade -y This will automatically choose the templates that need to be upgraded. The templates will be shut down during this process. Fresh templates on a clean 4.3.1 installation are not affected. Users who perform an in-place upgrade from 4.2 to 4.3 (instead of restoring templates from a backup) are also not affected, since the in-place upgrade process already includes the above fix in stage 4. For more information, see issue #8701. View the full list of known bugs affecting Qubes 4.3 in our issue tracker. ## What’s a patch release? The Qubes OS Project uses the semantic versioning standard. Version numbers are written as `[major].[minor].[patch]`. Hence, we refer to releases that increment the third number as “patch releases.” A patch release does not designate a separate, new major or minor release of Qubes OS. Rather, it designates its respective major or minor release (in this case, 4.3) inclusive of all updates up to a certain point. See our supported releases for a comprehensive list of major and minor releases and our version scheme documentation for more information about how Qubes OS releases are versioned.

We have published Qubes Security Bulletin (QSB) 115: HVM I/O port list traversal (XSA-491). The text of this QSB and its accompanying cryptographic signatures are reproduced below, followed by a general explanation of this announcement and authentication instructions. ## Qubes Security Bulletin 115 ---===[ Qubes Security Bulletin 115 ]===--- 2026-06-09 HVM I/O port list traversal (XSA-491) User action ------------ Continue to update normally [1] in order to receive the security updates described in the "Patching" section below. No other user action is required in response to this QSB. Summary -------- On 2026-06-09, the Xen Project published XSA-491, "x86 HVM I/O port list traversal" (CVE-2026-42487) [3]: | HVM guest I/O port accesses are subject to either emulation or at | least translation. Translations are managed by the device model (via | XEN_DOMCTL_ioport_mapping), and hence the linked list used may changed | at any time. Traversal of those lists (while handling guest I/O port | accesses) therefore needs synchronizing with updates, which was | missing so far. Impact ------- A malicious stub domain can crash the hypervisor (and hence the entire system). A stub domain is a qube that accompanies a "fully-virtualized" (HVM) qube and in which QEMU is isolated. Privilege escalation and information leaks cannot be ruled out. Affected systems ----------------- All supported versions of Qubes OS are affected. Only qubes running in HVM mode are affected. In the default configuration, this includes sys-net and sys-usb. Patching --------- The following packages contain security updates that address the vulnerabilities described in this bulletin: For Qubes 4.2, in dom0: - Xen packages, version 4.17.6-6 For Qubes 4.3, in dom0: - Xen packages, version 4.19.4-9 These packages will migrate from the security-testing repository to the current (stable) repository over the next two weeks after being tested by the community. [2] Once available, the packages should be installed via the Qubes Update tool or its command-line equivalents. [1] Dom0 must be restarted afterward in order for the updates to take effect. If you use Anti Evil Maid, you will need to reseal your secret passphrase to new PCR values, as PCR18+19 will change due to the new Xen binaries. Credits -------- See the original Xen Security Advisory. [3] References ----------- [1] https://doc.qubes-os.org/en/latest/user/how-to-guides/how-to-update.html [2] https://doc.qubes-os.org/en/latest/user/downloading-installing-upgrading/testing.html [3] https://xenbits.xen.org/xsa/advisory-491.html -- The Qubes Security Team https://www.qubes-os.org/security/ **Source:** qsb-115-2026.txt ## Marek Marczykowski-Górecki’s PGP signature -----BEGIN PGP SIGNATURE----- iQIzBAABCAAdFiEELRdx/k12ftx2sIn61lWk8hgw4GoFAmon/JcACgkQ1lWk8hgw 4GonwA/9FXOs2RveaZ1dDShgbiYM5tdMv1I4jv4PgUKc1YAdbeW2UPpGeMoYfJ7b YRZzyJbcxtKZ/g/zFUhI8Oz3g2GRt1zohaB7yYe1x29nWaEh++ORrFArDzBksVjo uUGQNGvlf40vLDo0DVIgY40cSFKhU/P+R0MVz9t1oDiVCBdSt/fh8cmTDZnETB+g 41b6xa6rtienJv2SiR3jtp9Xphi3+e/v2JR9b+Ln8QMX6EpSW8fwPWwl2XGZBqD9 w9WyciGIMtRVGwesjOmH2PYmSzSZkTSER8vPTMaZw+LfAV3PHH2ccosaAZg4C+C8 ni+WUzBaqPGqa+LkujPP/Rr1dYAnUoWIH1BPsmT0/uTPt220q4ydNXR2+b4iwV6k PmlI1BJaa7oRua9Q7BDUHJw7pGmuwUbsRwyQZJ/74aOmKF8jrq+48DMFvBnAJklz z8dK7LlBHexumPheSHcszJtFWO7YdH8wv7SIiGrrtJWILZGGwuqJW8WhW3ZCO666 maXzl3bm5RjvYWsp4kA7REeBazz067+IXCKNWdj3CeMOj0w7Gbu4c9vDHLXsHJmV 4H8DSx0ZtHeL3NaWr559GKxY8WKCzN0j5wSPQwGRSkBnXL6CxAvKoIkKA4CJXzI/ b3k2cOVX7oFi0YdMSu0/dEsEImNKvz11bIX65l7Ii2RKLR1H1Gw= =QiLq -----END PGP SIGNATURE----- **Source:** qsb-115-2026.txt.sig.marmarek ## Simon Gaiser (aka HW42)’s PGP signature -----BEGIN PGP SIGNATURE----- iQIzBAABCgAdFiEE6hjn8EDEHdrv6aoPSsGN4REuFJAFAmom9IMACgkQSsGN4REu FJDxHw/+KDCeF8EeMZ2AidWz0gtj2aCWe9MkZ2iSrof69dztym8zkYW3TrKovQuT aTiZBL/NmEOGivpgx5oWXf/R8MRzY222sIm3d+Bqpt5ki3osG6DM0rH42IqTeLuk w1yg2N239yv9Fjf0mJ7Q3JF3lP+skHe/JdP8IXxgiKIsYfC7GrKHUq/EZGWJPBXd qz548E5pZJrlyheulJaqEl+aXdzPpY76ERgVjkgfLGoapKgyRFOt075MQUMaa75H RXQiypmjovmEUVdxnMQDXC2MGzu1qDdJHItEsLY9PCYnGI2wn7MwKltbGa/ey4IZ a4q8QMcp20Q/rFDQ+MAl1troGz0FUyyYG+YUeOPTFC5IeXlHakhc7P+fjg4vqPXi 637XwAip51RQAXvGWSaOPMULsUXfI8wnxYBtEYhhxjKzYLR0jAhuqEpBFl0YIS50 qNiS1QFsHv1S9Tqi1mWL9eCvnzUotGsGlErtMqWf4W47Wz97WHZgVH7L61Lw9szn kIN/WzJxL3M+aM838OQUPEEAoichnaJFfg6iPJd+cLHHgiptkg8fu9Cb3zpmrLMr tDm8AQs2wtLiZnAm4yVDRrddiFUzBs7LEDSkRJkv8ZDvdeDtl0pkLscE9k4FjbFa 1mYklLru/GNO/uq6hOzQiFwTlb7LqyJKdLqIPeevwjYl3GxLM4A= =84mQ -----END PGP SIGNATURE----- **Source:** qsb-115-2026.txt.sig.simon ## What is the purpose of this announcement? The purpose of this announcement is to inform the Qubes community that a new Qubes security bulletin (QSB) has been published. ## What is a Qubes security bulletin (QSB)? A Qubes security bulletin (QSB) is a security announcement issued by the Qubes security team. A QSB typically provides a summary and impact analysis of one or more recently-discovered software vulnerabilities, including details about patching to address them. ## Why should I care about QSBs? QSBs tell you what actions you must take in order to protect yourself from recently-discovered security vulnerabilities. In most cases, security vulnerabilities are addressed by updating normally. However, in some cases, special user action is required. In all cases, the required actions are detailed in QSBs. ## What are the PGP signatures that accompany QSBs? A PGP signature is a cryptographic digital signature made in accordance with the OpenPGP standard. PGP signatures can be cryptographically verified with programs like GNU Privacy Guard (GPG). The Qubes security team cryptographically signs all QSBs so that Qubes users have a reliable way to check whether QSBs are genuine. The only way to be certain that a QSB is authentic is by verifying its PGP signatures. ## Why should I care whether a QSB is authentic? A forged QSB could deceive you into taking actions that adversely affect the security of your Qubes OS system, such as installing malware or making configuration changes that render your system vulnerable to attack. Falsified QSBs could sow fear, uncertainty, and doubt about the security of Qubes OS or the status of the Qubes OS Project. ## How do I verify the PGP signatures on a QSB? The following command-line instructions assume a Linux system with `git` and `gpg` installed. (For Windows and Mac options, see OpenPGP software.) 1. Obtain the Qubes Master Signing Key (QMSK), e.g.: $ gpg --fetch-keys https://keys.qubes-os.org/keys/qubes-master-signing-key.asc gpg: directory '/home/user/.gnupg' created gpg: keybox '/home/user/.gnupg/pubring.kbx' created gpg: requesting key from 'https://keys.qubes-os.org/keys/qubes-master-signing-key.asc' gpg: /home/user/.gnupg/trustdb.gpg: trustdb created gpg: key DDFA1A3E36879494: public key "Qubes Master Signing Key" imported gpg: Total number processed: 1 gpg: imported: 1 (For more ways to obtain the QMSK, see How to import and authenticate the Qubes Master Signing Key.) 2. View the fingerprint of the PGP key you just imported. (Note: `gpg>` indicates a prompt inside of the GnuPG program. Type what appears after it when prompted.) $ gpg --edit-key 0x427F11FD0FAA4B080123F01CDDFA1A3E36879494 gpg (GnuPG) 2.2.27; Copyright (C) 2021 Free Software Foundation, Inc. This is free software: you are free to change and redistribute it. There is NO WARRANTY, to the extent permitted by law. pub rsa4096/DDFA1A3E36879494 created: 2010-04-01 expires: never usage: SC trust: unknown validity: unknown [ unknown] (1). Qubes Master Signing Key gpg> fpr pub rsa4096/DDFA1A3E36879494 2010-04-01 Qubes Master Signing Key Primary key fingerprint: 427F 11FD 0FAA 4B08 0123 F01C DDFA 1A3E 3687 9494 3. **Important:** At this point, you still don’t know whether the key you just imported is the genuine QMSK or a forgery. In order for this entire procedure to provide meaningful security benefits, you _must_ authenticate the QMSK out-of-band. **Do not skip this step!** The standard method is to obtain the QMSK fingerprint from _multiple independent sources in several different ways_ and check to see whether they match the key you just imported. For more information, see How to import and authenticate the Qubes Master Signing Key. **Tip:** After you have authenticated the QMSK out-of-band to your satisfaction, record the QMSK fingerprint in a safe place (or several) so that you don’t have to repeat this step in the future. 4. Once you are satisfied that you have the genuine QMSK, set its trust level to 5 (“ultimate”), then quit GnuPG with `q`. gpg> trust pub rsa4096/DDFA1A3E36879494 created: 2010-04-01 expires: never usage: SC trust: unknown validity: unknown [ unknown] (1). Qubes Master Signing Key Please decide how far you trust this user to correctly verify other users' keys (by looking at passports, checking fingerprints from different sources, etc.) 1 = I don't know or won't say 2 = I do NOT trust 3 = I trust marginally 4 = I trust fully 5 = I trust ultimately m = back to the main menu Your decision? 5 Do you really want to set this key to ultimate trust? (y/N) y pub rsa4096/DDFA1A3E36879494 created: 2010-04-01 expires: never usage: SC trust: ultimate validity: unknown [ unknown] (1). Qubes Master Signing Key Please note that the shown key validity is not necessarily correct unless you restart the program. gpg> q 5. Use Git to clone the qubes-secpack repo. $ git clone https://github.com/QubesOS/qubes-secpack.git Cloning into 'qubes-secpack'... remote: Enumerating objects: 4065, done. remote: Counting objects: 100% (1474/1474), done. remote: Compressing objects: 100% (742/742), done. remote: Total 4065 (delta 743), reused 1413 (delta 731), pack-reused 2591 Receiving objects: 100% (4065/4065), 1.64 MiB | 2.53 MiB/s, done. Resolving deltas: 100% (1910/1910), done. 6. Import the included PGP keys. (See our PGP key policies for important information about these keys.) $ gpg --import qubes-secpack/keys/*/* gpg: key 063938BA42CFA724: public key "Marek Marczykowski-Górecki (Qubes OS signing key)" imported gpg: qubes-secpack/keys/core-devs/retired: read error: Is a directory gpg: no valid OpenPGP data found. gpg: key 8C05216CE09C093C: 1 signature not checked due to a missing key gpg: key 8C05216CE09C093C: public key "HW42 (Qubes Signing Key)" imported gpg: key DA0434BC706E1FCF: public key "Simon Gaiser (Qubes OS signing key)" imported gpg: key 8CE137352A019A17: 2 signatures not checked due to missing keys gpg: key 8CE137352A019A17: public key "Andrew David Wong (Qubes Documentation Signing Key)" imported gpg: key AAA743B42FBC07A9: public key "Brennan Novak (Qubes Website & Documentation Signing)" imported gpg: key B6A0BB95CA74A5C3: public key "Joanna Rutkowska (Qubes Documentation Signing Key)" imported gpg: key F32894BE9684938A: public key "Marek Marczykowski-Górecki (Qubes Documentation Signing Key)" imported gpg: key 6E7A27B909DAFB92: public key "Hakisho Nukama (Qubes Documentation Signing Key)" imported gpg: key 485C7504F27D0A72: 1 signature not checked due to a missing key gpg: key 485C7504F27D0A72: public key "Sven Semmler (Qubes Documentation Signing Key)" imported gpg: key BB52274595B71262: public key "unman (Qubes Documentation Signing Key)" imported gpg: key DC2F3678D272F2A8: 1 signature not checked due to a missing key gpg: key DC2F3678D272F2A8: public key "Wojtek Porczyk (Qubes OS documentation signing key)" imported gpg: key FD64F4F9E9720C4D: 1 signature not checked due to a missing key gpg: key FD64F4F9E9720C4D: public key "Zrubi (Qubes Documentation Signing Key)" imported gpg: key DDFA1A3E36879494: "Qubes Master Signing Key" not changed gpg: key 1848792F9E2795E9: public key "Qubes OS Release 4 Signing Key" imported gpg: qubes-secpack/keys/release-keys/retired: read error: Is a directory gpg: no valid OpenPGP data found. gpg: key D655A4F21830E06A: public key "Marek Marczykowski-Górecki (Qubes security pack)" imported gpg: key ACC2602F3F48CB21: public key "Qubes OS Security Team" imported gpg: qubes-secpack/keys/security-team/retired: read error: Is a directory gpg: no valid OpenPGP data found. gpg: key 4AC18DE1112E1490: public key "Simon Gaiser (Qubes Security Pack signing key)" imported gpg: Total number processed: 17 gpg: imported: 16 gpg: unchanged: 1 gpg: marginals needed: 3 completes needed: 1 trust model: pgp gpg: depth: 0 valid: 1 signed: 6 trust: 0-, 0q, 0n, 0m, 0f, 1u gpg: depth: 1 valid: 6 signed: 0 trust: 6-, 0q, 0n, 0m, 0f, 0u 7. Verify signed Git tags. $ cd qubes-secpack/ $ git tag -v `git describe` object 266e14a6fae57c9a91362c9ac784d3a891f4d351 type commit tag marmarek_sec_266e14a6 tagger Marek Marczykowski-Górecki 1677757924 +0100 Tag for commit 266e14a6fae57c9a91362c9ac784d3a891f4d351 gpg: Signature made Thu 02 Mar 2023 03:52:04 AM PST gpg: using RSA key 2D1771FE4D767EDC76B089FAD655A4F21830E06A gpg: Good signature from "Marek Marczykowski-Górecki (Qubes security pack)" [full] The exact output will differ, but the final line should always start with `gpg: Good signature from...` followed by an appropriate key. The `[full]` indicates full trust, which this key inherits in virtue of being validly signed by the QMSK. 8. Verify PGP signatures, e.g.: $ cd QSBs/ $ gpg --verify qsb-087-2022.txt.sig.marmarek qsb-087-2022.txt gpg: Signature made Wed 23 Nov 2022 04:05:51 AM PST gpg: using RSA key 2D1771FE4D767EDC76B089FAD655A4F21830E06A gpg: Good signature from "Marek Marczykowski-Górecki (Qubes security pack)" [full] $ gpg --verify qsb-087-2022.txt.sig.simon qsb-087-2022.txt gpg: Signature made Wed 23 Nov 2022 03:50:42 AM PST gpg: using RSA key EA18E7F040C41DDAEFE9AA0F4AC18DE1112E1490 gpg: Good signature from "Simon Gaiser (Qubes Security Pack signing key)" [full] $ cd ../canaries/ $ gpg --verify canary-034-2023.txt.sig.marmarek canary-034-2023.txt gpg: Signature made Thu 02 Mar 2023 03:51:48 AM PST gpg: using RSA key 2D1771FE4D767EDC76B089FAD655A4F21830E06A gpg: Good signature from "Marek Marczykowski-Górecki (Qubes security pack)" [full] $ gpg --verify canary-034-2023.txt.sig.simon canary-034-2023.txt gpg: Signature made Thu 02 Mar 2023 01:47:52 AM PST gpg: using RSA key EA18E7F040C41DDAEFE9AA0F4AC18DE1112E1490 gpg: Good signature from "Simon Gaiser (Qubes Security Pack signing key)" [full] Again, the exact output will differ, but the final line of output from each `gpg --verify` command should always start with `gpg: Good signature from...` followed by an appropriate key. For this announcement (QSB-115), the commands are: $ gpg --verify qsb-115-2026.txt.sig.marmarek qsb-115-2026.txt $ gpg --verify qsb-115-2026.txt.sig.simon qsb-115-2026.txt You can also verify the signatures directly from this announcement in addition to or instead of verifying the files from the qubes-secpack. Simply copy and paste the QSB-115 text into a plain text file and do the same for both signature files. Then, perform the same authentication steps as listed above, substituting the filenames above with the names of the files you just created.

We have published Qubes Canary 047. The text of this canary and its accompanying cryptographic signatures are reproduced below. For an explanation of this announcement and instructions for authenticating this canary, please see the end of this announcement. ## Qubes Canary 047 ---===[ Qubes Canary 047 ]===--- Statements ----------- The Qubes security team members who have digitally signed this file [1] state the following: 1. The date of issue of this canary is June 03, 2026. 2. There have been 114 Qubes security bulletins published so far. 3. The Qubes Master Signing Key fingerprint is: 427F 11FD 0FAA 4B08 0123 F01C DDFA 1A3E 3687 9494 4. No warrants have ever been served to us with regard to the Qubes OS Project (e.g. to hand out the private signing keys or to introduce backdoors). 5. We plan to publish the next of these canary statements in the first fourteen days of September 2026. Special note should be taken if no new canary is published by that time or if the list of statements changes without plausible explanation. Special announcements ---------------------- None. Disclaimers and notes ---------------------- We would like to remind you that Qubes OS has been designed under the assumption that all relevant infrastructure is permanently compromised. This means that we assume NO trust in any of the servers or services which host or provide any Qubes-related data, in particular, software updates, source code repositories, and Qubes ISO downloads. This canary scheme is not infallible. Although signing the declaration makes it very difficult for a third party to produce arbitrary declarations, it does not prevent them from using force or other means, like blackmail or compromising the signers' laptops, to coerce us to produce false declarations. The proof of freshness provided below serves to demonstrate that this canary could not have been created prior to the date stated. It shows that a series of canaries was not created in advance. This declaration is merely a best effort and is provided without any guarantee or warranty. It is not legally binding in any way to anybody. None of the signers should be ever held legally responsible for any of the statements made here. Proof of freshness ------------------- Wed, 03 Jun 2026 02:51:46 +0000 Source: DER SPIEGEL - International (https://www.spiegel.de/international/index.rss) NSDAP archive: How DER SPIEGEL processed the data from the Nazi card file Interactive Research Tool: What Your Family Did Under Hitler – Find Out Here Human Rights in the US: Meet the Transgender Americans Forced to Flee GOP Persecution An Interview with Maduro's Son: "We Should Have Done More to Protect My Father" Forced Mercenaries: How Russia Dupes Kenyans into Fighting in Ukraine Source: NYT > World News (https://rss.nytimes.com/services/xml/rss/nyt/World.xml) Iran War Live Updates: Iran Targets Neighbors as U.S. Condemns ‘Aggressive’ Strikes Russia Launches Deadly Strikes on Kyiv After Threatening Ukraine for a Week U.S. Ebola Unit Plans in Kenya, Subject of Protests, Suffers New Setback From Court Ruling The New Zealand Parakeet Pair That Are Saving Their Species U.S. Was Asked to Blacklist Colombian Cartel Gold. It Was Also Buying It. Source: BBC News (https://feeds.bbci.co.uk/news/world/rss.xml) Israel strikes southern Lebanon but partial truce with Hezbollah appears to hold US and Iran launch new strikes as ceasefire negotiations stall Putin remains uncompromising on Ukraine, but is public discourse on war changing in Russia? 'They'll fix the building, but not our souls': Sleepy Kyiv neighbourhood hit in Russian strike British couple lose Iran jail sentence appeal, family says Source: Blockchain.info 00000000000000000001c7c4fb4f5b739e74f18ca4b3b6add30011982c0735d7 Footnotes ---------- [1] This file should be signed in two ways: (1) via detached PGP signatures by each of the signers, distributed together with this canary in the qubes-secpack.git repo, and (2) via digital signatures on the corresponding qubes-secpack.git repo tags. [2] [2] Don't just trust the contents of this file blindly! Verify the digital signatures! Instructions for doing so are documented here: https://doc.qubes-os.org/en/latest/project-security/security-pack.html -- The Qubes Security Team https://www.qubes-os.org/security/ Source: canary-047-2026.txt ## Marek Marczykowski-Górecki’s PGP signature -----BEGIN PGP SIGNATURE----- iQIzBAABCAAdFiEELRdx/k12ftx2sIn61lWk8hgw4GoFAmogGGoACgkQ1lWk8hgw 4GqoLxAAgGBg5spc/nfW5c04S0nP7WhAgrBsjsLJEG2COhYhc2rK5IiLVYd1JroF QJiqw4OLmBoCCka+QFUmhsnPK2iQ+IVdm9uSPcyBkhBHk6C1RYEbyJFMqVhWzaCf v846YoAeQuKTZAQHb+BsdL/4uQNRI8bhmdIs6mqE3cxdGoqzalitfQ8Un0dv67Ma LqZM48GpiBZipuwpzMHNQ49IRNvjO+wArLrlNaoPtJD9VJAQcjp5772xXI2mWCj7 2BCwoZQ2vvcQA5qg/QL9WWFt9AYcp5kxZXkaGbjzX60wPwSYFz8xPHHsAP2sSbap a6npFo49QX+V8ho8a3q811dw0q6FCiurip4D2MTTSqDQBzxb8boRl43mZcaZhc6I GzKeY/VuH30YLuP6QoItTj1cW1APVgDh6KVSWhE2pZgjfRxsimMJti7dY3FX91oF twIZog8Z7CmlKumhH459YABTKoLR0YQLdVqlyGXROOvX3C5kZw2FBbfiTtkjmg9O aNb+GJ2ihBjUYkW3k+WHKJdA5rnd9VzYd+9w0wEnr02U/Ghh8o6BmEQQbdrMemso TuuupdLkylN19oPltjhmtBl7qe5XA1cshkCngcLhom99WgeQIfayUUEUwsPQMbCC HzYqOb8YCvntllFGcAHyyhxGizJUgIa9e6xogwP9DRT5DOCXevE= =v00t -----END PGP SIGNATURE----- Source: canary-047-2026.txt.sig.marmarek ## Simon Gaiser (aka HW42)’s PGP signature -----BEGIN PGP SIGNATURE----- iQIzBAABCgAdFiEE6hjn8EDEHdrv6aoPSsGN4REuFJAFAmogYMsACgkQSsGN4REu FJCGMQ/7BfF8If6ooYaRvVxR/I/dqGBnE5vqmlKti89OfAHynZw4XpXbAsDXqZKV mPTRBMzfy5L9Ujo0xtmqg0+fMmhjzLqqUSlSRyZgGRUvkYkEV3tfG9qr0LWZmJLA dREye5fH5QYggcGUqZjRwcmSavdc/HfnTx6xW/yKzqH+43Gn3iAuHzr47J+vpvv3 Abr6aK1YKQGy5IvJ+CV5/9U4x+cDtYnuXqWoIZq0R8uHj1p4+wUnzWH1CIs1OKGQ nVUx0g6SH7ktqjGubhLIVGkPX6j/dKFN1OB1Qn2ooHQbqaHa4wDUM8TqdDna4gBP Batcgo6Kp7e+kec+OtEOHIjyFySNrNRtMpEI6cfVKmrGcBNDeWyfdV+5lpJtg4GP 0MyvgLovwYONkb8fWR25tAWj3O54Fjkydts9uM5cLWQBlQqUIbQBVRcXtHRmKgZS vrPf7ORjdBXf86CS35FTrwjKV9CcecZYgtQMthLOaYcsP4H5NKfnDr+4tyilaFjD dkl8rR6EbC+YV4OBNc+6OFBK9x7rV+uOrNqq00QHmsFw+jDEnQMKotWu49oZcszH 2vETkeXmJz0Mgs2H9KaY6xURj8bGHOGUfVSbZa1d55h+9R15j+94Hni/UyekgpEq AJ65/grY6xJ9iumeCFZhNYywvOzkeAQ2viDKzv9VfWcG31msmno= =ViwC -----END PGP SIGNATURE----- Source: canary-047-2026.txt.sig.simon ## What is the purpose of this announcement? The purpose of this announcement is to inform the Qubes community that a new Qubes canary has been published. ## What is a Qubes canary? A Qubes canary is a security announcement periodically issued by the Qubes security team consisting of several statements to the effect that the signers of the canary have not been compromised. The idea is that, as long as signed canaries including such statements continue to be published, all is well. However, if the canaries should suddenly cease, if one or more signers begin declining to sign them, or if the included statements change significantly without plausible explanation, then this may indicate that something has gone wrong. The name originates from the practice in which miners would bring caged canaries into coal mines. If the level of methane gas in the mine reached a dangerous level, the canary would die, indicating to miners that they should evacuate. (See the Wikipedia article on warrant canaries for more information, but bear in mind that Qubes Canaries are not strictly limited to legal warrants.) ## Why should I care about canaries? Canaries provide an important indication about the security status of the project. If the canary is healthy, it’s a strong sign that things are running normally. However, if the canary is unhealthy, it could mean that the project or its members are being coerced in some way. ## What are some signs of an unhealthy canary? Here is a non-exhaustive list of examples: * **Dead canary.** In each canary, we state a window of time during which you should expect the next canary to be published. If no canary is published within that window of time and no good explanation is provided for missing the deadline, then the canary has died. * **Missing statement(s).** Canaries include a set of numbered statements at the top. These statements are generally the same across canaries, except for specific numbers and dates that have changed since the previous canary. If an important statement was present in older canaries but suddenly goes missing from new canaries with no correction or explanation, then this may be an indication that the signers can no longer truthfully make that statement. * **Missing signature(s).** Qubes canaries are signed by the members of the Qubes security team (see below). If one of them has been signing all canaries but suddenly and permanently stops signing new canaries without any explanation, then this may indicate that this person is under duress or can no longer truthfully sign the statements contained in the canary. ## Does every unexpected or unusual occurrence related to a canary indicate something bad? No, there are many canary-related possibilities that should _not_ worry you. Here is a non-exhaustive list of examples: * **Unusual reposts.** The only canaries that matter are the ones that are validly signed in the Qubes security pack (qubes-secpack). Reposts of canaries (like the one in this announcement) do not have any authority (except insofar as they reproduce validly-signed text from the qubes-secpack). If the actual canary in the qubes-secpack is healthy, but reposts are late, absent, or modified on the website, mailing lists, forum, or social media platforms, you should not be concerned about the canary. * **Last-minute signature(s).** If the canary is signed at the last minute but before the deadline, that’s okay. (People get busy and procrastinate sometimes.) * **Signatures at different times.** If one signature is earlier or later than the other, but both are present within a reasonable period of time, that’s okay. (For example, sometimes one signer is out of town, but we try to plan the deadlines around this.) * **Permitted changes.** If something about a canary changes without violating any of the statements in prior canaries, that’s okay. (For example, canaries are usually scheduled for the first fourteen days of a given month, but there’s no rule that says they have to be.) * **Unusual but planned changes.** If something unusual happens, but it was announced in advance, and the appropriate statements are signed, that’s okay (e.g., when Joanna left the security team and Simon joined it). In general, it would not be realistic for an organization to exist that never changed, had zero turnover, and never made mistakes. Therefore, it would be reasonable to expect such events to occur periodically, and it would be unreasonable to regard _every_ unusual or unexpected canary-related event as a sign of compromise. For example, if something usual happens with a canary, and we say it was a mistake and correct it (with valid signatures), you will have to decide for yourself whether it’s more likely that it really was just a mistake or that something is wrong and that this is how we chose to send you a subtle signal about it. This will require you to think carefully about which among many possible scenarios is most likely given the evidence available to you. Since this is fundamentally a matter of judgment, canaries are ultimately a _social_ scheme, not a technical one. ## What are the PGP signatures that accompany canaries? A PGP signature is a cryptographic digital signature made in accordance with the OpenPGP standard. PGP signatures can be cryptographically verified with programs like GNU Privacy Guard (GPG). The Qubes security team cryptographically signs all canaries so that Qubes users have a reliable way to check whether canaries are genuine. The only way to be certain that a canary is authentic is by verifying its PGP signatures. ## Why should I care whether a canary is authentic? If you fail to notice that a canary is unhealthy or has died, you may continue to trust the Qubes security team even after they have signaled via the canary (or lack thereof) that they been compromised or coerced. Alternatively, an adversary could fabricate a canary in an attempt to deceive the public. Such a canary would not be validly signed, but users who neglect to check the signatures on the fake canary would not be aware of this, so they may mistakenly believe it to be genuine, especially if it closely mimics the language of authentic canaries. Such falsified canaries could include manipulated text designed to sow fear, uncertainty, and doubt about the security of Qubes OS or the status of the Qubes OS Project. ## How do I verify the PGP signatures on a canary? The following command-line instructions assume a Linux system with `git` and `gpg` installed. (For Windows and Mac options, see OpenPGP software.) 1. Obtain the Qubes Master Signing Key (QMSK), e.g.: $ gpg --fetch-keys https://keys.qubes-os.org/keys/qubes-master-signing-key.asc gpg: directory '/home/user/.gnupg' created gpg: keybox '/home/user/.gnupg/pubring.kbx' created gpg: requesting key from 'https://keys.qubes-os.org/keys/qubes-master-signing-key.asc' gpg: /home/user/.gnupg/trustdb.gpg: trustdb created gpg: key DDFA1A3E36879494: public key "Qubes Master Signing Key" imported gpg: Total number processed: 1 gpg: imported: 1 (For more ways to obtain the QMSK, see How to import and authenticate the Qubes Master Signing Key.) 2. View the fingerprint of the PGP key you just imported. (Note: `gpg>` indicates a prompt inside of the GnuPG program. Type what appears after it when prompted.) $ gpg --edit-key 0x427F11FD0FAA4B080123F01CDDFA1A3E36879494 gpg (GnuPG) 2.2.27; Copyright (C) 2021 Free Software Foundation, Inc. This is free software: you are free to change and redistribute it. There is NO WARRANTY, to the extent permitted by law. pub rsa4096/DDFA1A3E36879494 created: 2010-04-01 expires: never usage: SC trust: unknown validity: unknown [ unknown] (1). Qubes Master Signing Key gpg> fpr pub rsa4096/DDFA1A3E36879494 2010-04-01 Qubes Master Signing Key Primary key fingerprint: 427F 11FD 0FAA 4B08 0123 F01C DDFA 1A3E 3687 9494 3. **Important:** At this point, you still don’t know whether the key you just imported is the genuine QMSK or a forgery. In order for this entire procedure to provide meaningful security benefits, you _must_ authenticate the QMSK out-of-band. **Do not skip this step!** The standard method is to obtain the QMSK fingerprint from _multiple independent sources in several different ways_ and check to see whether they match the key you just imported. For more information, see How to import and authenticate the Qubes Master Signing Key. **Tip:** After you have authenticated the QMSK out-of-band to your satisfaction, record the QMSK fingerprint in a safe place (or several) so that you don’t have to repeat this step in the future. 4. Once you are satisfied that you have the genuine QMSK, set its trust level to 5 (“ultimate”), then quit GnuPG with `q`. gpg> trust pub rsa4096/DDFA1A3E36879494 created: 2010-04-01 expires: never usage: SC trust: unknown validity: unknown [ unknown] (1). Qubes Master Signing Key Please decide how far you trust this user to correctly verify other users' keys (by looking at passports, checking fingerprints from different sources, etc.) 1 = I don't know or won't say 2 = I do NOT trust 3 = I trust marginally 4 = I trust fully 5 = I trust ultimately m = back to the main menu Your decision? 5 Do you really want to set this key to ultimate trust? (y/N) y pub rsa4096/DDFA1A3E36879494 created: 2010-04-01 expires: never usage: SC trust: ultimate validity: unknown [ unknown] (1). Qubes Master Signing Key Please note that the shown key validity is not necessarily correct unless you restart the program. gpg> q 5. Use Git to clone the qubes-secpack repo. $ git clone https://github.com/QubesOS/qubes-secpack.git Cloning into 'qubes-secpack'... remote: Enumerating objects: 4065, done. remote: Counting objects: 100% (1474/1474), done. remote: Compressing objects: 100% (742/742), done. remote: Total 4065 (delta 743), reused 1413 (delta 731), pack-reused 2591 Receiving objects: 100% (4065/4065), 1.64 MiB | 2.53 MiB/s, done. Resolving deltas: 100% (1910/1910), done. 6. Import the included PGP keys. (See our PGP key policies for important information about these keys.) $ gpg --import qubes-secpack/keys/*/* gpg: key 063938BA42CFA724: public key "Marek Marczykowski-Górecki (Qubes OS signing key)" imported gpg: qubes-secpack/keys/core-devs/retired: read error: Is a directory gpg: no valid OpenPGP data found. gpg: key 8C05216CE09C093C: 1 signature not checked due to a missing key gpg: key 8C05216CE09C093C: public key "HW42 (Qubes Signing Key)" imported gpg: key DA0434BC706E1FCF: public key "Simon Gaiser (Qubes OS signing key)" imported gpg: key 8CE137352A019A17: 2 signatures not checked due to missing keys gpg: key 8CE137352A019A17: public key "Andrew David Wong (Qubes Documentation Signing Key)" imported gpg: key AAA743B42FBC07A9: public key "Brennan Novak (Qubes Website & Documentation Signing)" imported gpg: key B6A0BB95CA74A5C3: public key "Joanna Rutkowska (Qubes Documentation Signing Key)" imported gpg: key F32894BE9684938A: public key "Marek Marczykowski-Górecki (Qubes Documentation Signing Key)" imported gpg: key 6E7A27B909DAFB92: public key "Hakisho Nukama (Qubes Documentation Signing Key)" imported gpg: key 485C7504F27D0A72: 1 signature not checked due to a missing key gpg: key 485C7504F27D0A72: public key "Sven Semmler (Qubes Documentation Signing Key)" imported gpg: key BB52274595B71262: public key "unman (Qubes Documentation Signing Key)" imported gpg: key DC2F3678D272F2A8: 1 signature not checked due to a missing key gpg: key DC2F3678D272F2A8: public key "Wojtek Porczyk (Qubes OS documentation signing key)" imported gpg: key FD64F4F9E9720C4D: 1 signature not checked due to a missing key gpg: key FD64F4F9E9720C4D: public key "Zrubi (Qubes Documentation Signing Key)" imported gpg: key DDFA1A3E36879494: "Qubes Master Signing Key" not changed gpg: key 1848792F9E2795E9: public key "Qubes OS Release 4 Signing Key" imported gpg: qubes-secpack/keys/release-keys/retired: read error: Is a directory gpg: no valid OpenPGP data found. gpg: key D655A4F21830E06A: public key "Marek Marczykowski-Górecki (Qubes security pack)" imported gpg: key ACC2602F3F48CB21: public key "Qubes OS Security Team" imported gpg: qubes-secpack/keys/security-team/retired: read error: Is a directory gpg: no valid OpenPGP data found. gpg: key 4AC18DE1112E1490: public key "Simon Gaiser (Qubes Security Pack signing key)" imported gpg: Total number processed: 17 gpg: imported: 16 gpg: unchanged: 1 gpg: marginals needed: 3 completes needed: 1 trust model: pgp gpg: depth: 0 valid: 1 signed: 6 trust: 0-, 0q, 0n, 0m, 0f, 1u gpg: depth: 1 valid: 6 signed: 0 trust: 6-, 0q, 0n, 0m, 0f, 0u 7. Verify signed Git tags. $ cd qubes-secpack/ $ git tag -v `git describe` object 266e14a6fae57c9a91362c9ac784d3a891f4d351 type commit tag marmarek_sec_266e14a6 tagger Marek Marczykowski-Górecki 1677757924 +0100 Tag for commit 266e14a6fae57c9a91362c9ac784d3a891f4d351 gpg: Signature made Thu 02 Mar 2023 03:52:04 AM PST gpg: using RSA key 2D1771FE4D767EDC76B089FAD655A4F21830E06A gpg: Good signature from "Marek Marczykowski-Górecki (Qubes security pack)" [full] The exact output will differ, but the final line should always start with `gpg: Good signature from...` followed by an appropriate key. The `[full]` indicates full trust, which this key inherits in virtue of being validly signed by the QMSK. 8. Verify PGP signatures, e.g.: $ cd QSBs/ $ gpg --verify qsb-087-2022.txt.sig.marmarek qsb-087-2022.txt gpg: Signature made Wed 23 Nov 2022 04:05:51 AM PST gpg: using RSA key 2D1771FE4D767EDC76B089FAD655A4F21830E06A gpg: Good signature from "Marek Marczykowski-Górecki (Qubes security pack)" [full] $ gpg --verify qsb-087-2022.txt.sig.simon qsb-087-2022.txt gpg: Signature made Wed 23 Nov 2022 03:50:42 AM PST gpg: using RSA key EA18E7F040C41DDAEFE9AA0F4AC18DE1112E1490 gpg: Good signature from "Simon Gaiser (Qubes Security Pack signing key)" [full] $ cd ../canaries/ $ gpg --verify canary-034-2023.txt.sig.marmarek canary-034-2023.txt gpg: Signature made Thu 02 Mar 2023 03:51:48 AM PST gpg: using RSA key 2D1771FE4D767EDC76B089FAD655A4F21830E06A gpg: Good signature from "Marek Marczykowski-Górecki (Qubes security pack)" [full] $ gpg --verify canary-034-2023.txt.sig.simon canary-034-2023.txt gpg: Signature made Thu 02 Mar 2023 01:47:52 AM PST gpg: using RSA key EA18E7F040C41DDAEFE9AA0F4AC18DE1112E1490 gpg: Good signature from "Simon Gaiser (Qubes Security Pack signing key)" [full] Again, the exact output will differ, but the final line of output from each `gpg --verify` command should always start with `gpg: Good signature from...` followed by an appropriate key. For this announcement (Qubes Canary 047), the commands are: $ gpg --verify canary-047-2026.txt.sig.marmarek canary-047-2026.txt $ gpg --verify canary-047-2026.txt.sig.simon canary-047-2026.txt You can also verify the signatures directly from this announcement in addition to or instead of verifying the files from the qubes-secpack. Simply copy and paste the Qubes Canary 047 text into a plain text file and do the same for both signature files. Then, perform the same authentication steps as listed above, substituting the filenames above with the names of the files you just created.

The first release candidate (RC) for Qubes OS 4.3.1 is now available for testing. This patch release aims to consolidate all the security patches, bug fixes, and other updates that have occurred since the release of Qubes 4.3.0. ## What’s new in Qubes 4.3.1? * Default Fedora template upgraded to Fedora 43. (Note: Fedora 42 has reached end of life.) * Many bug fixes ## When is the stable release? That depends on the number of bugs discovered in this RC and their severity. As explained in our release schedule documentation, our usual process after issuing a new RC is to collect bug reports, triage the bugs, and fix them. If warranted, we then issue a new RC that includes the fixes and repeat the process. We continue this iterative procedure until we’re left with an RC that’s good enough to be declared the stable release. No one can predict with certainty, at the outset, how many iterations will be required (and hence how many RCs will be needed before a stable release), but we tend to get a clearer picture of this as testing progresses. Since the changes between 4.3.0 and 4.3.1 are relatively minor, we currently don’t anticipate any major problems requiring a second RC. We currently expect to be able to publish the stable 4.3.1 release in one to two weeks. ## How to test Qubes 4.3.1-rc1 If you’d like to help us test this RC, the best way to do so is by performing a clean installation with the new ISO. As always, we strongly recommend making a full backup beforehand and updating Qubes OS immediately afterward in order to apply all available bug fixes. As an alternative to a clean installation, there’s also the option of performing an in-place upgrade without reinstalling. However, since Qubes 4.3.1 is a patch release, it’s essentially Qubes 4.3.0 inclusive of all updates to date, which largely amounts to just using a fully-updated 4.3.0 installation. By contrast, a clean installation covers other areas that could also benefit from testing, such as the installation procedure, which is why it’s the recommended testing method. Regardless of your testing method, please help us improve the eventual stable release by reporting any bugs you encounter. If you’re an experienced user, we encourage you to join the testing team. ## Known issues in Qubes OS 4.3.1 It is possible that templates restored in 4.3.1 from a pre-4.3 backup may continue to target their original Qubes OS release repos. This does not affect fresh templates on a clean 4.3.1 installation. For more information, see issue #8701. View the full list of known bugs affecting Qubes 4.3 in our issue tracker. ## What’s a release candidate? A release candidate (RC) is a software build that has the potential to become a stable release, unless significant bugs are discovered in testing. RCs are intended for more advanced (or adventurous!) users who are comfortable testing early versions of software that are potentially buggier than stable releases. You can read more about Qubes OS supported releases and the version scheme in our documentation. ## What’s a patch release? The Qubes OS Project uses the semantic versioning standard. Version numbers are written as `[major].[minor].[patch]`. Hence, we refer to releases that increment the third number as “patch releases.” A patch release does not designate a separate, new major or minor release of Qubes OS. Rather, it designates its respective major or minor release (in this case, 4.3) inclusive of all updates up to a certain point. See our supported releases for a comprehensive list of major and minor releases and our version scheme documentation for more information about how Qubes OS releases are versioned.

We have published Qubes Security Bulletin (QSB) 114: Intel CPU data exposure vulnerability. The text of this QSB and its accompanying cryptographic signatures are reproduced below, followed by a general explanation of this announcement and authentication instructions. ## Qubes Security Bulletin 114 ---===[ Qubes Security Bulletin 114 ]===--- 2026-05-13 Intel CPU data exposure vulnerability User action ------------ Continue to update normally [1] in order to receive the security updates described in the "Patching" section below. No other user action is required in response to this QSB. Summary -------- On 2026-05-12, Intel published "2026.2 IPU-Intel Processor Firmware Advisory" (INTEL-SA-01420, CVE-2025-35979). [3] Unfortunately, this advisory does not provide sufficient information for us to make a definitive assessment about the extent to which this vulnerability affects the security of Qubes OS. Based on the limited information available, we surmise that it is likely that it might affect cross-qube data exposure. Impact ------- On affected systems, an attacker who has managed to compromise one qube can attempt to exploit this vulnerability in order to infer data belonging to other qubes. Affected systems ----------------- Intel Core Ultra Series 2 and 3 processors are affected. For a more detailed list of affected products, see Intel's "2026.2 IPU-Intel Processor Firmware Advisory." [3] Patching --------- The following packages contain security updates that address the vulnerabilities described in this bulletin: For Qubes 4.2 and 4.3, in dom0: - microcode_ctl version 2.1.20260512 These packages will migrate from the security-testing repository to the current (stable) repository over the next two weeks after being tested by the community. [2] Once available, the packages should be installed via the Qubes Update tool or its command-line equivalents. [1] Dom0 must be restarted afterward in order for the updates to take effect. If you use Anti Evil Maid, you will need to reseal your secret passphrase to new PCR values, as PCR18+19 will change due to the new microcode updates. Credits -------- See Intel's "2026.2 IPU-Intel Processor Firmware Advisory." [3] References ----------- [1] https://doc.qubes-os.org/en/latest/user/how-to-guides/how-to-update.html [2] https://doc.qubes-os.org/en/latest/user/downloading-installing-upgrading/testing.html [3] https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01420.html -- The Qubes Security Team https://www.qubes-os.org/security/ **Source:** qsb-114-2026.txt ## Marek Marczykowski-Górecki’s PGP signature -----BEGIN PGP SIGNATURE----- iQIzBAABCAAdFiEELRdx/k12ftx2sIn61lWk8hgw4GoFAmoFN9QACgkQ1lWk8hgw 4GqUbBAAiXjMrnNlWAfCno5WRQ+O//A+gvWNja8oVYqqGYIXOlT6nyIloGUueY4S q+Cg5QWsgFJ+gVFn0z3ZgIUi5ryIIvucesFP/ZG1ipmmu29dVaiQKcHRadAUInTI TMywxnz7LArebbu3saS3BpLGdYX3PdXVg5WFdUC3XHg+g0/AFR+RXZEjuvJ8vbM0 QPIRaGbBVnqSXQ7Y2fKia5uycQsZmn8ua4GB17LZYkbPgih6cwOe3R5fKuICCtZ2 OkjJFMfZEZEKzean66oPMPz5tBlMrmDlixrYsWYmaQO2P86fOt9QyoskJ3FEPtQZ ZNV+c8fD8aRp1xsDxTx6DKgSevldYrRbovW/+bBHcdbbnCxPYffRKbS71Nuk48RF 1Vj5D2mZRM7Vq4P5LSQHfRfoDk1eCRDSIvxw0jhpf4Jq2SO6FXZD/rFUcoCPerRJ ghUls8zWPbkgDPu8UMwkosZIOuHPoxmexm3U+wFb7n63R9iXRrS6wIjDlsoC8aZw WAlc8Ra+hASnGE1SWiBHE2uVLzNx7DKfa38mXph0eJ44FhLGBur4F8V/Jhqe9bCM oCAjP+1al8yDs/KQP2kI++mHqBsy2YKfEW3Jks/e3t/3e10tJ1W2a5I9cPPrIoAe /gZu6FtBmZAEFAmNuWWj+2wM4k2DLFq8ojE4lFjNqrfCxD+E6cY= =0kpC -----END PGP SIGNATURE----- **Source:** qsb-114-2026.txt.sig.marmarek ## Simon Gaiser (aka HW42)’s PGP signature -----BEGIN PGP SIGNATURE----- iQIzBAABCgAdFiEE6hjn8EDEHdrv6aoPSsGN4REuFJAFAmoFossACgkQSsGN4REu FJCUfw/+OlXTGq66HQGv6O8Bp060fXmopjpJGSP/XJ6GC4OfDSNPQwwwuPHBFDyV ZH8BabEbwF8vVG0AEYgWtGOicGsOkrQgySGfnJ0SMMdmgfbrU3ADyA7tGrlgaSRX xqgX3gHtdvYT+WTplom66XPmRq+ANYL2De0ju23WXxwZ+H+twDB1hzmttzOpg95R EDkcblB0LPvmIlnLDwNv38lCwYJr4B0cANvdEafnwbvOGQV0VqYxWMfC2gvHHIQ9 Wbd4gPSczuwvMlac6paEZL1paA53IDDVaGu9mJJEvYS8Mv7PGc4Q4cSCbrCPJ5to Y3iAlWjAOFshcQvn5kq7RM5MDFrelQ+qb891PHBaH1TFZQnU5GXVM50l8k5wt6Eb bn8hWphr5U2c0smpr9/xO3WhDIMDu2ACddBFt1caqYtuyjhy/Z0D848aW0iRxyNq RM4DLqqR1vtk/Og9mbJg05hdExWy4tAuZscSIQasuv+KaUAwG2gaJTdric7aPH2R n/wGliEy+5U1ICm3kRVRpA8hYumYgIBd1Ez5zHrsp9sEPXrTbtsYrUzesyg74GN1 9GajWdJqSxpvQQSjnIFhZY3K1GqMzNpTr3ggnOKa4czDIqVCzALYHXB49N46l5yI JkO/MDVB4Iw4JCHS+9jR4Z0tcHWyC+FtA+rOgOpNPw7nL2RM4zA= =0Hee -----END PGP SIGNATURE----- **Source:** qsb-114-2026.txt.sig.simon ## What is the purpose of this announcement? The purpose of this announcement is to inform the Qubes community that a new Qubes security bulletin (QSB) has been published. ## What is a Qubes security bulletin (QSB)? A Qubes security bulletin (QSB) is a security announcement issued by the Qubes security team. A QSB typically provides a summary and impact analysis of one or more recently-discovered software vulnerabilities, including details about patching to address them. ## Why should I care about QSBs? QSBs tell you what actions you must take in order to protect yourself from recently-discovered security vulnerabilities. In most cases, security vulnerabilities are addressed by updating normally. However, in some cases, special user action is required. In all cases, the required actions are detailed in QSBs. ## What are the PGP signatures that accompany QSBs? A PGP signature is a cryptographic digital signature made in accordance with the OpenPGP standard. PGP signatures can be cryptographically verified with programs like GNU Privacy Guard (GPG). The Qubes security team cryptographically signs all QSBs so that Qubes users have a reliable way to check whether QSBs are genuine. The only way to be certain that a QSB is authentic is by verifying its PGP signatures. ## Why should I care whether a QSB is authentic? A forged QSB could deceive you into taking actions that adversely affect the security of your Qubes OS system, such as installing malware or making configuration changes that render your system vulnerable to attack. Falsified QSBs could sow fear, uncertainty, and doubt about the security of Qubes OS or the status of the Qubes OS Project. ## How do I verify the PGP signatures on a QSB? The following command-line instructions assume a Linux system with `git` and `gpg` installed. (For Windows and Mac options, see OpenPGP software.) 1. Obtain the Qubes Master Signing Key (QMSK), e.g.: $ gpg --fetch-keys https://keys.qubes-os.org/keys/qubes-master-signing-key.asc gpg: directory '/home/user/.gnupg' created gpg: keybox '/home/user/.gnupg/pubring.kbx' created gpg: requesting key from 'https://keys.qubes-os.org/keys/qubes-master-signing-key.asc' gpg: /home/user/.gnupg/trustdb.gpg: trustdb created gpg: key DDFA1A3E36879494: public key "Qubes Master Signing Key" imported gpg: Total number processed: 1 gpg: imported: 1 (For more ways to obtain the QMSK, see How to import and authenticate the Qubes Master Signing Key.) 2. View the fingerprint of the PGP key you just imported. (Note: `gpg>` indicates a prompt inside of the GnuPG program. Type what appears after it when prompted.) $ gpg --edit-key 0x427F11FD0FAA4B080123F01CDDFA1A3E36879494 gpg (GnuPG) 2.2.27; Copyright (C) 2021 Free Software Foundation, Inc. This is free software: you are free to change and redistribute it. There is NO WARRANTY, to the extent permitted by law. pub rsa4096/DDFA1A3E36879494 created: 2010-04-01 expires: never usage: SC trust: unknown validity: unknown [ unknown] (1). Qubes Master Signing Key gpg> fpr pub rsa4096/DDFA1A3E36879494 2010-04-01 Qubes Master Signing Key Primary key fingerprint: 427F 11FD 0FAA 4B08 0123 F01C DDFA 1A3E 3687 9494 3. **Important:** At this point, you still don’t know whether the key you just imported is the genuine QMSK or a forgery. In order for this entire procedure to provide meaningful security benefits, you _must_ authenticate the QMSK out-of-band. **Do not skip this step!** The standard method is to obtain the QMSK fingerprint from _multiple independent sources in several different ways_ and check to see whether they match the key you just imported. For more information, see How to import and authenticate the Qubes Master Signing Key. **Tip:** After you have authenticated the QMSK out-of-band to your satisfaction, record the QMSK fingerprint in a safe place (or several) so that you don’t have to repeat this step in the future. 4. Once you are satisfied that you have the genuine QMSK, set its trust level to 5 (“ultimate”), then quit GnuPG with `q`. gpg> trust pub rsa4096/DDFA1A3E36879494 created: 2010-04-01 expires: never usage: SC trust: unknown validity: unknown [ unknown] (1). Qubes Master Signing Key Please decide how far you trust this user to correctly verify other users' keys (by looking at passports, checking fingerprints from different sources, etc.) 1 = I don't know or won't say 2 = I do NOT trust 3 = I trust marginally 4 = I trust fully 5 = I trust ultimately m = back to the main menu Your decision? 5 Do you really want to set this key to ultimate trust? (y/N) y pub rsa4096/DDFA1A3E36879494 created: 2010-04-01 expires: never usage: SC trust: ultimate validity: unknown [ unknown] (1). Qubes Master Signing Key Please note that the shown key validity is not necessarily correct unless you restart the program. gpg> q 5. Use Git to clone the qubes-secpack repo. $ git clone https://github.com/QubesOS/qubes-secpack.git Cloning into 'qubes-secpack'... remote: Enumerating objects: 4065, done. remote: Counting objects: 100% (1474/1474), done. remote: Compressing objects: 100% (742/742), done. remote: Total 4065 (delta 743), reused 1413 (delta 731), pack-reused 2591 Receiving objects: 100% (4065/4065), 1.64 MiB | 2.53 MiB/s, done. Resolving deltas: 100% (1910/1910), done. 6. Import the included PGP keys. (See our PGP key policies for important information about these keys.) $ gpg --import qubes-secpack/keys/*/* gpg: key 063938BA42CFA724: public key "Marek Marczykowski-Górecki (Qubes OS signing key)" imported gpg: qubes-secpack/keys/core-devs/retired: read error: Is a directory gpg: no valid OpenPGP data found. gpg: key 8C05216CE09C093C: 1 signature not checked due to a missing key gpg: key 8C05216CE09C093C: public key "HW42 (Qubes Signing Key)" imported gpg: key DA0434BC706E1FCF: public key "Simon Gaiser (Qubes OS signing key)" imported gpg: key 8CE137352A019A17: 2 signatures not checked due to missing keys gpg: key 8CE137352A019A17: public key "Andrew David Wong (Qubes Documentation Signing Key)" imported gpg: key AAA743B42FBC07A9: public key "Brennan Novak (Qubes Website & Documentation Signing)" imported gpg: key B6A0BB95CA74A5C3: public key "Joanna Rutkowska (Qubes Documentation Signing Key)" imported gpg: key F32894BE9684938A: public key "Marek Marczykowski-Górecki (Qubes Documentation Signing Key)" imported gpg: key 6E7A27B909DAFB92: public key "Hakisho Nukama (Qubes Documentation Signing Key)" imported gpg: key 485C7504F27D0A72: 1 signature not checked due to a missing key gpg: key 485C7504F27D0A72: public key "Sven Semmler (Qubes Documentation Signing Key)" imported gpg: key BB52274595B71262: public key "unman (Qubes Documentation Signing Key)" imported gpg: key DC2F3678D272F2A8: 1 signature not checked due to a missing key gpg: key DC2F3678D272F2A8: public key "Wojtek Porczyk (Qubes OS documentation signing key)" imported gpg: key FD64F4F9E9720C4D: 1 signature not checked due to a missing key gpg: key FD64F4F9E9720C4D: public key "Zrubi (Qubes Documentation Signing Key)" imported gpg: key DDFA1A3E36879494: "Qubes Master Signing Key" not changed gpg: key 1848792F9E2795E9: public key "Qubes OS Release 4 Signing Key" imported gpg: qubes-secpack/keys/release-keys/retired: read error: Is a directory gpg: no valid OpenPGP data found. gpg: key D655A4F21830E06A: public key "Marek Marczykowski-Górecki (Qubes security pack)" imported gpg: key ACC2602F3F48CB21: public key "Qubes OS Security Team" imported gpg: qubes-secpack/keys/security-team/retired: read error: Is a directory gpg: no valid OpenPGP data found. gpg: key 4AC18DE1112E1490: public key "Simon Gaiser (Qubes Security Pack signing key)" imported gpg: Total number processed: 17 gpg: imported: 16 gpg: unchanged: 1 gpg: marginals needed: 3 completes needed: 1 trust model: pgp gpg: depth: 0 valid: 1 signed: 6 trust: 0-, 0q, 0n, 0m, 0f, 1u gpg: depth: 1 valid: 6 signed: 0 trust: 6-, 0q, 0n, 0m, 0f, 0u 7. Verify signed Git tags. $ cd qubes-secpack/ $ git tag -v `git describe` object 266e14a6fae57c9a91362c9ac784d3a891f4d351 type commit tag marmarek_sec_266e14a6 tagger Marek Marczykowski-Górecki 1677757924 +0100 Tag for commit 266e14a6fae57c9a91362c9ac784d3a891f4d351 gpg: Signature made Thu 02 Mar 2023 03:52:04 AM PST gpg: using RSA key 2D1771FE4D767EDC76B089FAD655A4F21830E06A gpg: Good signature from "Marek Marczykowski-Górecki (Qubes security pack)" [full] The exact output will differ, but the final line should always start with `gpg: Good signature from...` followed by an appropriate key. The `[full]` indicates full trust, which this key inherits in virtue of being validly signed by the QMSK. 8. Verify PGP signatures, e.g.: $ cd QSBs/ $ gpg --verify qsb-087-2022.txt.sig.marmarek qsb-087-2022.txt gpg: Signature made Wed 23 Nov 2022 04:05:51 AM PST gpg: using RSA key 2D1771FE4D767EDC76B089FAD655A4F21830E06A gpg: Good signature from "Marek Marczykowski-Górecki (Qubes security pack)" [full] $ gpg --verify qsb-087-2022.txt.sig.simon qsb-087-2022.txt gpg: Signature made Wed 23 Nov 2022 03:50:42 AM PST gpg: using RSA key EA18E7F040C41DDAEFE9AA0F4AC18DE1112E1490 gpg: Good signature from "Simon Gaiser (Qubes Security Pack signing key)" [full] $ cd ../canaries/ $ gpg --verify canary-034-2023.txt.sig.marmarek canary-034-2023.txt gpg: Signature made Thu 02 Mar 2023 03:51:48 AM PST gpg: using RSA key 2D1771FE4D767EDC76B089FAD655A4F21830E06A gpg: Good signature from "Marek Marczykowski-Górecki (Qubes security pack)" [full] $ gpg --verify canary-034-2023.txt.sig.simon canary-034-2023.txt gpg: Signature made Thu 02 Mar 2023 01:47:52 AM PST gpg: using RSA key EA18E7F040C41DDAEFE9AA0F4AC18DE1112E1490 gpg: Good signature from "Simon Gaiser (Qubes Security Pack signing key)" [full] Again, the exact output will differ, but the final line of output from each `gpg --verify` command should always start with `gpg: Good signature from...` followed by an appropriate key. For this announcement (QSB-114), the commands are: $ gpg --verify qsb-114-2026.txt.sig.marmarek qsb-114-2026.txt $ gpg --verify qsb-114-2026.txt.sig.simon qsb-114-2026.txt You can also verify the signatures directly from this announcement in addition to or instead of verifying the files from the qubes-secpack. Simply copy and paste the QSB-114 text into a plain text file and do the same for both signature files. Then, perform the same authentication steps as listed above, substituting the filenames above with the names of the files you just created.

We have published Qubes Security Bulletin (QSB) 113: AMD CPU Opcode Cache corruption (XSA-490). The text of this QSB and its accompanying cryptographic signatures are reproduced below, followed by a general explanation of this announcement and authentication instructions. ## Qubes Security Bulletin 113 ---===[ Qubes Security Bulletin 113 ]===--- 2026-05-12 AMD CPU Opcode Cache corruption (XSA-490) User action ------------ Continue to update normally [1] in order to receive the security updates described in the "Patching" section below. No other user action is required in response to this QSB. Summary -------- On 2026-05-12, the Xen Project published XSA-490, "x86: CPU Opcode Cache corruption" (CVE-2025-54518) [3]: | AMD have disclosed a potential vulnerability in certain CPUs which can | cause instructions to execute at a higher privilege. For more information, see AMD's "CPU OP Cache Corruption" advisory. [4] Impact ------- On affected systems, an attacker can attempt to exploit this vulnerability in order to: - escalate privileges from userspace to the kernel inside of a given qube in order to escape sandboxes inside that qube - compromise Qubes OS itself Affected systems ----------------- Only AMD Zen 2 systems are affected. Systems with other AMD microarchitectures and systems with Intel processors are not affected. Patching --------- The following packages contain security updates that address the vulnerabilities described in this bulletin: For Qubes 4.2, in dom0: - Xen packages, version 4.17.6-5 For Qubes 4.3, in dom0: - Xen packages, version 4.19.4-8 These packages will migrate from the security-testing repository to the current (stable) repository over the next two weeks after being tested by the community. [2] Once available, the packages should be installed via the Qubes Update tool or its command-line equivalents. [1] Dom0 must be restarted afterward in order for the updates to take effect. If you use Anti Evil Maid, you will need to reseal your secret passphrase to new PCR values, as PCR18+19 will change due to the new Xen binaries. Credits -------- See AMD's "CPU OP Cache Corruption" advisory. [4] References ----------- [1] https://doc.qubes-os.org/en/latest/user/how-to-guides/how-to-update.html [2] https://doc.qubes-os.org/en/latest/user/downloading-installing-upgrading/testing.html [3] https://xenbits.xen.org/xsa/advisory-490.html [4] https://www.amd.com/en/resources/product-security/bulletin/amd-sb-7052.html -- The Qubes Security Team https://www.qubes-os.org/security/ **Source:** qsb-113-2026.txt ## Marek Marczykowski-Górecki’s PGP signature -----BEGIN PGP SIGNATURE----- iQIzBAABCAAdFiEELRdx/k12ftx2sIn61lWk8hgw4GoFAmoEZPMACgkQ1lWk8hgw 4Gog8Q/+MhlqZQ4EfpXn0jy4qP2SOD2mk0e5gzokxhMrvENxKzBKa5h2UB/zFruU uud72pSlvH7bP1+izHrxK5Ld+lPaK4ZVXbbyaC6Cqx09HihGLljhMl/zKELT6hi8 LzZqT3+eSPiagi58cqkRdiKOhCM+ew4TUAtoAPHSd/Wun8Ao8Cl3HZiAHlsIc1uJ T8mHfAD7WetO24aa72g8D5s/huOLccUKIiXdDygtGJO1uTPT1uGfav5YtFYeB0nZ y6HqFSNKC83JFHUZpP6FJqNsYn/M96Faw8G4utiV9N1Vhd8APnPU/DGSY1hE46/x 5ANuH2mIeGiuIG8pF1ucRRjLejpatN829MVxz8D8e6eI9SqprysMBi5LJw9rlihk F31p028hlx+towv3cVHqtr/qHWAzHe7RzQce6CnKd/R0Aoj3fAhLMdgwHiKYkF4L Fq9XpJJeQyJ9cRxs2zyLGX7XQWfb7cobP8CImL+fOaY0RxEovkKcsiyVRwcOu+OX afAMNAGyn+EJxKwp4nF4vzvFbqAJILtuMCPfqvCMKHbUe2rnOudGsOzDps8P5+eD 5l6oDKly2NfMiIiyyjbDYuKYzE3JQlTMSbiAlYRIxaP3/yhQxM/H/hxTvtx4o6GG 9mCcc3SpWhAsp7kOJM0bkK2zZezgovQ2L6dHBlem+HpizfHvrEU= =EDLg -----END PGP SIGNATURE----- **Source:** qsb-113-2026.txt.sig.marmarek ## Simon Gaiser (aka HW42)’s PGP signature -----BEGIN PGP SIGNATURE----- iQIzBAABCgAdFiEE6hjn8EDEHdrv6aoPSsGN4REuFJAFAmoEXn8ACgkQSsGN4REu FJCQRw/9FEFMx/P4GvKO5Kf4xTwuvdDasQ67hJD7D04xXNqOyiot/k4CgWQ421CI efsecioFz0MAKqGa1cHYL44wOxAw1ot7QP5AmPvkiRVO8se0hsBepZggzB5vf50X F+amqs3TAIcEiVlIf9PO9pgHz1oZuj0lqQBQkvD2zSwpb9oXPTIFicAndDYHkX8f GT5iRc4tI4aVAYwnThIQWaEFxgUU8+EpspnA7hkZbz0rxx6rmNqyEY16oTt5Pu2U 6E93rcIo9+M+zmuQjkkQiN3jjJn3gukCQ7uBTHRcTrc+vUVEDii83CxDPMUlxXfj t3MlC2Zk93Ikw7PEDaY0QqP3d0a7IjwY547rzPKzkPIyLsMMTrRktOwkKSz3BUgr WSvjkhnSiDKaxZXf9u0/vMRzXfLsXC4+bZI78d9IewLB1bfBKeVTUTcgaLgoteLn mjP3rueNCXXRXhhcZOEyZxfIhv+ePsFaVGSjdDFJ+B1tFz1j6rkuymOWimuqw52Z wiCFcQJqzDoalMHvySEdrfs3FPQc7lJ2lYjs+90XXDwfNnpei1Lwtm3Zt9zTvetp PZmZSgmvIV5WOJRSmgRMEGj46lPjJMO5h8RJAM6IVsre2ssjO/+pgcb8rYGq81LT 8cV8vbN7mk4QI6MWn5kvD+jO7fABqOLVTOZBEsWaRl1xSmfcCsg= =zem1 -----END PGP SIGNATURE----- **Source:** qsb-113-2026.txt.sig.simon ## What is the purpose of this announcement? The purpose of this announcement is to inform the Qubes community that a new Qubes security bulletin (QSB) has been published. ## What is a Qubes security bulletin (QSB)? A Qubes security bulletin (QSB) is a security announcement issued by the Qubes security team. A QSB typically provides a summary and impact analysis of one or more recently-discovered software vulnerabilities, including details about patching to address them. ## Why should I care about QSBs? QSBs tell you what actions you must take in order to protect yourself from recently-discovered security vulnerabilities. In most cases, security vulnerabilities are addressed by updating normally. However, in some cases, special user action is required. In all cases, the required actions are detailed in QSBs. ## What are the PGP signatures that accompany QSBs? A PGP signature is a cryptographic digital signature made in accordance with the OpenPGP standard. PGP signatures can be cryptographically verified with programs like GNU Privacy Guard (GPG). The Qubes security team cryptographically signs all QSBs so that Qubes users have a reliable way to check whether QSBs are genuine. The only way to be certain that a QSB is authentic is by verifying its PGP signatures. ## Why should I care whether a QSB is authentic? A forged QSB could deceive you into taking actions that adversely affect the security of your Qubes OS system, such as installing malware or making configuration changes that render your system vulnerable to attack. Falsified QSBs could sow fear, uncertainty, and doubt about the security of Qubes OS or the status of the Qubes OS Project. ## How do I verify the PGP signatures on a QSB? The following command-line instructions assume a Linux system with `git` and `gpg` installed. (For Windows and Mac options, see OpenPGP software.) 1. Obtain the Qubes Master Signing Key (QMSK), e.g.: $ gpg --fetch-keys https://keys.qubes-os.org/keys/qubes-master-signing-key.asc gpg: directory '/home/user/.gnupg' created gpg: keybox '/home/user/.gnupg/pubring.kbx' created gpg: requesting key from 'https://keys.qubes-os.org/keys/qubes-master-signing-key.asc' gpg: /home/user/.gnupg/trustdb.gpg: trustdb created gpg: key DDFA1A3E36879494: public key "Qubes Master Signing Key" imported gpg: Total number processed: 1 gpg: imported: 1 (For more ways to obtain the QMSK, see How to import and authenticate the Qubes Master Signing Key.) 2. View the fingerprint of the PGP key you just imported. (Note: `gpg>` indicates a prompt inside of the GnuPG program. Type what appears after it when prompted.) $ gpg --edit-key 0x427F11FD0FAA4B080123F01CDDFA1A3E36879494 gpg (GnuPG) 2.2.27; Copyright (C) 2021 Free Software Foundation, Inc. This is free software: you are free to change and redistribute it. There is NO WARRANTY, to the extent permitted by law. pub rsa4096/DDFA1A3E36879494 created: 2010-04-01 expires: never usage: SC trust: unknown validity: unknown [ unknown] (1). Qubes Master Signing Key gpg> fpr pub rsa4096/DDFA1A3E36879494 2010-04-01 Qubes Master Signing Key Primary key fingerprint: 427F 11FD 0FAA 4B08 0123 F01C DDFA 1A3E 3687 9494 3. **Important:** At this point, you still don’t know whether the key you just imported is the genuine QMSK or a forgery. In order for this entire procedure to provide meaningful security benefits, you _must_ authenticate the QMSK out-of-band. **Do not skip this step!** The standard method is to obtain the QMSK fingerprint from _multiple independent sources in several different ways_ and check to see whether they match the key you just imported. For more information, see How to import and authenticate the Qubes Master Signing Key. **Tip:** After you have authenticated the QMSK out-of-band to your satisfaction, record the QMSK fingerprint in a safe place (or several) so that you don’t have to repeat this step in the future. 4. Once you are satisfied that you have the genuine QMSK, set its trust level to 5 (“ultimate”), then quit GnuPG with `q`. gpg> trust pub rsa4096/DDFA1A3E36879494 created: 2010-04-01 expires: never usage: SC trust: unknown validity: unknown [ unknown] (1). Qubes Master Signing Key Please decide how far you trust this user to correctly verify other users' keys (by looking at passports, checking fingerprints from different sources, etc.) 1 = I don't know or won't say 2 = I do NOT trust 3 = I trust marginally 4 = I trust fully 5 = I trust ultimately m = back to the main menu Your decision? 5 Do you really want to set this key to ultimate trust? (y/N) y pub rsa4096/DDFA1A3E36879494 created: 2010-04-01 expires: never usage: SC trust: ultimate validity: unknown [ unknown] (1). Qubes Master Signing Key Please note that the shown key validity is not necessarily correct unless you restart the program. gpg> q 5. Use Git to clone the qubes-secpack repo. $ git clone https://github.com/QubesOS/qubes-secpack.git Cloning into 'qubes-secpack'... remote: Enumerating objects: 4065, done. remote: Counting objects: 100% (1474/1474), done. remote: Compressing objects: 100% (742/742), done. remote: Total 4065 (delta 743), reused 1413 (delta 731), pack-reused 2591 Receiving objects: 100% (4065/4065), 1.64 MiB | 2.53 MiB/s, done. Resolving deltas: 100% (1910/1910), done. 6. Import the included PGP keys. (See our PGP key policies for important information about these keys.) $ gpg --import qubes-secpack/keys/*/* gpg: key 063938BA42CFA724: public key "Marek Marczykowski-Górecki (Qubes OS signing key)" imported gpg: qubes-secpack/keys/core-devs/retired: read error: Is a directory gpg: no valid OpenPGP data found. gpg: key 8C05216CE09C093C: 1 signature not checked due to a missing key gpg: key 8C05216CE09C093C: public key "HW42 (Qubes Signing Key)" imported gpg: key DA0434BC706E1FCF: public key "Simon Gaiser (Qubes OS signing key)" imported gpg: key 8CE137352A019A17: 2 signatures not checked due to missing keys gpg: key 8CE137352A019A17: public key "Andrew David Wong (Qubes Documentation Signing Key)" imported gpg: key AAA743B42FBC07A9: public key "Brennan Novak (Qubes Website & Documentation Signing)" imported gpg: key B6A0BB95CA74A5C3: public key "Joanna Rutkowska (Qubes Documentation Signing Key)" imported gpg: key F32894BE9684938A: public key "Marek Marczykowski-Górecki (Qubes Documentation Signing Key)" imported gpg: key 6E7A27B909DAFB92: public key "Hakisho Nukama (Qubes Documentation Signing Key)" imported gpg: key 485C7504F27D0A72: 1 signature not checked due to a missing key gpg: key 485C7504F27D0A72: public key "Sven Semmler (Qubes Documentation Signing Key)" imported gpg: key BB52274595B71262: public key "unman (Qubes Documentation Signing Key)" imported gpg: key DC2F3678D272F2A8: 1 signature not checked due to a missing key gpg: key DC2F3678D272F2A8: public key "Wojtek Porczyk (Qubes OS documentation signing key)" imported gpg: key FD64F4F9E9720C4D: 1 signature not checked due to a missing key gpg: key FD64F4F9E9720C4D: public key "Zrubi (Qubes Documentation Signing Key)" imported gpg: key DDFA1A3E36879494: "Qubes Master Signing Key" not changed gpg: key 1848792F9E2795E9: public key "Qubes OS Release 4 Signing Key" imported gpg: qubes-secpack/keys/release-keys/retired: read error: Is a directory gpg: no valid OpenPGP data found. gpg: key D655A4F21830E06A: public key "Marek Marczykowski-Górecki (Qubes security pack)" imported gpg: key ACC2602F3F48CB21: public key "Qubes OS Security Team" imported gpg: qubes-secpack/keys/security-team/retired: read error: Is a directory gpg: no valid OpenPGP data found. gpg: key 4AC18DE1112E1490: public key "Simon Gaiser (Qubes Security Pack signing key)" imported gpg: Total number processed: 17 gpg: imported: 16 gpg: unchanged: 1 gpg: marginals needed: 3 completes needed: 1 trust model: pgp gpg: depth: 0 valid: 1 signed: 6 trust: 0-, 0q, 0n, 0m, 0f, 1u gpg: depth: 1 valid: 6 signed: 0 trust: 6-, 0q, 0n, 0m, 0f, 0u 7. Verify signed Git tags. $ cd qubes-secpack/ $ git tag -v `git describe` object 266e14a6fae57c9a91362c9ac784d3a891f4d351 type commit tag marmarek_sec_266e14a6 tagger Marek Marczykowski-Górecki 1677757924 +0100 Tag for commit 266e14a6fae57c9a91362c9ac784d3a891f4d351 gpg: Signature made Thu 02 Mar 2023 03:52:04 AM PST gpg: using RSA key 2D1771FE4D767EDC76B089FAD655A4F21830E06A gpg: Good signature from "Marek Marczykowski-Górecki (Qubes security pack)" [full] The exact output will differ, but the final line should always start with `gpg: Good signature from...` followed by an appropriate key. The `[full]` indicates full trust, which this key inherits in virtue of being validly signed by the QMSK. 8. Verify PGP signatures, e.g.: $ cd QSBs/ $ gpg --verify qsb-087-2022.txt.sig.marmarek qsb-087-2022.txt gpg: Signature made Wed 23 Nov 2022 04:05:51 AM PST gpg: using RSA key 2D1771FE4D767EDC76B089FAD655A4F21830E06A gpg: Good signature from "Marek Marczykowski-Górecki (Qubes security pack)" [full] $ gpg --verify qsb-087-2022.txt.sig.simon qsb-087-2022.txt gpg: Signature made Wed 23 Nov 2022 03:50:42 AM PST gpg: using RSA key EA18E7F040C41DDAEFE9AA0F4AC18DE1112E1490 gpg: Good signature from "Simon Gaiser (Qubes Security Pack signing key)" [full] $ cd ../canaries/ $ gpg --verify canary-034-2023.txt.sig.marmarek canary-034-2023.txt gpg: Signature made Thu 02 Mar 2023 03:51:48 AM PST gpg: using RSA key 2D1771FE4D767EDC76B089FAD655A4F21830E06A gpg: Good signature from "Marek Marczykowski-Górecki (Qubes security pack)" [full] $ gpg --verify canary-034-2023.txt.sig.simon canary-034-2023.txt gpg: Signature made Thu 02 Mar 2023 01:47:52 AM PST gpg: using RSA key EA18E7F040C41DDAEFE9AA0F4AC18DE1112E1490 gpg: Good signature from "Simon Gaiser (Qubes Security Pack signing key)" [full] Again, the exact output will differ, but the final line of output from each `gpg --verify` command should always start with `gpg: Good signature from...` followed by an appropriate key. For this announcement (QSB-113), the commands are: $ gpg --verify qsb-113-2026.txt.sig.marmarek qsb-113-2026.txt $ gpg --verify qsb-113-2026.txt.sig.simon qsb-113-2026.txt You can also verify the signatures directly from this announcement in addition to or instead of verifying the files from the qubes-secpack. Simply copy and paste the QSB-113 text into a plain text file and do the same for both signature files. Then, perform the same authentication steps as listed above, substituting the filenames above with the names of the files you just created.

Debian 12 (Bookworm) is currently scheduled to reach end-of-life (EOL) on 2026-06-10 (approximately one month from the date of this announcement). Please upgrade all of your Debian templates and standalones by that date. For more information, see Upgrading to avoid EOL. There are two ways to upgrade a template to a new Debian release: * **Recommended:** Install a fresh template to replace the existing one. This option is simpler for less experienced users, but it won’t preserve any modifications you’ve made to your template. After you install the new template, you’ll have to redo your desired template modifications (if any) and switch everything that was set to the old template to the new template. If you choose to modify your template, you may wish to write those modifications down so that you remember what to redo on each fresh install. To see a log of package manager actions, see `/var/log/dpkg.log` and `/var/log/apt/history.log` in the old Debian template. * **Advanced:** Perform an in-place upgrade of an existing Debian template. This option will preserve any modifications you’ve made to the template, but it may be more complicated for less experienced users. ## Note on Debian LTS Debian releases have two EOL dates: regular and long-term support (LTS). Qubes OS support for Debian templates ends at the regular EOL date, not the LTS EOL date.

The Xen Project has released one or more Xen security advisories (XSAs). The security of Qubes OS is **not** affected. ## XSAs that DO affect the security of Qubes OS The following XSAs **do affect** the security of Qubes OS: * (none) ## XSAs that DO NOT affect the security of Qubes OS The following XSAs **do not affect** the security of Qubes OS, and no user action is necessary: * XSA-483 * Qubes OS does not use oxenstored. * XSA-484 * Denial of service only * XSA-485 * In-VM attack only * XSA-486 * Grant table v2 is disabled in Qubes OS. * XSA-487 * In-VM attack only * XSA-489 * Qubes OS does not use XAPI. ## About this announcement Qubes OS uses the Xen hypervisor as part of its architecture. When the Xen Project publicly discloses a vulnerability in the Xen hypervisor, they issue a notice called a Xen security advisory (XSA). Vulnerabilities in the Xen hypervisor sometimes have security implications for Qubes OS. When they do, we issue a notice called a Qubes security bulletin (QSB). (QSBs are also issued for non-Xen vulnerabilities.) However, QSBs can provide only _positive_ confirmation that certain XSAs _do_ affect the security of Qubes OS. QSBs cannot provide _negative_ confirmation that other XSAs do _not_ affect the security of Qubes OS. Therefore, we also maintain an XSA tracker, which is a comprehensive list of all XSAs publicly disclosed to date, including whether each one affects the security of Qubes OS. When new XSAs are published, we add them to the XSA tracker and publish a notice like this one in order to inform Qubes users that a new batch of XSAs has been released and whether each one affects the security of Qubes OS.

Qubes OS 4.2 is scheduled to reach end-of-life (EOL) on 2026-06-21, approximately two months from the date of this announcement. ## Recommended actions If you’re currently using Qubes 4.2, you should upgrade to Qubes 4.3 no later than 2026-06-21. There are two ways to upgrade: * Perform a clean installation of Qubes 4.3. This involves backing up your current system, replacing your current installation with a fresh Qubes 4.3 installation, then restoring from your backup. Many users find this option to be simpler, easier, and less error-prone. However, if you’ve made extensive customizations in dom0, they may need to be redone. * Perform an in-place upgrade from Qubes 4.2 to Qubes 4.3. Instead of replacing your existing installation, this method involves installing a special command-line tool in dom0, then using it to upgrade your existing Qubes 4.2 installation to Qubes 4.3. This is a more complex multi-stage process, which makes it most suitable for advanced users. This method preserves your qubes and all the customizations you’ve made in dom0 that are compatible with the in-place upgrade process. While not strictly required, we still strongly recommend making a full backup before attempting an in-place upgrade. This way, if anything goes wrong, your data is still safe, and you always have the option of falling back to performing a clean installation. (If you’re already on Qubes 4.3, then you don’t have to do anything. This announcement doesn’t apply to you.) ## What does end-of-life (EOL) mean? When a Qubes OS release reaches end-of-life (EOL), it’s no longer supported. This means that bugs discovered in that release will no longer be fixed, and enhancements will no longer be added. Most importantly, releases that have reached EOL no longer receive security updates, which is why it’s critically important to upgrade to a supported release. ## What about patch releases? The Qubes OS Project uses the semantic versioning standard. Version numbers are written as `[major].[minor].[patch]`. When a major or minor release reaches EOL, all of its patch releases also reach EOL. For example, when we say that “Qubes 4.2” (without specifying a `[patch]` number) is approaching EOL, we’re specifying a particular minor release, inclusive of all patch releases within it. This means that Qubes 4.2.0, 4.2.1, 4.2.2, 4.2.3, and 4.2.4 will all reach EOL at the same time (on 2026-06-21), since they’re all patch releases of the same minor release. ## How are EOL dates determined? According to our support policy, stable Qubes OS releases are supported for six months after each subsequent major or minor release. This means that Qubes 4.2 reaches EOL six months after Qubes 4.3 was released. Since Qubes 4.3.0 was released on 2025-12-21, Qubes 4.2’s EOL date is six months later, which is 2026-06-21.

We have published Qubes Security Bulletin (QSB) 112: Floating Point Divider State Sampling (XSA-488). The text of this QSB and its accompanying cryptographic signatures are reproduced below, followed by a general explanation of this announcement and authentication instructions. ## Qubes Security Bulletin 112 ---===[ Qubes Security Bulletin 112 ]===--- 2026-04-18 Floating Point Divider State Sampling (XSA-488) User action ------------ Continue to update normally [1] in order to receive the security updates described in the "Patching" section below. No other user action is required in response to this QSB. Summary -------- On 2026-04-17, the Xen Project published XSA-488, "x86: Floating Point Divider State Sampling" (CVE-2025-54505) [3]: | Researchers from the CISPA Helmholtz Center for Information Security | have discovered Floating Point Divider State Sampling. It is detailed | in a paper titled "TREVEX: A Black-Box Detection Framework For | Data-Flow Transient Execution Vulnerabilities" | | For more information, see: | https://www.amd.com/en/resources/product-security/bulletin/amd-sb-7053.html | https://roots.ec/blog/fpdss/ Impact ------- An attacker might be able to infer data belonging to other contexts, including data belonging to other qubes. Affected systems ----------------- Only AMD CPUs with the Zen or Zen+ microarchitecture (Family 17h) are believed to be affected. Other AMD CPUs (including later Zen generations) and CPUs from other manufacturers are not believed to be affected. Patching --------- The following packages contain security updates that address the vulnerabilities described in this bulletin: For Qubes 4.2, in dom0: - Xen packages, version 4.17.6-4 For Qubes 4.3, in dom0: - Xen packages, version 4.19.4-7 These packages will migrate from the security-testing repository to the current (stable) repository over the next two weeks after being tested by the community. [2] Once available, the packages should be installed via the Qubes Update tool or its command-line equivalents. [1] Dom0 must be restarted afterward in order for the updates to take effect. If you use Anti Evil Maid, you will need to reseal your secret passphrase to new PCR values, as PCR18+19 will change due to the new Xen binaries. Credits -------- See the original Xen Security Advisory and linked publications. References ----------- [1] https://doc.qubes-os.org/en/latest/user/how-to-guides/how-to-update.html [2] https://doc.qubes-os.org/en/latest/user/downloading-installing-upgrading/testing.html [3] https://xenbits.xen.org/xsa/advisory-488.html -- The Qubes Security Team https://www.qubes-os.org/security/ **Source:** qsb-112-2026.txt ## Marek Marczykowski-Górecki’s PGP signature -----BEGIN PGP SIGNATURE----- iQIzBAABCAAdFiEELRdx/k12ftx2sIn61lWk8hgw4GoFAmnjWdQACgkQ1lWk8hgw 4GpFRA/7Bl1DIRzKJ7O8Y0VC3HLM6q5rCa6tk9hyjkjNLFH8MB6LqTsYl71ma2iS HtWp+xJbg77Jrdf8X4PdFP4vH/38VT9MxAjFnF13HIi7IxEc2bCHpAPQYSDmT0+1 1d5z5A8yX5A32ZswIFEDjIfG9KdobrKq9c8ZGBMonpbylH2keNJobqkJ2DYzSjZI BLai5S5U2PO884hxa3t52R5dAO0nojypx9hI8BfV/UGk4htBgBbdL/k0TNOymOfZ 3j9lV3khBMAoNLRZnRViEqmDE1i7FldK+WAEmNzPP1Y2YdU9S6MyLd6rvdGA6VLg NCXwzyiUKdSvGvYiVpnB1JXZP3sGtoulr0xwodwQbR1rLlYS6uW+CRZKk6FSrM8t juVsa+fTWqxSfGU55Mvm2LKdFl1MKChD+Ln9QeYaw14kvqYIv3nOBiLcL+UGBYbb 3SaieSqqSe7nvmWWeA/dReObtHUGyLT1ZOTxObpQRFX2cdOQyZTj+wzROtGV31jn jvJqZ/GBGTaMTOJrNv+7nNzJbICiLHmLwR+/FZbRxt4rs5+ek1Ovt4k0qGIN2jti GXSAvU0lkWIqEtuxHDjD/f7hYJI/DQ6OCDq5HO5lHfl25RIGP0TdbWam4fLyj0NG rmID8bDIJ6WT/20VqTXN5pyiL7vo3QGqmh9iWyoJXeKjezFktAc= =sq1L -----END PGP SIGNATURE----- **Source:** qsb-112-2026.txt.sig.marmarek ## Simon Gaiser (aka HW42)’s PGP signature -----BEGIN PGP SIGNATURE----- iQIzBAABCgAdFiEE6hjn8EDEHdrv6aoPSsGN4REuFJAFAmnj92wACgkQSsGN4REu FJA1lA//VBqhmIeONyVFhyNej/2sI1MUTbELKA9f+9zKQaw/tgeM5y7SbbazgYdc zWVRObsENtLSrBG0vIPwVat93B76lDeoJZAWxfW9MQ2lBx3/QKPArU+8abOfzel4 eRQOchaH3hPVszIK8jtLMX9YyUSF3BWedBnIOp2wnmvNgR/Aczv73XcgVWAgF6RG 81T5S6ailrgZgWDq4xnd0699UdUSSAgxSYvMxeM8suqDWDb+viiF2kCoSyXJ4K7P mHKh3VR7VGEj9kUHB7DsbOd1jspioWV/Y/FAEISTB6BLjQMWSPAZlQSmKCql4PMl YB3o8yaE6XbvjBmixMwUivhDq2QzewzqxZdDKqJxZ+wDh8hGBYu8dyN+SOMCG251 SnMSsx0MOWqOh3I4ng0GLAhE3kPzgehsaZYTXFcaxTMRMSnnWuGaNlpkjUmOFQup D2VcQbCyLBsaM/32ZxbZ86SBcZEgF0uPJO0Qc/11mW+nydPYHVnjHBon31eMlFLo 7MdinyUlAztrv8OL0kw9ip1ytiw17k9N0ynU7cWZPWHkmhLyz4McxjGQ1PD9wOes ApxUn8DjvSXXcHdkPt2xMI/fOH575t2WaTV+Tyud32hdHFYX0sQ40dvz1khL1RJT s65YivSaBv61M8NMU0mnZHDMH27lTKL/LIa8EPmi8WtD2dqTwM8= =6b1c -----END PGP SIGNATURE----- **Source:** qsb-112-2026.txt.sig.simon ## What is the purpose of this announcement? The purpose of this announcement is to inform the Qubes community that a new Qubes security bulletin (QSB) has been published. ## What is a Qubes security bulletin (QSB)? A Qubes security bulletin (QSB) is a security announcement issued by the Qubes security team. A QSB typically provides a summary and impact analysis of one or more recently-discovered software vulnerabilities, including details about patching to address them. ## Why should I care about QSBs? QSBs tell you what actions you must take in order to protect yourself from recently-discovered security vulnerabilities. In most cases, security vulnerabilities are addressed by updating normally. However, in some cases, special user action is required. In all cases, the required actions are detailed in QSBs. ## What are the PGP signatures that accompany QSBs? A PGP signature is a cryptographic digital signature made in accordance with the OpenPGP standard. PGP signatures can be cryptographically verified with programs like GNU Privacy Guard (GPG). The Qubes security team cryptographically signs all QSBs so that Qubes users have a reliable way to check whether QSBs are genuine. The only way to be certain that a QSB is authentic is by verifying its PGP signatures. ## Why should I care whether a QSB is authentic? A forged QSB could deceive you into taking actions that adversely affect the security of your Qubes OS system, such as installing malware or making configuration changes that render your system vulnerable to attack. Falsified QSBs could sow fear, uncertainty, and doubt about the security of Qubes OS or the status of the Qubes OS Project. ## How do I verify the PGP signatures on a QSB? The following command-line instructions assume a Linux system with `git` and `gpg` installed. (For Windows and Mac options, see OpenPGP software.) 1. Obtain the Qubes Master Signing Key (QMSK), e.g.: $ gpg --fetch-keys https://keys.qubes-os.org/keys/qubes-master-signing-key.asc gpg: directory '/home/user/.gnupg' created gpg: keybox '/home/user/.gnupg/pubring.kbx' created gpg: requesting key from 'https://keys.qubes-os.org/keys/qubes-master-signing-key.asc' gpg: /home/user/.gnupg/trustdb.gpg: trustdb created gpg: key DDFA1A3E36879494: public key "Qubes Master Signing Key" imported gpg: Total number processed: 1 gpg: imported: 1 (For more ways to obtain the QMSK, see How to import and authenticate the Qubes Master Signing Key.) 2. View the fingerprint of the PGP key you just imported. (Note: `gpg>` indicates a prompt inside of the GnuPG program. Type what appears after it when prompted.) $ gpg --edit-key 0x427F11FD0FAA4B080123F01CDDFA1A3E36879494 gpg (GnuPG) 2.2.27; Copyright (C) 2021 Free Software Foundation, Inc. This is free software: you are free to change and redistribute it. There is NO WARRANTY, to the extent permitted by law. pub rsa4096/DDFA1A3E36879494 created: 2010-04-01 expires: never usage: SC trust: unknown validity: unknown [ unknown] (1). Qubes Master Signing Key gpg> fpr pub rsa4096/DDFA1A3E36879494 2010-04-01 Qubes Master Signing Key Primary key fingerprint: 427F 11FD 0FAA 4B08 0123 F01C DDFA 1A3E 3687 9494 3. **Important:** At this point, you still don’t know whether the key you just imported is the genuine QMSK or a forgery. In order for this entire procedure to provide meaningful security benefits, you _must_ authenticate the QMSK out-of-band. **Do not skip this step!** The standard method is to obtain the QMSK fingerprint from _multiple independent sources in several different ways_ and check to see whether they match the key you just imported. For more information, see How to import and authenticate the Qubes Master Signing Key. **Tip:** After you have authenticated the QMSK out-of-band to your satisfaction, record the QMSK fingerprint in a safe place (or several) so that you don’t have to repeat this step in the future. 4. Once you are satisfied that you have the genuine QMSK, set its trust level to 5 (“ultimate”), then quit GnuPG with `q`. gpg> trust pub rsa4096/DDFA1A3E36879494 created: 2010-04-01 expires: never usage: SC trust: unknown validity: unknown [ unknown] (1). Qubes Master Signing Key Please decide how far you trust this user to correctly verify other users' keys (by looking at passports, checking fingerprints from different sources, etc.) 1 = I don't know or won't say 2 = I do NOT trust 3 = I trust marginally 4 = I trust fully 5 = I trust ultimately m = back to the main menu Your decision? 5 Do you really want to set this key to ultimate trust? (y/N) y pub rsa4096/DDFA1A3E36879494 created: 2010-04-01 expires: never usage: SC trust: ultimate validity: unknown [ unknown] (1). Qubes Master Signing Key Please note that the shown key validity is not necessarily correct unless you restart the program. gpg> q 5. Use Git to clone the qubes-secpack repo. $ git clone https://github.com/QubesOS/qubes-secpack.git Cloning into 'qubes-secpack'... remote: Enumerating objects: 4065, done. remote: Counting objects: 100% (1474/1474), done. remote: Compressing objects: 100% (742/742), done. remote: Total 4065 (delta 743), reused 1413 (delta 731), pack-reused 2591 Receiving objects: 100% (4065/4065), 1.64 MiB | 2.53 MiB/s, done. Resolving deltas: 100% (1910/1910), done. 6. Import the included PGP keys. (See our PGP key policies for important information about these keys.) $ gpg --import qubes-secpack/keys/*/* gpg: key 063938BA42CFA724: public key "Marek Marczykowski-Górecki (Qubes OS signing key)" imported gpg: qubes-secpack/keys/core-devs/retired: read error: Is a directory gpg: no valid OpenPGP data found. gpg: key 8C05216CE09C093C: 1 signature not checked due to a missing key gpg: key 8C05216CE09C093C: public key "HW42 (Qubes Signing Key)" imported gpg: key DA0434BC706E1FCF: public key "Simon Gaiser (Qubes OS signing key)" imported gpg: key 8CE137352A019A17: 2 signatures not checked due to missing keys gpg: key 8CE137352A019A17: public key "Andrew David Wong (Qubes Documentation Signing Key)" imported gpg: key AAA743B42FBC07A9: public key "Brennan Novak (Qubes Website & Documentation Signing)" imported gpg: key B6A0BB95CA74A5C3: public key "Joanna Rutkowska (Qubes Documentation Signing Key)" imported gpg: key F32894BE9684938A: public key "Marek Marczykowski-Górecki (Qubes Documentation Signing Key)" imported gpg: key 6E7A27B909DAFB92: public key "Hakisho Nukama (Qubes Documentation Signing Key)" imported gpg: key 485C7504F27D0A72: 1 signature not checked due to a missing key gpg: key 485C7504F27D0A72: public key "Sven Semmler (Qubes Documentation Signing Key)" imported gpg: key BB52274595B71262: public key "unman (Qubes Documentation Signing Key)" imported gpg: key DC2F3678D272F2A8: 1 signature not checked due to a missing key gpg: key DC2F3678D272F2A8: public key "Wojtek Porczyk (Qubes OS documentation signing key)" imported gpg: key FD64F4F9E9720C4D: 1 signature not checked due to a missing key gpg: key FD64F4F9E9720C4D: public key "Zrubi (Qubes Documentation Signing Key)" imported gpg: key DDFA1A3E36879494: "Qubes Master Signing Key" not changed gpg: key 1848792F9E2795E9: public key "Qubes OS Release 4 Signing Key" imported gpg: qubes-secpack/keys/release-keys/retired: read error: Is a directory gpg: no valid OpenPGP data found. gpg: key D655A4F21830E06A: public key "Marek Marczykowski-Górecki (Qubes security pack)" imported gpg: key ACC2602F3F48CB21: public key "Qubes OS Security Team" imported gpg: qubes-secpack/keys/security-team/retired: read error: Is a directory gpg: no valid OpenPGP data found. gpg: key 4AC18DE1112E1490: public key "Simon Gaiser (Qubes Security Pack signing key)" imported gpg: Total number processed: 17 gpg: imported: 16 gpg: unchanged: 1 gpg: marginals needed: 3 completes needed: 1 trust model: pgp gpg: depth: 0 valid: 1 signed: 6 trust: 0-, 0q, 0n, 0m, 0f, 1u gpg: depth: 1 valid: 6 signed: 0 trust: 6-, 0q, 0n, 0m, 0f, 0u 7. Verify signed Git tags. $ cd qubes-secpack/ $ git tag -v `git describe` object 266e14a6fae57c9a91362c9ac784d3a891f4d351 type commit tag marmarek_sec_266e14a6 tagger Marek Marczykowski-Górecki 1677757924 +0100 Tag for commit 266e14a6fae57c9a91362c9ac784d3a891f4d351 gpg: Signature made Thu 02 Mar 2023 03:52:04 AM PST gpg: using RSA key 2D1771FE4D767EDC76B089FAD655A4F21830E06A gpg: Good signature from "Marek Marczykowski-Górecki (Qubes security pack)" [full] The exact output will differ, but the final line should always start with `gpg: Good signature from...` followed by an appropriate key. The `[full]` indicates full trust, which this key inherits in virtue of being validly signed by the QMSK. 8. Verify PGP signatures, e.g.: $ cd QSBs/ $ gpg --verify qsb-087-2022.txt.sig.marmarek qsb-087-2022.txt gpg: Signature made Wed 23 Nov 2022 04:05:51 AM PST gpg: using RSA key 2D1771FE4D767EDC76B089FAD655A4F21830E06A gpg: Good signature from "Marek Marczykowski-Górecki (Qubes security pack)" [full] $ gpg --verify qsb-087-2022.txt.sig.simon qsb-087-2022.txt gpg: Signature made Wed 23 Nov 2022 03:50:42 AM PST gpg: using RSA key EA18E7F040C41DDAEFE9AA0F4AC18DE1112E1490 gpg: Good signature from "Simon Gaiser (Qubes Security Pack signing key)" [full] $ cd ../canaries/ $ gpg --verify canary-034-2023.txt.sig.marmarek canary-034-2023.txt gpg: Signature made Thu 02 Mar 2023 03:51:48 AM PST gpg: using RSA key 2D1771FE4D767EDC76B089FAD655A4F21830E06A gpg: Good signature from "Marek Marczykowski-Górecki (Qubes security pack)" [full] $ gpg --verify canary-034-2023.txt.sig.simon canary-034-2023.txt gpg: Signature made Thu 02 Mar 2023 01:47:52 AM PST gpg: using RSA key EA18E7F040C41DDAEFE9AA0F4AC18DE1112E1490 gpg: Good signature from "Simon Gaiser (Qubes Security Pack signing key)" [full] Again, the exact output will differ, but the final line of output from each `gpg --verify` command should always start with `gpg: Good signature from...` followed by an appropriate key. For this announcement (QSB-112), the commands are: $ gpg --verify qsb-112-2026.txt.sig.marmarek qsb-112-2026.txt $ gpg --verify qsb-112-2026.txt.sig.simon qsb-112-2026.txt You can also verify the signatures directly from this announcement in addition to or instead of verifying the files from the qubes-secpack. Simply copy and paste the QSB-112 text into a plain text file and do the same for both signature files. Then, perform the same authentication steps as listed above, substituting the filenames above with the names of the files you just created.

We have published Qubes Security Bulletin (QSB) 111: xfce4-screensaver login bypass. The text of this QSB and its accompanying cryptographic signatures are reproduced below, followed by a general explanation of this announcement and authentication instructions. ## Qubes Security Bulletin 111 ---===[ Qubes Security Bulletin 111 ]===--- 2026-04-14 xfce4-screensaver login bypass User action ------------ Continue to update normally [1] in order to receive the security updates described in the "Patching" section below. No other user action is required in response to this QSB. Summary -------- When connecting or disconnecting a display or, in some cases, when simply activating the xfce4-screensaver login prompt on a locked screen, there is a very short window of time during which keyboard input is not intercepted by xfce4-screensaver and is instead sent to the application that was active before locking. The issue has been fixed upstream in [2]. Impact ------- The time window is normally too short for any real harm to occur when physically typing on a keyboard. However, if an attacker is able to generate input events in an automated way, the attacker can attempt to deactivate the screensaver by sending a command quickly enough. Affected systems ----------------- The default Qubes OS 4.3 configuration, which uses xfce4-screensaver and the Xfce desktop environment, is affected. Other Qubes OS releases and other screensavers are not affected. Systems that permit an attacker physical access to a keyboard interface are affected. Most systems permit such access in some way, since the user's legitimate keyboard must connect to the system through such an interface, but the degree of difficulty for the attacker varies significantly depending on the nature of the interface. - The easiest method for an attacker is unrestricted USB keyboard input without a confirmation prompt, but this is disabled in Qubes OS by default. However, users can override this default configuration to allow unrestricted USB keyboard input, and many users do so because they have no other way to connect a legitimate keyboard to their systems. If the user has allowed unrestricted USB keyboard input, then an attacker can easily and quickly generate keyboard input events by connecting a USB device that emulates a keyboard. - An attacker could also use a non-USB keyboard input interface, such as a PS/2 port. However, such interfaces are less common nowadays. Nonetheless, if the system has such an interface, and if the attacker has physical access to it, then the system is affected, even if USB keyboard input is restricted. - Even when there is no keyboard input interface exposed on the outside of the machine as a convenient port, as in the case of a laptop with disabled USB keyboard input and no PS/2 port, it may still be possible for the attacker to physically modify the machine in order to gain access to such an interface. For example, built-in laptop keyboards must still be internally connected to the laptop's motherboard through such an interface in order to function properly. An attacker who can gain access to the internal components of the machine could disconnect the legitimate keyboard and attach their own malicious device to the same interface. However, this form of attack is significantly more complex than the foregoing attack vectors and requires extensive physical access, making it much more difficult to execute successfully. Discussion ----------- In general, we consider most attacks that require physical access to the system to fall outside the scope of the Qubes security model. Aside from the general challenges of protecting against physical attacks, this is primarily because physical protections depend heavily on the hardware and firmware details of the system. Since Qubes OS is designed to run on any x86 system that meets its system requirements [3], these hardware and firmware details can vary significantly between systems and are typically outside of Qubes' control. Nonetheless, we consider this screensaver login bypass vulnerability to fall within the scope of the Qubes security model, since Qubes OS does have control over keyboard input interception on the lock screen. Patching --------- The following packages contain security updates that address the vulnerabilities described in this bulletin: For Qubes 4.3, in dom0 (no GUI domain): - xfce4-screensaver 4.18.4-5 For systems with a GUI domain, a similar update will be provided by the distribution of the template on which the GUI domain is based (e.g., Fedora or Debian). These packages will migrate from the security-testing repository to the current (stable) repository over the next two weeks after being tested by the community. [4] Once available, the packages should be installed via the Qubes Update tool or its command-line equivalents. [1] Dom0's user session must be restarted afterward in order for the updates to take effect. This can be accomplished by logging out of Xfce4, then logging back in again, or by simply restarting the system. Credits -------- The issue was reported by Murat Altindis and Maria Kessler of AWARE7 GmbH. Qubes issue #10720 [5] is likely a report of the same problem. This issue was incorrectly identified as a duplicate of another issue that sounds similar but that is not relevant to the security of Qubes OS. References ----------- [1] https://doc.qubes-os.org/en/latest/user/how-to-guides/how-to-update.html [2] https://gitlab.xfce.org/apps/xfce4-screensaver/-/commit/4436087c6af5e915a2438d7c1dd0fdc282f547f8 [3] https://doc.qubes-os.org/en/latest/user/hardware/system-requirements.html [4] https://doc.qubes-os.org/en/latest/user/downloading-installing-upgrading/testing.html [5] https://github.com/QubesOS/qubes-issues/issues/10720 -- The Qubes Security Team https://www.qubes-os.org/security/ **Source:** qsb-111-2026.txt ## Marek Marczykowski-Górecki’s PGP signature -----BEGIN PGP SIGNATURE----- iQIzBAABCAAdFiEELRdx/k12ftx2sIn61lWk8hgw4GoFAmndgcIACgkQ1lWk8hgw 4GpjTA//Uu9j7FMKVj014K5ORjHWgIv5PAVmvl6LaMQpxctGtFoBH9/PXGppv/E8 tsSv9+hFH14a0AH+yj63wflYuWc5rnMA1Z93D/29T8QKpY6ygijr1i5+L19Rb+6Q lW2H8LefiZgdYANjImilUzBD9Pc8BjvDUXJ+jqO0ETeyiBvFLX65MgFw2GREo+yB yGBkCOBKdCiuOdnxhWUCwCM4Cdrs4eIjfO/97aOqE3KbqzHLRM2LuBsFKq3N5kBW NJnH3TLQZVvfHA96JNbY0WFbnSO09J4cs1b61kLK/wIUSM/JoqkQ94ieNNOGvJKa 0TQ0WyIwfjX4mIrVzZ6jbWZPbFDJfjvlNwnwicl4UuQtB3ChzPfWJ5zK/ama9ixW MNWwD6hfyj60XoR2DIL42j5lZvEOUDcn84T7jy8bS6/bbNsa1dYgYyToaUIOqiiM 0QrDWqVu9eL4v+zA8IvNTqnayPF6xb4t4j9bB26QlNcoKRbcysnYlRPAWB2aYr1X iV0bE/I3KJqXAyR+rvf1zPerkAodExV0o0C08NYSbgR2lN8cyoDrMBx5meHyQ6wa seAdM7cWy0JSos4J+sdY83nRKojB0uMcpbKAankstxJ2L8Th6MQnmULWYGBT+msG HJjFWcSIzS+P3uYvg1FlBVeIcR/oQexDDM78q/wsqqPzbyokxmo= =AWM/ -----END PGP SIGNATURE----- **Source:** qsb-111-2026.txt.sig.marmarek ## Simon Gaiser (aka HW42)’s PGP signature -----BEGIN PGP SIGNATURE----- iQIzBAABCgAdFiEE6hjn8EDEHdrv6aoPSsGN4REuFJAFAmndisoACgkQSsGN4REu FJAAXA/9F7StrFFMXOxW/ApJQX/MxthsaK94s/iI43dLSK60xs4KFUsCFUibYamc lcYT/m1GdOdG+4JYKW5M9CbkaZix9f1w8IuwGBpJ6qN857IfAINStyv+bX0HEb8s dFgR0bMIHkJiCIZWgFGSxyLKAR5GVUHS/JIJIe8OEawiAKc1NA+Z6TTRPIo0y4yX QB1UC6vgFNVq1jRRiEo+m+vi3fLsXyWEbPGpG5KlJQZ+0T7mY/XYaumkJQtgobwb mBt3mBrEGgc2532uw6LYO6YpsxITKiLPejY/gen41K+W9b3WxPzTJrao+NGohnZk hFM+mTvCYnfcL2fVRt9OBJijn0YU0aVAaS+Ri6BzCGo6ZUop8I2Z0TpBR7axEaWi wJrZWR6sz15094x4XbnrnaJtcXylEswMmhSOTnpWy5jUW4DhyUNyGSCgF3GiGzN7 Vpb6KdDybaxDCTUwexd890Y3hNFbm1pGlYfUzq1H4OEVHsUy4NATFad1QjzEmirn 7bLJE17/Kgqva5MqyTH6jUAabE88oo1W93dG+lKLJ4uwicQMJjM3V9U/SIqNbhy0 wLLyx8cF+UCnGkZKZVGmEbG0dV6U+D0T28ExQs2aOEHpOURN1Uui6v7XyXG0aUyK AlIyeZxkyCyQPL5pMAKhhNZhPnWNIuqlkraOj5GCdd7xjbvrFfk= =jkhv -----END PGP SIGNATURE----- **Source:** qsb-111-2026.txt.sig.simon ## What is the purpose of this announcement? The purpose of this announcement is to inform the Qubes community that a new Qubes security bulletin (QSB) has been published. ## What is a Qubes security bulletin (QSB)? A Qubes security bulletin (QSB) is a security announcement issued by the Qubes security team. A QSB typically provides a summary and impact analysis of one or more recently-discovered software vulnerabilities, including details about patching to address them. ## Why should I care about QSBs? QSBs tell you what actions you must take in order to protect yourself from recently-discovered security vulnerabilities. In most cases, security vulnerabilities are addressed by updating normally. However, in some cases, special user action is required. In all cases, the required actions are detailed in QSBs. ## What are the PGP signatures that accompany QSBs? A PGP signature is a cryptographic digital signature made in accordance with the OpenPGP standard. PGP signatures can be cryptographically verified with programs like GNU Privacy Guard (GPG). The Qubes security team cryptographically signs all QSBs so that Qubes users have a reliable way to check whether QSBs are genuine. The only way to be certain that a QSB is authentic is by verifying its PGP signatures. ## Why should I care whether a QSB is authentic? A forged QSB could deceive you into taking actions that adversely affect the security of your Qubes OS system, such as installing malware or making configuration changes that render your system vulnerable to attack. Falsified QSBs could sow fear, uncertainty, and doubt about the security of Qubes OS or the status of the Qubes OS Project. ## How do I verify the PGP signatures on a QSB? The following command-line instructions assume a Linux system with `git` and `gpg` installed. (For Windows and Mac options, see OpenPGP software.) 1. Obtain the Qubes Master Signing Key (QMSK), e.g.: $ gpg --fetch-keys https://keys.qubes-os.org/keys/qubes-master-signing-key.asc gpg: directory '/home/user/.gnupg' created gpg: keybox '/home/user/.gnupg/pubring.kbx' created gpg: requesting key from 'https://keys.qubes-os.org/keys/qubes-master-signing-key.asc' gpg: /home/user/.gnupg/trustdb.gpg: trustdb created gpg: key DDFA1A3E36879494: public key "Qubes Master Signing Key" imported gpg: Total number processed: 1 gpg: imported: 1 (For more ways to obtain the QMSK, see How to import and authenticate the Qubes Master Signing Key.) 2. View the fingerprint of the PGP key you just imported. (Note: `gpg>` indicates a prompt inside of the GnuPG program. Type what appears after it when prompted.) $ gpg --edit-key 0x427F11FD0FAA4B080123F01CDDFA1A3E36879494 gpg (GnuPG) 2.2.27; Copyright (C) 2021 Free Software Foundation, Inc. This is free software: you are free to change and redistribute it. There is NO WARRANTY, to the extent permitted by law. pub rsa4096/DDFA1A3E36879494 created: 2010-04-01 expires: never usage: SC trust: unknown validity: unknown [ unknown] (1). Qubes Master Signing Key gpg> fpr pub rsa4096/DDFA1A3E36879494 2010-04-01 Qubes Master Signing Key Primary key fingerprint: 427F 11FD 0FAA 4B08 0123 F01C DDFA 1A3E 3687 9494 3. **Important:** At this point, you still don’t know whether the key you just imported is the genuine QMSK or a forgery. In order for this entire procedure to provide meaningful security benefits, you _must_ authenticate the QMSK out-of-band. **Do not skip this step!** The standard method is to obtain the QMSK fingerprint from _multiple independent sources in several different ways_ and check to see whether they match the key you just imported. For more information, see How to import and authenticate the Qubes Master Signing Key. **Tip:** After you have authenticated the QMSK out-of-band to your satisfaction, record the QMSK fingerprint in a safe place (or several) so that you don’t have to repeat this step in the future. 4. Once you are satisfied that you have the genuine QMSK, set its trust level to 5 (“ultimate”), then quit GnuPG with `q`. gpg> trust pub rsa4096/DDFA1A3E36879494 created: 2010-04-01 expires: never usage: SC trust: unknown validity: unknown [ unknown] (1). Qubes Master Signing Key Please decide how far you trust this user to correctly verify other users' keys (by looking at passports, checking fingerprints from different sources, etc.) 1 = I don't know or won't say 2 = I do NOT trust 3 = I trust marginally 4 = I trust fully 5 = I trust ultimately m = back to the main menu Your decision? 5 Do you really want to set this key to ultimate trust? (y/N) y pub rsa4096/DDFA1A3E36879494 created: 2010-04-01 expires: never usage: SC trust: ultimate validity: unknown [ unknown] (1). Qubes Master Signing Key Please note that the shown key validity is not necessarily correct unless you restart the program. gpg> q 5. Use Git to clone the qubes-secpack repo. $ git clone https://github.com/QubesOS/qubes-secpack.git Cloning into 'qubes-secpack'... remote: Enumerating objects: 4065, done. remote: Counting objects: 100% (1474/1474), done. remote: Compressing objects: 100% (742/742), done. remote: Total 4065 (delta 743), reused 1413 (delta 731), pack-reused 2591 Receiving objects: 100% (4065/4065), 1.64 MiB | 2.53 MiB/s, done. Resolving deltas: 100% (1910/1910), done. 6. Import the included PGP keys. (See our PGP key policies for important information about these keys.) $ gpg --import qubes-secpack/keys/*/* gpg: key 063938BA42CFA724: public key "Marek Marczykowski-Górecki (Qubes OS signing key)" imported gpg: qubes-secpack/keys/core-devs/retired: read error: Is a directory gpg: no valid OpenPGP data found. gpg: key 8C05216CE09C093C: 1 signature not checked due to a missing key gpg: key 8C05216CE09C093C: public key "HW42 (Qubes Signing Key)" imported gpg: key DA0434BC706E1FCF: public key "Simon Gaiser (Qubes OS signing key)" imported gpg: key 8CE137352A019A17: 2 signatures not checked due to missing keys gpg: key 8CE137352A019A17: public key "Andrew David Wong (Qubes Documentation Signing Key)" imported gpg: key AAA743B42FBC07A9: public key "Brennan Novak (Qubes Website & Documentation Signing)" imported gpg: key B6A0BB95CA74A5C3: public key "Joanna Rutkowska (Qubes Documentation Signing Key)" imported gpg: key F32894BE9684938A: public key "Marek Marczykowski-Górecki (Qubes Documentation Signing Key)" imported gpg: key 6E7A27B909DAFB92: public key "Hakisho Nukama (Qubes Documentation Signing Key)" imported gpg: key 485C7504F27D0A72: 1 signature not checked due to a missing key gpg: key 485C7504F27D0A72: public key "Sven Semmler (Qubes Documentation Signing Key)" imported gpg: key BB52274595B71262: public key "unman (Qubes Documentation Signing Key)" imported gpg: key DC2F3678D272F2A8: 1 signature not checked due to a missing key gpg: key DC2F3678D272F2A8: public key "Wojtek Porczyk (Qubes OS documentation signing key)" imported gpg: key FD64F4F9E9720C4D: 1 signature not checked due to a missing key gpg: key FD64F4F9E9720C4D: public key "Zrubi (Qubes Documentation Signing Key)" imported gpg: key DDFA1A3E36879494: "Qubes Master Signing Key" not changed gpg: key 1848792F9E2795E9: public key "Qubes OS Release 4 Signing Key" imported gpg: qubes-secpack/keys/release-keys/retired: read error: Is a directory gpg: no valid OpenPGP data found. gpg: key D655A4F21830E06A: public key "Marek Marczykowski-Górecki (Qubes security pack)" imported gpg: key ACC2602F3F48CB21: public key "Qubes OS Security Team" imported gpg: qubes-secpack/keys/security-team/retired: read error: Is a directory gpg: no valid OpenPGP data found. gpg: key 4AC18DE1112E1490: public key "Simon Gaiser (Qubes Security Pack signing key)" imported gpg: Total number processed: 17 gpg: imported: 16 gpg: unchanged: 1 gpg: marginals needed: 3 completes needed: 1 trust model: pgp gpg: depth: 0 valid: 1 signed: 6 trust: 0-, 0q, 0n, 0m, 0f, 1u gpg: depth: 1 valid: 6 signed: 0 trust: 6-, 0q, 0n, 0m, 0f, 0u 7. Verify signed Git tags. $ cd qubes-secpack/ $ git tag -v `git describe` object 266e14a6fae57c9a91362c9ac784d3a891f4d351 type commit tag marmarek_sec_266e14a6 tagger Marek Marczykowski-Górecki 1677757924 +0100 Tag for commit 266e14a6fae57c9a91362c9ac784d3a891f4d351 gpg: Signature made Thu 02 Mar 2023 03:52:04 AM PST gpg: using RSA key 2D1771FE4D767EDC76B089FAD655A4F21830E06A gpg: Good signature from "Marek Marczykowski-Górecki (Qubes security pack)" [full] The exact output will differ, but the final line should always start with `gpg: Good signature from...` followed by an appropriate key. The `[full]` indicates full trust, which this key inherits in virtue of being validly signed by the QMSK. 8. Verify PGP signatures, e.g.: $ cd QSBs/ $ gpg --verify qsb-087-2022.txt.sig.marmarek qsb-087-2022.txt gpg: Signature made Wed 23 Nov 2022 04:05:51 AM PST gpg: using RSA key 2D1771FE4D767EDC76B089FAD655A4F21830E06A gpg: Good signature from "Marek Marczykowski-Górecki (Qubes security pack)" [full] $ gpg --verify qsb-087-2022.txt.sig.simon qsb-087-2022.txt gpg: Signature made Wed 23 Nov 2022 03:50:42 AM PST gpg: using RSA key EA18E7F040C41DDAEFE9AA0F4AC18DE1112E1490 gpg: Good signature from "Simon Gaiser (Qubes Security Pack signing key)" [full] $ cd ../canaries/ $ gpg --verify canary-034-2023.txt.sig.marmarek canary-034-2023.txt gpg: Signature made Thu 02 Mar 2023 03:51:48 AM PST gpg: using RSA key 2D1771FE4D767EDC76B089FAD655A4F21830E06A gpg: Good signature from "Marek Marczykowski-Górecki (Qubes security pack)" [full] $ gpg --verify canary-034-2023.txt.sig.simon canary-034-2023.txt gpg: Signature made Thu 02 Mar 2023 01:47:52 AM PST gpg: using RSA key EA18E7F040C41DDAEFE9AA0F4AC18DE1112E1490 gpg: Good signature from "Simon Gaiser (Qubes Security Pack signing key)" [full] Again, the exact output will differ, but the final line of output from each `gpg --verify` command should always start with `gpg: Good signature from...` followed by an appropriate key. For this announcement (QSB-111), the commands are: $ gpg --verify qsb-111-2026.txt.sig.marmarek qsb-111-2026.txt $ gpg --verify qsb-111-2026.txt.sig.simon qsb-111-2026.txt You can also verify the signatures directly from this announcement in addition to or instead of verifying the files from the qubes-secpack. Simply copy and paste the QSB-111 text into a plain text file and do the same for both signature files. Then, perform the same authentication steps as listed above, substituting the filenames above with the names of the files you just created.

The Xen Project has released one or more Xen security advisories (XSAs). The security of Qubes OS is **not** affected. ## XSAs that DO affect the security of Qubes OS The following XSAs **do affect** the security of Qubes OS: * (none) ## XSAs that DO NOT affect the security of Qubes OS The following XSAs **do not affect** the security of Qubes OS, and no user action is necessary: * XSA-482 * In-VM escalation only * Qubes OS does not support Secure Boot inside VMs. ## About this announcement Qubes OS uses the Xen hypervisor as part of its architecture. When the Xen Project publicly discloses a vulnerability in the Xen hypervisor, they issue a notice called a Xen security advisory (XSA). Vulnerabilities in the Xen hypervisor sometimes have security implications for Qubes OS. When they do, we issue a notice called a Qubes security bulletin (QSB). (QSBs are also issued for non-Xen vulnerabilities.) However, QSBs can provide only _positive_ confirmation that certain XSAs _do_ affect the security of Qubes OS. QSBs cannot provide _negative_ confirmation that other XSAs do _not_ affect the security of Qubes OS. Therefore, we also maintain an XSA tracker, which is a comprehensive list of all XSAs publicly disclosed to date, including whether each one affects the security of Qubes OS. When new XSAs are published, we add them to the XSA tracker and publish a notice like this one in order to inform Qubes users that a new batch of XSAs has been released and whether each one affects the security of Qubes OS.

We have published Qubes Security Bulletin (QSB) 110: Use after free of paging structures in EPT (XSA-480). The text of this QSB and its accompanying cryptographic signatures are reproduced below, followed by a general explanation of this announcement and authentication instructions. ## Qubes Security Bulletin 110 ---===[ Qubes Security Bulletin 110 ]===--- 2026-03-17 Use after free of paging structures in EPT (XSA-480) User action ------------ Continue to update normally [1] in order to receive the security updates described in the "Patching" section below. No other user action is required in response to this QSB. Summary -------- On 2026-03-17, the Xen Project published XSA-480, "Use after free of paging structures in EPT" [3]: | The Intel EPT paging code uses an optimization to defer flushing of any cached | EPT state until the p2m lock is dropped, so that multiple modifications done | under the same locked region only issue a single flush. | | Freeing of paging structures however is not deferred until the flushing is | done, and can result in freed pages transiently being present in cached state. | Such stale entries can point to memory ranges not owned by the guest, thus | allowing access to unintended memory regions. Impact ------- On affected systems, an attacker controlling any PVH or HVM qube can attempt to exploit this vulnerability in order to compromise Qubes OS. Affected systems ----------------- Only x86 Intel systems are affected. Patching --------- The following packages contain security updates that address the vulnerabilities described in this bulletin: For Qubes 4.2, in dom0: - Xen packages version 4.17.6-3 For Qubes 4.3, in dom0: - Xen packages version 4.19.4-5 These packages will migrate from the security-testing repository to the current (stable) repository over the next two weeks after being tested by the community. [2] Once available, the packages should be installed via the Qubes Update tool or its command-line equivalents. [1] Dom0 must be restarted afterward in order for the updates to take effect. If you use Anti Evil Maid, you will need to reseal your secret passphrase to new PCR values, as PCR18+19 will change due to the new Xen binaries. Credits -------- See the original Xen Security Advisory and linked publications. References ----------- [1] https://www.qubes-os.org/doc/how-to-update/ [2] https://www.qubes-os.org/doc/testing/ [3] https://xenbits.xen.org/xsa/advisory-480.html -- The Qubes Security Team https://www.qubes-os.org/security/ **Source:** qsb-110-2026.txt ## Marek Marczykowski-Górecki’s PGP signature -----BEGIN PGP SIGNATURE----- iQIzBAABCAAdFiEELRdx/k12ftx2sIn61lWk8hgw4GoFAmm5Xt8ACgkQ1lWk8hgw 4GqnfA/+L8SZOiI5cB0uaak6ormCPESvKQD4Y1yRvY4XQMYOkvrDC8IF3bI6Q/mO Xw4fIrwQ+j4lFQD/fn0exum+5/QZ0n7Wjx6oD1gfzKQvN55icRelt0opxbvyRCsz Uzh14sUNn8D5hLWWflNP4BTIFuwUPvv3DnQv4Mq3jSYlhnzHwWKGh70D1HnDfhS0 cDhJtd1py5juLl2V5JdqnHNSzpjOgOhPEAlCAnndoRMDRGjT+CALx9/F53LBm+Sf +W1M5ocTn816FXrLyInxiHJ1BfLsHz2gZtmg+hx/WXrgr+2XOT6UI5zbMLbkJmph p1UVx53W+qH9zHd0nFd47ZEFTYAbQggFYlBWOzOmlDXjshk3kQ5OTzf+36u9iezC fBdhHSiLE8HgR94c5Un8k0oJQsesYl/OvOGt3r1N4DirqFBpClXjoOTU+FI+8Xk4 RK77iaWuin/3Gz7cK8HmNSch/GRQZhJ9iZkOK/3a2+AXCFQs8AtZXUUxZ4Zr54gA h1AAG8RppKA0oajQ93BL6nOHFIH9/5dYH58O7xbWloQuhxz+s6m3kFCUy9yoo8iE uXaTpllF+5dV+g1Qn8TFC+IDrA75LF2j9vv8ll3KnvRoV31vB3TML7ECfkHtKqTA /CFvUWEXwc4TmVIeymWxMnMS9IBitbq6KrWJjGaGyVS4j0OIHzY= =gtVw -----END PGP SIGNATURE----- **Source:** qsb-110-2026.txt.sig.marmarek ## Simon Gaiser (aka HW42)’s PGP signature -----BEGIN PGP SIGNATURE----- iQIzBAABCgAdFiEE6hjn8EDEHdrv6aoPSsGN4REuFJAFAmm5YegACgkQSsGN4REu FJC7iBAAhZRtb8L4QWTyGJerJdfhhqTshRnPxRX6MeQ3TEQQccsXby/h8eyHcm2M zFpK9jBPaZCxpjvgoh2Yo4wu+2BVxlfPV40Z8lpBTdCjvZ3HhJXgDAKMGUQiimtG cWvoH0MKkfExm7+fQlYVZ/yVzN+Gf/00mFPxZhmAI0NUVvP4AdaT/UAgHjf5EzHx BkyX3cTbCkkzKrI5o973SoL4nNYQzVqFcUbsGb8uzZIPUTEMQmB+Sy7xrsUYJVKs FRTZ4qQx0+UEjMHAKrRFqt4MzQR1LaHdGbcZ9eenPSECWTJzc6nEpuoz3LUfvTBo rNrWJ+6vjdr4RBUj2VKhP7tNCGLGnLRVYyQ9vnLrHCKmYkQmH/opWh5j+VPXrhM9 fWRPMC39hdd9SYUOG78lSDf3Fu0FgD70b85kY5mYT4asliYaWBf3K9qN4xrGwJ/B /ebUNsOXjXmp4msqenWAdg1yjEzyK/xkxFMYOq1ideF4Dbqgmm1Sc8xmVbYjdlon lH3QfHqDDCDvASoGpPTCxybsmq5JEWMUvbkUSmVaKT/AeDikv9sSlMIjC4PfubKO 8UUyAe/4JOJO5np70d/zn0cEBVXYWeXd/71Bip29g9zpFBIKU96EJFdt0ynXzaHY zmptnFnZr5pwaaxaCmceN1HnLqt2TSpQiFRv8GZK+tmrf5hma1Y= =2DP5 -----END PGP SIGNATURE----- **Source:** qsb-110-2026.txt.sig.simon ## What is the purpose of this announcement? The purpose of this announcement is to inform the Qubes community that a new Qubes security bulletin (QSB) has been published. ## What is a Qubes security bulletin (QSB)? A Qubes security bulletin (QSB) is a security announcement issued by the Qubes security team. A QSB typically provides a summary and impact analysis of one or more recently-discovered software vulnerabilities, including details about patching to address them. ## Why should I care about QSBs? QSBs tell you what actions you must take in order to protect yourself from recently-discovered security vulnerabilities. In most cases, security vulnerabilities are addressed by updating normally. However, in some cases, special user action is required. In all cases, the required actions are detailed in QSBs. ## What are the PGP signatures that accompany QSBs? A PGP signature is a cryptographic digital signature made in accordance with the OpenPGP standard. PGP signatures can be cryptographically verified with programs like GNU Privacy Guard (GPG). The Qubes security team cryptographically signs all QSBs so that Qubes users have a reliable way to check whether QSBs are genuine. The only way to be certain that a QSB is authentic is by verifying its PGP signatures. ## Why should I care whether a QSB is authentic? A forged QSB could deceive you into taking actions that adversely affect the security of your Qubes OS system, such as installing malware or making configuration changes that render your system vulnerable to attack. Falsified QSBs could sow fear, uncertainty, and doubt about the security of Qubes OS or the status of the Qubes OS Project. ## How do I verify the PGP signatures on a QSB? The following command-line instructions assume a Linux system with `git` and `gpg` installed. (For Windows and Mac options, see OpenPGP software.) 1. Obtain the Qubes Master Signing Key (QMSK), e.g.: $ gpg --fetch-keys https://keys.qubes-os.org/keys/qubes-master-signing-key.asc gpg: directory '/home/user/.gnupg' created gpg: keybox '/home/user/.gnupg/pubring.kbx' created gpg: requesting key from 'https://keys.qubes-os.org/keys/qubes-master-signing-key.asc' gpg: /home/user/.gnupg/trustdb.gpg: trustdb created gpg: key DDFA1A3E36879494: public key "Qubes Master Signing Key" imported gpg: Total number processed: 1 gpg: imported: 1 (For more ways to obtain the QMSK, see How to import and authenticate the Qubes Master Signing Key.) 2. View the fingerprint of the PGP key you just imported. (Note: `gpg>` indicates a prompt inside of the GnuPG program. Type what appears after it when prompted.) $ gpg --edit-key 0x427F11FD0FAA4B080123F01CDDFA1A3E36879494 gpg (GnuPG) 2.2.27; Copyright (C) 2021 Free Software Foundation, Inc. This is free software: you are free to change and redistribute it. There is NO WARRANTY, to the extent permitted by law. pub rsa4096/DDFA1A3E36879494 created: 2010-04-01 expires: never usage: SC trust: unknown validity: unknown [ unknown] (1). Qubes Master Signing Key gpg> fpr pub rsa4096/DDFA1A3E36879494 2010-04-01 Qubes Master Signing Key Primary key fingerprint: 427F 11FD 0FAA 4B08 0123 F01C DDFA 1A3E 3687 9494 3. **Important:** At this point, you still don’t know whether the key you just imported is the genuine QMSK or a forgery. In order for this entire procedure to provide meaningful security benefits, you _must_ authenticate the QMSK out-of-band. **Do not skip this step!** The standard method is to obtain the QMSK fingerprint from _multiple independent sources in several different ways_ and check to see whether they match the key you just imported. For more information, see How to import and authenticate the Qubes Master Signing Key. **Tip:** After you have authenticated the QMSK out-of-band to your satisfaction, record the QMSK fingerprint in a safe place (or several) so that you don’t have to repeat this step in the future. 4. Once you are satisfied that you have the genuine QMSK, set its trust level to 5 (“ultimate”), then quit GnuPG with `q`. gpg> trust pub rsa4096/DDFA1A3E36879494 created: 2010-04-01 expires: never usage: SC trust: unknown validity: unknown [ unknown] (1). Qubes Master Signing Key Please decide how far you trust this user to correctly verify other users' keys (by looking at passports, checking fingerprints from different sources, etc.) 1 = I don't know or won't say 2 = I do NOT trust 3 = I trust marginally 4 = I trust fully 5 = I trust ultimately m = back to the main menu Your decision? 5 Do you really want to set this key to ultimate trust? (y/N) y pub rsa4096/DDFA1A3E36879494 created: 2010-04-01 expires: never usage: SC trust: ultimate validity: unknown [ unknown] (1). Qubes Master Signing Key Please note that the shown key validity is not necessarily correct unless you restart the program. gpg> q 5. Use Git to clone the qubes-secpack repo. $ git clone https://github.com/QubesOS/qubes-secpack.git Cloning into 'qubes-secpack'... remote: Enumerating objects: 4065, done. remote: Counting objects: 100% (1474/1474), done. remote: Compressing objects: 100% (742/742), done. remote: Total 4065 (delta 743), reused 1413 (delta 731), pack-reused 2591 Receiving objects: 100% (4065/4065), 1.64 MiB | 2.53 MiB/s, done. Resolving deltas: 100% (1910/1910), done. 6. Import the included PGP keys. (See our PGP key policies for important information about these keys.) $ gpg --import qubes-secpack/keys/*/* gpg: key 063938BA42CFA724: public key "Marek Marczykowski-Górecki (Qubes OS signing key)" imported gpg: qubes-secpack/keys/core-devs/retired: read error: Is a directory gpg: no valid OpenPGP data found. gpg: key 8C05216CE09C093C: 1 signature not checked due to a missing key gpg: key 8C05216CE09C093C: public key "HW42 (Qubes Signing Key)" imported gpg: key DA0434BC706E1FCF: public key "Simon Gaiser (Qubes OS signing key)" imported gpg: key 8CE137352A019A17: 2 signatures not checked due to missing keys gpg: key 8CE137352A019A17: public key "Andrew David Wong (Qubes Documentation Signing Key)" imported gpg: key AAA743B42FBC07A9: public key "Brennan Novak (Qubes Website & Documentation Signing)" imported gpg: key B6A0BB95CA74A5C3: public key "Joanna Rutkowska (Qubes Documentation Signing Key)" imported gpg: key F32894BE9684938A: public key "Marek Marczykowski-Górecki (Qubes Documentation Signing Key)" imported gpg: key 6E7A27B909DAFB92: public key "Hakisho Nukama (Qubes Documentation Signing Key)" imported gpg: key 485C7504F27D0A72: 1 signature not checked due to a missing key gpg: key 485C7504F27D0A72: public key "Sven Semmler (Qubes Documentation Signing Key)" imported gpg: key BB52274595B71262: public key "unman (Qubes Documentation Signing Key)" imported gpg: key DC2F3678D272F2A8: 1 signature not checked due to a missing key gpg: key DC2F3678D272F2A8: public key "Wojtek Porczyk (Qubes OS documentation signing key)" imported gpg: key FD64F4F9E9720C4D: 1 signature not checked due to a missing key gpg: key FD64F4F9E9720C4D: public key "Zrubi (Qubes Documentation Signing Key)" imported gpg: key DDFA1A3E36879494: "Qubes Master Signing Key" not changed gpg: key 1848792F9E2795E9: public key "Qubes OS Release 4 Signing Key" imported gpg: qubes-secpack/keys/release-keys/retired: read error: Is a directory gpg: no valid OpenPGP data found. gpg: key D655A4F21830E06A: public key "Marek Marczykowski-Górecki (Qubes security pack)" imported gpg: key ACC2602F3F48CB21: public key "Qubes OS Security Team" imported gpg: qubes-secpack/keys/security-team/retired: read error: Is a directory gpg: no valid OpenPGP data found. gpg: key 4AC18DE1112E1490: public key "Simon Gaiser (Qubes Security Pack signing key)" imported gpg: Total number processed: 17 gpg: imported: 16 gpg: unchanged: 1 gpg: marginals needed: 3 completes needed: 1 trust model: pgp gpg: depth: 0 valid: 1 signed: 6 trust: 0-, 0q, 0n, 0m, 0f, 1u gpg: depth: 1 valid: 6 signed: 0 trust: 6-, 0q, 0n, 0m, 0f, 0u 7. Verify signed Git tags. $ cd qubes-secpack/ $ git tag -v `git describe` object 266e14a6fae57c9a91362c9ac784d3a891f4d351 type commit tag marmarek_sec_266e14a6 tagger Marek Marczykowski-Górecki 1677757924 +0100 Tag for commit 266e14a6fae57c9a91362c9ac784d3a891f4d351 gpg: Signature made Thu 02 Mar 2023 03:52:04 AM PST gpg: using RSA key 2D1771FE4D767EDC76B089FAD655A4F21830E06A gpg: Good signature from "Marek Marczykowski-Górecki (Qubes security pack)" [full] The exact output will differ, but the final line should always start with `gpg: Good signature from...` followed by an appropriate key. The `[full]` indicates full trust, which this key inherits in virtue of being validly signed by the QMSK. 8. Verify PGP signatures, e.g.: $ cd QSBs/ $ gpg --verify qsb-087-2022.txt.sig.marmarek qsb-087-2022.txt gpg: Signature made Wed 23 Nov 2022 04:05:51 AM PST gpg: using RSA key 2D1771FE4D767EDC76B089FAD655A4F21830E06A gpg: Good signature from "Marek Marczykowski-Górecki (Qubes security pack)" [full] $ gpg --verify qsb-087-2022.txt.sig.simon qsb-087-2022.txt gpg: Signature made Wed 23 Nov 2022 03:50:42 AM PST gpg: using RSA key EA18E7F040C41DDAEFE9AA0F4AC18DE1112E1490 gpg: Good signature from "Simon Gaiser (Qubes Security Pack signing key)" [full] $ cd ../canaries/ $ gpg --verify canary-034-2023.txt.sig.marmarek canary-034-2023.txt gpg: Signature made Thu 02 Mar 2023 03:51:48 AM PST gpg: using RSA key 2D1771FE4D767EDC76B089FAD655A4F21830E06A gpg: Good signature from "Marek Marczykowski-Górecki (Qubes security pack)" [full] $ gpg --verify canary-034-2023.txt.sig.simon canary-034-2023.txt gpg: Signature made Thu 02 Mar 2023 01:47:52 AM PST gpg: using RSA key EA18E7F040C41DDAEFE9AA0F4AC18DE1112E1490 gpg: Good signature from "Simon Gaiser (Qubes Security Pack signing key)" [full] Again, the exact output will differ, but the final line of output from each `gpg --verify` command should always start with `gpg: Good signature from...` followed by an appropriate key. For this announcement (QSB-110), the commands are: $ gpg --verify qsb-110-2026.txt.sig.marmarek qsb-110-2026.txt $ gpg --verify qsb-110-2026.txt.sig.simon qsb-110-2026.txt You can also verify the signatures directly from this announcement in addition to or instead of verifying the files from the qubes-secpack. Simply copy and paste the QSB-110 text into a plain text file and do the same for both signature files. Then, perform the same authentication steps as listed above, substituting the filenames above with the names of the files you just created.

The following new Fedora 43 templates are now available for Qubes OS 4.2: * `fedora-43-xfce` (default Fedora template with the Xfce desktop environment) * `fedora-43` (alternative Fedora template with the GNOME desktop environment) * `fedora-43-minimal` (minimal template for advanced users) **Note:** These templates have already been released for Qubes OS 4.3. There are two ways to upgrade a template to a new Fedora release: 1. **Recommended:** Install a fresh template to replace an existing one. This option is simpler for less experienced users, but it won’t preserve any modifications you’ve made to your template. After you install the new template, you’ll have to redo your desired template modifications (if any) and switch everything that was set to the old template to the new template. If you choose to modify your template, you may wish to write those modifications down so that you remember what to redo on each fresh install. To see a log of package manager actions, open a terminal in the template and use the `dnf history` command. 2. **Advanced:** Perform an in-place upgrade of an existing Fedora template. This option will preserve any modifications you’ve made to the template, but it may be more complicated for less experienced users. **Note:** No user action is required regarding the OS version in dom0 (see our note on dom0 and EOL).

We have published Qubes Canary 046. The text of this canary and its accompanying cryptographic signatures are reproduced below. For an explanation of this announcement and instructions for authenticating this canary, please see the end of this announcement. ## Qubes Canary 046 ---===[ Qubes Canary 046 ]===--- Statements ----------- The Qubes security team members who have digitally signed this file [1] state the following: 1. The date of issue of this canary is March 12, 2026. 2. There have been 109 Qubes security bulletins published so far. 3. The Qubes Master Signing Key fingerprint is: 427F 11FD 0FAA 4B08 0123 F01C DDFA 1A3E 3687 9494 4. No warrants have ever been served to us with regard to the Qubes OS Project (e.g. to hand out the private signing keys or to introduce backdoors). 5. We plan to publish the next of these canary statements in the first fourteen days of June 2026. Special note should be taken if no new canary is published by that time or if the list of statements changes without plausible explanation. Special announcements ---------------------- None. Disclaimers and notes ---------------------- We would like to remind you that Qubes OS has been designed under the assumption that all relevant infrastructure is permanently compromised. This means that we assume NO trust in any of the servers or services which host or provide any Qubes-related data, in particular, software updates, source code repositories, and Qubes ISO downloads. This canary scheme is not infallible. Although signing the declaration makes it very difficult for a third party to produce arbitrary declarations, it does not prevent them from using force or other means, like blackmail or compromising the signers' laptops, to coerce us to produce false declarations. The proof of freshness provided below serves to demonstrate that this canary could not have been created prior to the date stated. It shows that a series of canaries was not created in advance. This declaration is merely a best effort and is provided without any guarantee or warranty. It is not legally binding in any way to anybody. None of the signers should be ever held legally responsible for any of the statements made here. Proof of freshness ------------------- Thu, 12 Mar 2026 11:22:20 +0000 Source: DER SPIEGEL - International (https://www.spiegel.de/international/index.rss) Insta, TikTok and Co.: Is Australia's Social Media Ban for Children Actually Working? "Reckless, Suicidal Race": The Deadly Threat Posed by Artificial Intelligence Portrait of a City after Four Years of War: The Courage of Kyiv U.S. Historian Robert Kagan: "We Are Watching a Country Fall Under Dictatorship Almost Without Resistance" Nord Stream: How Early Did the CIA Know about the Pipeline Attack? Source: NYT > World News (https://rss.nytimes.com/services/xml/rss/nyt/World.xml) Iran War Live Updates: Iraq Closes Oil Terminals Amid Growing Disruption to Global Supplies Trump’s Iran War Is Causing Problems For His Ally in Italy, Giorgia Meloni How Russia’s Scorched-Earth Attacks Put Ukraine’s Power Grid Near Collapse China Wants Its Ethnic Minorities to Blend In. Now It’s the Law. At China’s Big Political Meeting, a Rare Debate About Inequality Source: BBC News (https://feeds.bbci.co.uk/news/world/rss.xml) China approves 'ethnic unity' law requiring minorities to learn Mandarin Epstein used modelling agent to recruit girls, Brazilian women tell BBC War in Ukraine spills into Hungarian election campaign Noma head chef resigns from restaurant amid abuse allegations Hozier, Jessie Buckley and Bruce Springsteen record Shane MacGowan tribute album Source: Blockchain.info 000000000000000000017245ca11dddd962050ba2ce7fb38f0ab6a10d4a9cf00 Footnotes ---------- [1] This file should be signed in two ways: (1) via detached PGP signatures by each of the signers, distributed together with this canary in the qubes-secpack.git repo, and (2) via digital signatures on the corresponding qubes-secpack.git repo tags. [2] [2] Don't just trust the contents of this file blindly! Verify the digital signatures! Instructions for doing so are documented here: https://www.qubes-os.org/security/pack/ -- The Qubes Security Team https://www.qubes-os.org/security/ Source: canary-046-2026.txt ## Marek Marczykowski-Górecki’s PGP signature -----BEGIN PGP SIGNATURE----- iQIzBAABCAAdFiEELRdx/k12ftx2sIn61lWk8hgw4GoFAmmyrAoACgkQ1lWk8hgw 4GrH6g/9E/VpqfONfKxsls2CTFmesP3f4wCwE06X9hl4A98avOD3akjXU3yr7x4d 1r9yQ8htbR7i7CPVAfhN2wFNco7Ne12npSh/pe77z6IpbYnshE5gARPUVMW3+Pxt vLwSkAJOGybqk1l6kySAzVSJKMfnkqjwYM9N6JknXHDwF6b643vNaB1QXSGW3TVk suNK0bgjGcdi2Kr7rb0A7k5hlYKA9VqSZ47LqBKI1LEwHIoWCtHLDs1bebQSSxyg p7NgGvpRQ8LoUMYJ3zXRM6+LmQ+p67vYfmFNXLdH38GxVq2nlwZbEz8QrHhebdXT bDCXbr+AYIvYQIwmCKhk14bzXPCII6CsjHIxvvoDOkhBX79gTnuTEFbWwVh+UqOV IBzfW29/nBCylVorxgh0+N9W/XXg84aO4FWYREmUvOZ+vcJO/GjJtRQymZFeNvb1 hxj8Ny3Kj0hpfU8hRNagyrWzFhqVjcntUdJXSGEQ49FlDVmUNlEN7OJM/uBpu65T /ljENLS5MO0YXOT0FItIc26Ntb9QiNi0sYtJWzyJ6i+1ugFfTGGkEpBmfh2HSS6c zb8JU0RzBP2C5GN+ThMv+1KkCRWx6MCRG16YVfh0JAkCdezpSs0E3BaJ3zFK6gXb IHEZffCXoJQNnCJGgFLGTOTGdMiITBhmYYoa20a/tc4huxnwt24= =7wSH -----END PGP SIGNATURE----- Source: canary-046-2026.txt.sig.marmarek ## Simon Gaiser (aka HW42)’s PGP signature -----BEGIN PGP SIGNATURE----- iQIzBAABCgAdFiEE6hjn8EDEHdrv6aoPSsGN4REuFJAFAmmyuFEACgkQSsGN4REu FJDQfQ//WDz+9dBDn5Bs3g5wBb6kDPzWk7ws/pNQwqyCRQq6k7Np2ICR9uu+Hkbv Oe5F7u0el+w8xrJlibAHm6ZYkZbr0KFeZFNt3rQnlGL2kERBKLvgJV1aMXPnNonx vgod/hY5vgburQIs0Nz1X9wFQtaN6mJrbTiH7ixp7z3HGxKXeJPlpX8DDyAOEcP0 DWnU0mTuLpQtS601r46MWgG2t9uLpqyrIk5Bl+j9tdNvqsJrAscUYQovyi0T8JC8 Bwf7Q59ia5SCyIlOHxaKKhTGaqXXlr5scgn/+jB2TTkd3DKJVogUuAZ2oLdEbfdv 98tv7sBRpWtaPgK+PB5Y6Ese/3XSN7J5GmBKFM5l5Sw0kDlur47Q7maOirz941gX TiP9Vla+qe7r4N0ZM6HYvJQfoUTmtHFKn39TcrEucYb2cvTGYLrYRGufSz3koLgt MZTOyoS6xnT0lsvq9e7e7YqT1HPIJvHQD9LuG0gAukT5qqYR9GSlGc0f2InsLo1g KLDL8q8q5n8pmx8OhRSff7gDbqLU7ISCe1UzLJ8Sej47uz0KVJEGnkZGFWVlqiaB zJ4D9MqzWyQGIGHwS6FzE0DAQVDjyksTpchGzpmow3W6A2t3iE8iP8pCZCJ7CV1U hWciQJDtBiFoaHqJ/3Xl8n5b9SM1DbiwodV+r3Z1eNyJK/7QaK8= =DV9o -----END PGP SIGNATURE----- Source: canary-046-2026.txt.sig.simon ## What is the purpose of this announcement? The purpose of this announcement is to inform the Qubes community that a new Qubes canary has been published. ## What is a Qubes canary? A Qubes canary is a security announcement periodically issued by the Qubes security team consisting of several statements to the effect that the signers of the canary have not been compromised. The idea is that, as long as signed canaries including such statements continue to be published, all is well. However, if the canaries should suddenly cease, if one or more signers begin declining to sign them, or if the included statements change significantly without plausible explanation, then this may indicate that something has gone wrong. The name originates from the practice in which miners would bring caged canaries into coal mines. If the level of methane gas in the mine reached a dangerous level, the canary would die, indicating to miners that they should evacuate. (See the Wikipedia article on warrant canaries for more information, but bear in mind that Qubes Canaries are not strictly limited to legal warrants.) ## Why should I care about canaries? Canaries provide an important indication about the security status of the project. If the canary is healthy, it’s a strong sign that things are running normally. However, if the canary is unhealthy, it could mean that the project or its members are being coerced in some way. ## What are some signs of an unhealthy canary? Here is a non-exhaustive list of examples: * **Dead canary.** In each canary, we state a window of time during which you should expect the next canary to be published. If no canary is published within that window of time and no good explanation is provided for missing the deadline, then the canary has died. * **Missing statement(s).** Canaries include a set of numbered statements at the top. These statements are generally the same across canaries, except for specific numbers and dates that have changed since the previous canary. If an important statement was present in older canaries but suddenly goes missing from new canaries with no correction or explanation, then this may be an indication that the signers can no longer truthfully make that statement. * **Missing signature(s).** Qubes canaries are signed by the members of the Qubes security team (see below). If one of them has been signing all canaries but suddenly and permanently stops signing new canaries without any explanation, then this may indicate that this person is under duress or can no longer truthfully sign the statements contained in the canary. ## Does every unexpected or unusual occurrence related to a canary indicate something bad? No, there are many canary-related possibilities that should _not_ worry you. Here is a non-exhaustive list of examples: * **Unusual reposts.** The only canaries that matter are the ones that are validly signed in the Qubes security pack (qubes-secpack). Reposts of canaries (like the one in this announcement) do not have any authority (except insofar as they reproduce validly-signed text from the qubes-secpack). If the actual canary in the qubes-secpack is healthy, but reposts are late, absent, or modified on the website, mailing lists, forum, or social media platforms, you should not be concerned about the canary. * **Last-minute signature(s).** If the canary is signed at the last minute but before the deadline, that’s okay. (People get busy and procrastinate sometimes.) * **Signatures at different times.** If one signature is earlier or later than the other, but both are present within a reasonable period of time, that’s okay. (For example, sometimes one signer is out of town, but we try to plan the deadlines around this.) * **Permitted changes.** If something about a canary changes without violating any of the statements in prior canaries, that’s okay. (For example, canaries are usually scheduled for the first fourteen days of a given month, but there’s no rule that says they have to be.) * **Unusual but planned changes.** If something unusual happens, but it was announced in advance, and the appropriate statements are signed, that’s okay (e.g., when Joanna left the security team and Simon joined it). In general, it would not be realistic for an organization to exist that never changed, had zero turnover, and never made mistakes. Therefore, it would be reasonable to expect such events to occur periodically, and it would be unreasonable to regard _every_ unusual or unexpected canary-related event as a sign of compromise. For example, if something usual happens with a canary, and we say it was a mistake and correct it (with valid signatures), you will have to decide for yourself whether it’s more likely that it really was just a mistake or that something is wrong and that this is how we chose to send you a subtle signal about it. This will require you to think carefully about which among many possible scenarios is most likely given the evidence available to you. Since this is fundamentally a matter of judgment, canaries are ultimately a _social_ scheme, not a technical one. ## What are the PGP signatures that accompany canaries? A PGP signature is a cryptographic digital signature made in accordance with the OpenPGP standard. PGP signatures can be cryptographically verified with programs like GNU Privacy Guard (GPG). The Qubes security team cryptographically signs all canaries so that Qubes users have a reliable way to check whether canaries are genuine. The only way to be certain that a canary is authentic is by verifying its PGP signatures. ## Why should I care whether a canary is authentic? If you fail to notice that a canary is unhealthy or has died, you may continue to trust the Qubes security team even after they have signaled via the canary (or lack thereof) that they been compromised or coerced. Alternatively, an adversary could fabricate a canary in an attempt to deceive the public. Such a canary would not be validly signed, but users who neglect to check the signatures on the fake canary would not be aware of this, so they may mistakenly believe it to be genuine, especially if it closely mimics the language of authentic canaries. Such falsified canaries could include manipulated text designed to sow fear, uncertainty, and doubt about the security of Qubes OS or the status of the Qubes OS Project. ## How do I verify the PGP signatures on a canary? The following command-line instructions assume a Linux system with `git` and `gpg` installed. (For Windows and Mac options, see OpenPGP software.) 1. Obtain the Qubes Master Signing Key (QMSK), e.g.: $ gpg --fetch-keys https://keys.qubes-os.org/keys/qubes-master-signing-key.asc gpg: directory '/home/user/.gnupg' created gpg: keybox '/home/user/.gnupg/pubring.kbx' created gpg: requesting key from 'https://keys.qubes-os.org/keys/qubes-master-signing-key.asc' gpg: /home/user/.gnupg/trustdb.gpg: trustdb created gpg: key DDFA1A3E36879494: public key "Qubes Master Signing Key" imported gpg: Total number processed: 1 gpg: imported: 1 (For more ways to obtain the QMSK, see How to import and authenticate the Qubes Master Signing Key.) 2. View the fingerprint of the PGP key you just imported. (Note: `gpg>` indicates a prompt inside of the GnuPG program. Type what appears after it when prompted.) $ gpg --edit-key 0x427F11FD0FAA4B080123F01CDDFA1A3E36879494 gpg (GnuPG) 2.2.27; Copyright (C) 2021 Free Software Foundation, Inc. This is free software: you are free to change and redistribute it. There is NO WARRANTY, to the extent permitted by law. pub rsa4096/DDFA1A3E36879494 created: 2010-04-01 expires: never usage: SC trust: unknown validity: unknown [ unknown] (1). Qubes Master Signing Key gpg> fpr pub rsa4096/DDFA1A3E36879494 2010-04-01 Qubes Master Signing Key Primary key fingerprint: 427F 11FD 0FAA 4B08 0123 F01C DDFA 1A3E 3687 9494 3. **Important:** At this point, you still don’t know whether the key you just imported is the genuine QMSK or a forgery. In order for this entire procedure to provide meaningful security benefits, you _must_ authenticate the QMSK out-of-band. **Do not skip this step!** The standard method is to obtain the QMSK fingerprint from _multiple independent sources in several different ways_ and check to see whether they match the key you just imported. For more information, see How to import and authenticate the Qubes Master Signing Key. **Tip:** After you have authenticated the QMSK out-of-band to your satisfaction, record the QMSK fingerprint in a safe place (or several) so that you don’t have to repeat this step in the future. 4. Once you are satisfied that you have the genuine QMSK, set its trust level to 5 (“ultimate”), then quit GnuPG with `q`. gpg> trust pub rsa4096/DDFA1A3E36879494 created: 2010-04-01 expires: never usage: SC trust: unknown validity: unknown [ unknown] (1). Qubes Master Signing Key Please decide how far you trust this user to correctly verify other users' keys (by looking at passports, checking fingerprints from different sources, etc.) 1 = I don't know or won't say 2 = I do NOT trust 3 = I trust marginally 4 = I trust fully 5 = I trust ultimately m = back to the main menu Your decision? 5 Do you really want to set this key to ultimate trust? (y/N) y pub rsa4096/DDFA1A3E36879494 created: 2010-04-01 expires: never usage: SC trust: ultimate validity: unknown [ unknown] (1). Qubes Master Signing Key Please note that the shown key validity is not necessarily correct unless you restart the program. gpg> q 5. Use Git to clone the qubes-secpack repo. $ git clone https://github.com/QubesOS/qubes-secpack.git Cloning into 'qubes-secpack'... remote: Enumerating objects: 4065, done. remote: Counting objects: 100% (1474/1474), done. remote: Compressing objects: 100% (742/742), done. remote: Total 4065 (delta 743), reused 1413 (delta 731), pack-reused 2591 Receiving objects: 100% (4065/4065), 1.64 MiB | 2.53 MiB/s, done. Resolving deltas: 100% (1910/1910), done. 6. Import the included PGP keys. (See our PGP key policies for important information about these keys.) $ gpg --import qubes-secpack/keys/*/* gpg: key 063938BA42CFA724: public key "Marek Marczykowski-Górecki (Qubes OS signing key)" imported gpg: qubes-secpack/keys/core-devs/retired: read error: Is a directory gpg: no valid OpenPGP data found. gpg: key 8C05216CE09C093C: 1 signature not checked due to a missing key gpg: key 8C05216CE09C093C: public key "HW42 (Qubes Signing Key)" imported gpg: key DA0434BC706E1FCF: public key "Simon Gaiser (Qubes OS signing key)" imported gpg: key 8CE137352A019A17: 2 signatures not checked due to missing keys gpg: key 8CE137352A019A17: public key "Andrew David Wong (Qubes Documentation Signing Key)" imported gpg: key AAA743B42FBC07A9: public key "Brennan Novak (Qubes Website & Documentation Signing)" imported gpg: key B6A0BB95CA74A5C3: public key "Joanna Rutkowska (Qubes Documentation Signing Key)" imported gpg: key F32894BE9684938A: public key "Marek Marczykowski-Górecki (Qubes Documentation Signing Key)" imported gpg: key 6E7A27B909DAFB92: public key "Hakisho Nukama (Qubes Documentation Signing Key)" imported gpg: key 485C7504F27D0A72: 1 signature not checked due to a missing key gpg: key 485C7504F27D0A72: public key "Sven Semmler (Qubes Documentation Signing Key)" imported gpg: key BB52274595B71262: public key "unman (Qubes Documentation Signing Key)" imported gpg: key DC2F3678D272F2A8: 1 signature not checked due to a missing key gpg: key DC2F3678D272F2A8: public key "Wojtek Porczyk (Qubes OS documentation signing key)" imported gpg: key FD64F4F9E9720C4D: 1 signature not checked due to a missing key gpg: key FD64F4F9E9720C4D: public key "Zrubi (Qubes Documentation Signing Key)" imported gpg: key DDFA1A3E36879494: "Qubes Master Signing Key" not changed gpg: key 1848792F9E2795E9: public key "Qubes OS Release 4 Signing Key" imported gpg: qubes-secpack/keys/release-keys/retired: read error: Is a directory gpg: no valid OpenPGP data found. gpg: key D655A4F21830E06A: public key "Marek Marczykowski-Górecki (Qubes security pack)" imported gpg: key ACC2602F3F48CB21: public key "Qubes OS Security Team" imported gpg: qubes-secpack/keys/security-team/retired: read error: Is a directory gpg: no valid OpenPGP data found. gpg: key 4AC18DE1112E1490: public key "Simon Gaiser (Qubes Security Pack signing key)" imported gpg: Total number processed: 17 gpg: imported: 16 gpg: unchanged: 1 gpg: marginals needed: 3 completes needed: 1 trust model: pgp gpg: depth: 0 valid: 1 signed: 6 trust: 0-, 0q, 0n, 0m, 0f, 1u gpg: depth: 1 valid: 6 signed: 0 trust: 6-, 0q, 0n, 0m, 0f, 0u 7. Verify signed Git tags. $ cd qubes-secpack/ $ git tag -v `git describe` object 266e14a6fae57c9a91362c9ac784d3a891f4d351 type commit tag marmarek_sec_266e14a6 tagger Marek Marczykowski-Górecki 1677757924 +0100 Tag for commit 266e14a6fae57c9a91362c9ac784d3a891f4d351 gpg: Signature made Thu 02 Mar 2023 03:52:04 AM PST gpg: using RSA key 2D1771FE4D767EDC76B089FAD655A4F21830E06A gpg: Good signature from "Marek Marczykowski-Górecki (Qubes security pack)" [full] The exact output will differ, but the final line should always start with `gpg: Good signature from...` followed by an appropriate key. The `[full]` indicates full trust, which this key inherits in virtue of being validly signed by the QMSK. 8. Verify PGP signatures, e.g.: $ cd QSBs/ $ gpg --verify qsb-087-2022.txt.sig.marmarek qsb-087-2022.txt gpg: Signature made Wed 23 Nov 2022 04:05:51 AM PST gpg: using RSA key 2D1771FE4D767EDC76B089FAD655A4F21830E06A gpg: Good signature from "Marek Marczykowski-Górecki (Qubes security pack)" [full] $ gpg --verify qsb-087-2022.txt.sig.simon qsb-087-2022.txt gpg: Signature made Wed 23 Nov 2022 03:50:42 AM PST gpg: using RSA key EA18E7F040C41DDAEFE9AA0F4AC18DE1112E1490 gpg: Good signature from "Simon Gaiser (Qubes Security Pack signing key)" [full] $ cd ../canaries/ $ gpg --verify canary-034-2023.txt.sig.marmarek canary-034-2023.txt gpg: Signature made Thu 02 Mar 2023 03:51:48 AM PST gpg: using RSA key 2D1771FE4D767EDC76B089FAD655A4F21830E06A gpg: Good signature from "Marek Marczykowski-Górecki (Qubes security pack)" [full] $ gpg --verify canary-034-2023.txt.sig.simon canary-034-2023.txt gpg: Signature made Thu 02 Mar 2023 01:47:52 AM PST gpg: using RSA key EA18E7F040C41DDAEFE9AA0F4AC18DE1112E1490 gpg: Good signature from "Simon Gaiser (Qubes Security Pack signing key)" [full] Again, the exact output will differ, but the final line of output from each `gpg --verify` command should always start with `gpg: Good signature from...` followed by an appropriate key. For this announcement (Qubes Canary 046), the commands are: $ gpg --verify canary-046-2026.txt.sig.marmarek canary-046-2026.txt $ gpg --verify canary-046-2026.txt.sig.simon canary-046-2026.txt You can also verify the signatures directly from this announcement in addition to or instead of verifying the files from the qubes-secpack. Simply copy and paste the Qubes Canary 046 text into a plain text file and do the same for both signature files. Then, perform the same authentication steps as listed above, substituting the filenames above with the names of the files you just created.

<p>The following new <a href="https://doc.qubes-os.org/en/latest/user/templates/fedora/fedora.html">Fedora 43 templates</a> are now available for Qubes OS 4.3:</p> <ul> <li><code class="language-plaintext highlighter-rouge">fedora-43-xfce</code> (default Fedora template with the <a href="https://xfce.org/">Xfce</a> desktop environment)</li> <li><code class="language-plaintext highlighter-rouge">fedora-43</code> (alternative Fedora template with the <a href="https://www.gnome.org/">GNOME</a> desktop environment)</li> <li><code class="language-plaintext highlighter-rouge">fedora-43-minimal</code> (<a href="https://doc.qubes-os.org/en/latest/user/templates/minimal-templates.html">minimal template</a> for advanced users)</li> </ul> <p><strong>Note:</strong> Fedora 43 template availability for Qubes OS 4.2 will be announced separately.</p> <p>There are two ways to upgrade a template to a new Fedora release:</p> <ol> <li> <p><strong>Recommended:</strong> <a href="https://doc.qubes-os.org/en/latest/user/templates/fedora/fedora.html#installing">Install a fresh template to replace an existing one.</a> This option is simpler for less experienced users, but it won’t preserve any modifications you’ve made to your template. After you install the new template, you’ll have to redo your desired template modifications (if any) and <a href="https://doc.qubes-os.org/en/latest/user/templates/templates.html#switching">switch everything that was set to the old template to the new template</a>. If you choose to modify your template, you may wish to write those modifications down so that you remember what to redo on each fresh install. To see a log of package manager actions, open a terminal in the template and use the <code class="language-plaintext highlighter-rouge">dnf history</code> command.</p> </li> <li> <p><strong>Advanced:</strong> <a href="https://doc.qubes-os.org/en/latest/user/templates/fedora/fedora-upgrade.html">Perform an in-place upgrade of an existing Fedora template.</a> This option will preserve any modifications you’ve made to the template, but it may be more complicated for less experienced users.</p> </li> </ol> <p><strong>Note:</strong> No user action is required regarding the OS version in dom0 (see our <a href="https://doc.qubes-os.org/en/latest/user/downloading-installing-upgrading/supported-releases.html#note-on-dom0-and-eol">note on dom0 and EOL</a>).</p>

<p>The <a href="https://xenproject.org/">Xen Project</a> has released one or more <a href="https://xenbits.xen.org/xsa/">Xen security advisories (XSAs)</a>. The security of Qubes OS is <strong>not</strong> affected.</p> <h2 id="xsas-that-do-affect-the-security-of-qubes-os">XSAs that DO affect the security of Qubes OS</h2> <p>The following XSAs <strong>do affect</strong> the security of Qubes OS:</p> <ul> <li>(none)</li> </ul> <h2 id="xsas-that-do-not-affect-the-security-of-qubes-os">XSAs that DO NOT affect the security of Qubes OS</h2> <p>The following XSAs <strong>do not affect</strong> the security of Qubes OS, and no user action is necessary:</p> <ul> <li><a href="https://xenbits.xen.org/xsa/advisory-477.html">XSA-477</a> <ul> <li>This XSA affects only HVMs with shadow paging and tracing enabled.</li> </ul> </li> <li><a href="https://xenbits.xen.org/xsa/advisory-478.html">XSA-478</a> <ul> <li>This XSA affects only XAPI, which is an alternative toolstack. Qubes OS uses libxl instead of XAPI.</li> </ul> </li> <li><a href="https://xenbits.xen.org/xsa/advisory-479.html">XSA-479</a> <ul> <li>This XSA affects only in-VM isolation, which Qubes OS does not rely on for security. We will still provide the fix for this issue at a later date, but it will not be accompanied by a <a href="/security/qsb/">Qubes security bulletin (QSB)</a>.</li> </ul> </li> </ul> <h2 id="about-this-announcement">About this announcement</h2> <p>Qubes OS uses the <a href="https://wiki.xenproject.org/wiki/Xen_Project_Software_Overview">Xen hypervisor</a> as part of its <a href="/doc/architecture/">architecture</a>. When the <a href="https://xenproject.org/">Xen Project</a> publicly discloses a vulnerability in the Xen hypervisor, they issue a notice called a <a href="https://xenproject.org/developers/security-policy/">Xen security advisory (XSA)</a>. Vulnerabilities in the Xen hypervisor sometimes have security implications for Qubes OS. When they do, we issue a notice called a <a href="/security/qsb/">Qubes security bulletin (QSB)</a>. (QSBs are also issued for non-Xen vulnerabilities.) However, QSBs can provide only <em>positive</em> confirmation that certain XSAs <em>do</em> affect the security of Qubes OS. QSBs cannot provide <em>negative</em> confirmation that other XSAs do <em>not</em> affect the security of Qubes OS. Therefore, we also maintain an <a href="/security/xsa/">XSA tracker</a>, which is a comprehensive list of all XSAs publicly disclosed to date, including whether each one affects the security of Qubes OS. When new XSAs are published, we add them to the XSA tracker and publish a notice like this one in order to inform Qubes users that a new batch of XSAs has been released and whether each one affects the security of Qubes OS.</p>

We’re pleased to announce the stable release of Qubes OS 4.3.0! This minor release includes a host of new features, improvements, and bug fixes. The ISO and associated verification files are available on the downloads page. ## What’s new in Qubes 4.3? * Dom0 upgraded to Fedora 41 (#9402). * Xen upgraded to version 4.19 (#9420). * Default Fedora template upgraded to Fedora 42 (older versions not supported). * Default Debian template upgraded to Debian 13 (versions older than 12 not supported). * Default Whonix templates upgraded to Whonix 18 (older versions not supported). * Preloaded disposables (#1512) * Device “self-identity oriented” assignment (a.k.a. New Devices API) (#9325) * Qubes Windows Tools reintroduced with improved features (#1861). These are just a few highlights from the many changes included in this release. For a more comprehensive list of changes, see the Qubes OS 4.3 release notes. ## How to get Qubes OS 4.3.0 * If you’d like to install Qubes OS for the first time or perform a clean reinstallation on an existing system, there’s never been a better time to do so! Simply download the Qubes 4.3.0 ISO and follow our installation guide. * If you’re currently using Qubes 4.2, learn how to upgrade to Qubes 4.3. * If you’re currently using a Qubes 4.3 release candidate (RC), update normally (which includes upgrading any EOL templates and standalones you might have) in order to make your system effectively equivalent to the stable Qubes 4.3.0 release. No reinstallation or other special action is required. In all cases, we strongly recommend making a full backup beforehand. ## Known issues in Qubes OS 4.3.0 Templates restored in 4.3.0 from a pre-4.3 backup may continue to target their original Qubes OS release repos (#8701). After restoring such templates in 4.3.0, you must perform the following additional steps: sudo qubes-dom0-update -y qubes-dist-upgrade qubes-dist-upgrade --releasever=4.3 --template-standalone-upgrade -y This will automatically choose the templates that need to be updated. Fresh templates on a clean 4.3.0 installation are not affected. Users who perform an in-place upgrade from 4.2 to 4.3 (instead of restoring templates from a backup) are also not affected, since the in-place upgrade process already includes the above fix in stage 4. For more information, see issue #8701. View the full list of known bugs affecting Qubes 4.3 in our issue tracker. ## Support for older releases In accordance with our release support policy, Qubes 4.2 will remain supported for six months after the release of Qubes 4.3, until 2026-06-21. After that, Qubes 4.2 will no longer receive security updates or bug fixes. Whonix templates are created and supported by our partner, the Whonix Project. The Whonix Project has set its own support policy for Whonix templates in Qubes. For more information, see the Whonix Support Schedule. ## Thank you to our partners, donors, contributors, and testers! This release would not be possible without generous support from our partners and donors, as well as contributions from our active community members, especially bug reports from our testers. We are eternally grateful to our excellent community for making the Qubes OS Project a great example of open-source collaboration.

We have published Qubes Canary 045. The text of this canary and its accompanying cryptographic signatures are reproduced below. For an explanation of this announcement and instructions for authenticating this canary, please see the end of this announcement. ## Qubes Canary 045 ---===[ Qubes Canary 045 ]===--- Statements ----------- The Qubes security team members who have digitally signed this file [1] state the following: 1. The date of issue of this canary is December 10, 2025. 2. There have been 109 Qubes security bulletins published so far. 3. The Qubes Master Signing Key fingerprint is: 427F 11FD 0FAA 4B08 0123 F01C DDFA 1A3E 3687 9494 4. No warrants have ever been served to us with regard to the Qubes OS Project (e.g. to hand out the private signing keys or to introduce backdoors). 5. We plan to publish the next of these canary statements in the first fourteen days of March 2026. Special note should be taken if no new canary is published by that time or if the list of statements changes without plausible explanation. Special announcements ---------------------- None. Disclaimers and notes ---------------------- We would like to remind you that Qubes OS has been designed under the assumption that all relevant infrastructure is permanently compromised. This means that we assume NO trust in any of the servers or services which host or provide any Qubes-related data, in particular, software updates, source code repositories, and Qubes ISO downloads. This canary scheme is not infallible. Although signing the declaration makes it very difficult for a third party to produce arbitrary declarations, it does not prevent them from using force or other means, like blackmail or compromising the signers' laptops, to coerce us to produce false declarations. The proof of freshness provided below serves to demonstrate that this canary could not have been created prior to the date stated. It shows that a series of canaries was not created in advance. This declaration is merely a best effort and is provided without any guarantee or warranty. It is not legally binding in any way to anybody. None of the signers should be ever held legally responsible for any of the statements made here. Proof of freshness ------------------- Wed, 10 Dec 2025 01:14:56 +0000 Source: DER SPIEGEL - International (https://www.spiegel.de/international/index.rss) Confidential Conference on Ukraine Peace: "We Must Not Leave Ukraine and Volodymyr Alone with These Guys" Project 2025 Author: "We Won't Let Anyone Stop US from Using Our Oil and Gas" Remnants of the War: Syrians from Germany Helping with Reconstruction - But Remain Wary of Moving Back Germany's Queen Mum: Nostalgia for the Merkel Era Alive and Well Director Nadav Lapid on Israel after Gaza: It Was Our Duty to Scream Source: NYT > World News (https://rss.nytimes.com/services/xml/rss/nyt/World.xml) Hundreds of Thousands of Thais and Cambodians Flee Canada’s Northwest Territories Diamond Mines Are Closing Another Front in the War in Ukraine: Who Gets to Claim a Famed Artist? With Cheap Tickets and Lax Etiquette, a Theater Builds an Older Fan Base Between Pakistan and Afghanistan, a Trade War With No End in Sight Source: BBC News (https://feeds.bbci.co.uk/news/world/rss.xml) Trump criticises 'decaying' European countries and 'weak' leaders Nobel officials unsure when Peace Prize winner will arrive for ceremony Congress ups pressure to release boat strike video with threat to Hegseth's travel budget French feminists outraged by Brigitte Macron's comment about activists 'What's your name?' - Moment police confront Luigi Mangione at McDonald's Source: Blockchain.info 0000000000000000000028650dc7d328ea9c1b7e2b5376ce14089586c8ca3041 Footnotes ---------- [1] This file should be signed in two ways: (1) via detached PGP signatures by each of the signers, distributed together with this canary in the qubes-secpack.git repo, and (2) via digital signatures on the corresponding qubes-secpack.git repo tags. [2] [2] Don't just trust the contents of this file blindly! Verify the digital signatures! Instructions for doing so are documented here: https://www.qubes-os.org/security/pack/ -- The Qubes Security Team https://www.qubes-os.org/security/ Source: canary-045-2025.txt ## Marek Marczykowski-Górecki’s PGP signature -----BEGIN PGP SIGNATURE----- iQIzBAABCAAdFiEELRdx/k12ftx2sIn61lWk8hgw4GoFAmk4zrgACgkQ1lWk8hgw 4GpYrhAAiV6nfQk7dgKTljSSM2Bf22DFUl9+7eQOAV2ULbr+7G/CgRKMvezaYtgy X/0s2NZIXsJDTulhh2j9yAujZqlHv3xbSJuoA7lqo91jrFUr2qYpCadL91uBWcxk xkxBz5z01ApqHT8kgk/galfWqRj7f54A+YkmKHw3hynhMd+KaD10V3t2xBEW8a2X 7lsWRrhXGRVWsahDHgG5uZOA4spUlbRUiSlBkIo+ijeMQYxwu8CXQl3mwBeaI7jB /D/J9dNz8denRDknD1Fr8NvRFbKchL9S0ntAt3yvZqDLhwGX5J0bnEDpS2fDWi15 mDjLe7RtGfI77P9yjwvv/XXb64Mhdta5v4nXeKD+IdnM3IAmPvlkXDWvrNHA9jiF 31sYC0J0K/8qHniIZ61tjtPbTAMF7uXS5FSMnSt2xlhVsZEBXBN+4wKwVrSTCvwL 7H5zKWY0eWllf1Va3ez5rM9lCSkvWZAC/yDIqDZ2ZclxlKUOOCdHNOqBzjR1+Nex CyPrZ6wV/nDyVOpkZcMd+a7Q/brdT2zfELL39oeKDVv8w8+APC1wEbrTv56BvYVN TgCG62gLIdN/RwtwjjDR9IHB0rIH/x7Rimhsu5gHBUBSNtyIwwK/vIS3hKv1qvZI MxTVBDAZfZbJH1SwhioXChwTRsVXILZOFCTGgr3iltudNSn3uqY= =JXd7 -----END PGP SIGNATURE----- Source: canary-045-2025.txt.sig.marmarek ## Simon Gaiser (aka HW42)’s PGP signature -----BEGIN PGP SIGNATURE----- iQIzBAABCgAdFiEE6hjn8EDEHdrv6aoPSsGN4REuFJAFAmk5NNsACgkQSsGN4REu FJCT3hAAn0C8K0+3573tTDIcXnZU0SClejmgkmmeY1wgYktMysQKjw/T9FtkOt1f +e52uo2dwJ93Df+uJyQIvhd2UUA+p8yQtg8rA9svsOqiN6LfUO+hSTGPMUM63BSS T3YuaFEsO9ll31iOssmm3CaQj5ERUMIiGdHDgHbOx0hAMDPKjBRfshTt1IJ6OOc6 q4DGOgeXNiv6wvlKIgByA/d41K9prkXm/DQ95PfV2cGBPk5fw2DrM0ISij2eyGHk Z9r4BI15fj36OjtzfM+f1KMUeR/UDKtn4+tmVr/dLbEA9gRMcgy7Uzh1soKJcfyv L8TK9GMSzypKk1oJTojvoLPjU0CikNnEhr4YzsOpeJ0tYRC+oSM7anh84QR4coyZ jJxZLQnmIz3KUTOeJDoxuFguk2ItygRxxvYJuwMB3Y34dY1vP0TOOPHkEVhLllgK HPi+78al3YkjPctZ04UpbqoI2wnRSCpQcd8JH8hBhi57LnPfOkYeKpBQX6Q8gqtG RtwfB5cdrl7Y7EkZCbp/E+ieOt2MSzhwwyqAMsouQTnyuGcOdmZmu937Q03+kr9H VMOFrwrmgzYXSw7oUzD3TLIScWxGf2ZLacU4ShWa0HGi0z/tg7a2F4xiVJPzRuQ7 8gBi69St+rZfCUdmywvtpH11htMZZSFHddtFWUl+EwQoO59fGqI= =a3wa -----END PGP SIGNATURE----- Source: canary-045-2025.txt.sig.simon ## What is the purpose of this announcement? The purpose of this announcement is to inform the Qubes community that a new Qubes canary has been published. ## What is a Qubes canary? A Qubes canary is a security announcement periodically issued by the Qubes security team consisting of several statements to the effect that the signers of the canary have not been compromised. The idea is that, as long as signed canaries including such statements continue to be published, all is well. However, if the canaries should suddenly cease, if one or more signers begin declining to sign them, or if the included statements change significantly without plausible explanation, then this may indicate that something has gone wrong. The name originates from the practice in which miners would bring caged canaries into coal mines. If the level of methane gas in the mine reached a dangerous level, the canary would die, indicating to miners that they should evacuate. (See the Wikipedia article on warrant canaries for more information, but bear in mind that Qubes Canaries are not strictly limited to legal warrants.) ## Why should I care about canaries? Canaries provide an important indication about the security status of the project. If the canary is healthy, it’s a strong sign that things are running normally. However, if the canary is unhealthy, it could mean that the project or its members are being coerced in some way. ## What are some signs of an unhealthy canary? Here is a non-exhaustive list of examples: * **Dead canary.** In each canary, we state a window of time during which you should expect the next canary to be published. If no canary is published within that window of time and no good explanation is provided for missing the deadline, then the canary has died. * **Missing statement(s).** Canaries include a set of numbered statements at the top. These statements are generally the same across canaries, except for specific numbers and dates that have changed since the previous canary. If an important statement was present in older canaries but suddenly goes missing from new canaries with no correction or explanation, then this may be an indication that the signers can no longer truthfully make that statement. * **Missing signature(s).** Qubes canaries are signed by the members of the Qubes security team (see below). If one of them has been signing all canaries but suddenly and permanently stops signing new canaries without any explanation, then this may indicate that this person is under duress or can no longer truthfully sign the statements contained in the canary. ## Does every unexpected or unusual occurrence related to a canary indicate something bad? No, there are many canary-related possibilities that should _not_ worry you. Here is a non-exhaustive list of examples: * **Unusual reposts.** The only canaries that matter are the ones that are validly signed in the Qubes security pack (qubes-secpack). Reposts of canaries (like the one in this announcement) do not have any authority (except insofar as they reproduce validly-signed text from the qubes-secpack). If the actual canary in the qubes-secpack is healthy, but reposts are late, absent, or modified on the website, mailing lists, forum, or social media platforms, you should not be concerned about the canary. * **Last-minute signature(s).** If the canary is signed at the last minute but before the deadline, that’s okay. (People get busy and procrastinate sometimes.) * **Signatures at different times.** If one signature is earlier or later than the other, but both are present within a reasonable period of time, that’s okay. (For example, sometimes one signer is out of town, but we try to plan the deadlines around this.) * **Permitted changes.** If something about a canary changes without violating any of the statements in prior canaries, that’s okay. (For example, canaries are usually scheduled for the first fourteen days of a given month, but there’s no rule that says they have to be.) * **Unusual but planned changes.** If something unusual happens, but it was announced in advance, and the appropriate statements are signed, that’s okay (e.g., when Joanna left the security team and Simon joined it). In general, it would not be realistic for an organization to exist that never changed, had zero turnover, and never made mistakes. Therefore, it would be reasonable to expect such events to occur periodically, and it would be unreasonable to regard _every_ unusual or unexpected canary-related event as a sign of compromise. For example, if something usual happens with a canary, and we say it was a mistake and correct it (with valid signatures), you will have to decide for yourself whether it’s more likely that it really was just a mistake or that something is wrong and that this is how we chose to send you a subtle signal about it. This will require you to think carefully about which among many possible scenarios is most likely given the evidence available to you. Since this is fundamentally a matter of judgment, canaries are ultimately a _social_ scheme, not a technical one. ## What are the PGP signatures that accompany canaries? A PGP signature is a cryptographic digital signature made in accordance with the OpenPGP standard. PGP signatures can be cryptographically verified with programs like GNU Privacy Guard (GPG). The Qubes security team cryptographically signs all canaries so that Qubes users have a reliable way to check whether canaries are genuine. The only way to be certain that a canary is authentic is by verifying its PGP signatures. ## Why should I care whether a canary is authentic? If you fail to notice that a canary is unhealthy or has died, you may continue to trust the Qubes security team even after they have signaled via the canary (or lack thereof) that they been compromised or coerced. Alternatively, an adversary could fabricate a canary in an attempt to deceive the public. Such a canary would not be validly signed, but users who neglect to check the signatures on the fake canary would not be aware of this, so they may mistakenly believe it to be genuine, especially if it closely mimics the language of authentic canaries. Such falsified canaries could include manipulated text designed to sow fear, uncertainty, and doubt about the security of Qubes OS or the status of the Qubes OS Project. ## How do I verify the PGP signatures on a canary? The following command-line instructions assume a Linux system with `git` and `gpg` installed. (For Windows and Mac options, see OpenPGP software.) 1. Obtain the Qubes Master Signing Key (QMSK), e.g.: $ gpg --fetch-keys https://keys.qubes-os.org/keys/qubes-master-signing-key.asc gpg: directory '/home/user/.gnupg' created gpg: keybox '/home/user/.gnupg/pubring.kbx' created gpg: requesting key from 'https://keys.qubes-os.org/keys/qubes-master-signing-key.asc' gpg: /home/user/.gnupg/trustdb.gpg: trustdb created gpg: key DDFA1A3E36879494: public key "Qubes Master Signing Key" imported gpg: Total number processed: 1 gpg: imported: 1 (For more ways to obtain the QMSK, see How to import and authenticate the Qubes Master Signing Key.) 2. View the fingerprint of the PGP key you just imported. (Note: `gpg>` indicates a prompt inside of the GnuPG program. Type what appears after it when prompted.) $ gpg --edit-key 0x427F11FD0FAA4B080123F01CDDFA1A3E36879494 gpg (GnuPG) 2.2.27; Copyright (C) 2021 Free Software Foundation, Inc. This is free software: you are free to change and redistribute it. There is NO WARRANTY, to the extent permitted by law. pub rsa4096/DDFA1A3E36879494 created: 2010-04-01 expires: never usage: SC trust: unknown validity: unknown [ unknown] (1). Qubes Master Signing Key gpg> fpr pub rsa4096/DDFA1A3E36879494 2010-04-01 Qubes Master Signing Key Primary key fingerprint: 427F 11FD 0FAA 4B08 0123 F01C DDFA 1A3E 3687 9494 3. **Important:** At this point, you still don’t know whether the key you just imported is the genuine QMSK or a forgery. In order for this entire procedure to provide meaningful security benefits, you _must_ authenticate the QMSK out-of-band. **Do not skip this step!** The standard method is to obtain the QMSK fingerprint from _multiple independent sources in several different ways_ and check to see whether they match the key you just imported. For more information, see How to import and authenticate the Qubes Master Signing Key. **Tip:** After you have authenticated the QMSK out-of-band to your satisfaction, record the QMSK fingerprint in a safe place (or several) so that you don’t have to repeat this step in the future. 4. Once you are satisfied that you have the genuine QMSK, set its trust level to 5 (“ultimate”), then quit GnuPG with `q`. gpg> trust pub rsa4096/DDFA1A3E36879494 created: 2010-04-01 expires: never usage: SC trust: unknown validity: unknown [ unknown] (1). Qubes Master Signing Key Please decide how far you trust this user to correctly verify other users' keys (by looking at passports, checking fingerprints from different sources, etc.) 1 = I don't know or won't say 2 = I do NOT trust 3 = I trust marginally 4 = I trust fully 5 = I trust ultimately m = back to the main menu Your decision? 5 Do you really want to set this key to ultimate trust? (y/N) y pub rsa4096/DDFA1A3E36879494 created: 2010-04-01 expires: never usage: SC trust: ultimate validity: unknown [ unknown] (1). Qubes Master Signing Key Please note that the shown key validity is not necessarily correct unless you restart the program. gpg> q 5. Use Git to clone the qubes-secpack repo. $ git clone https://github.com/QubesOS/qubes-secpack.git Cloning into 'qubes-secpack'... remote: Enumerating objects: 4065, done. remote: Counting objects: 100% (1474/1474), done. remote: Compressing objects: 100% (742/742), done. remote: Total 4065 (delta 743), reused 1413 (delta 731), pack-reused 2591 Receiving objects: 100% (4065/4065), 1.64 MiB | 2.53 MiB/s, done. Resolving deltas: 100% (1910/1910), done. 6. Import the included PGP keys. (See our PGP key policies for important information about these keys.) $ gpg --import qubes-secpack/keys/*/* gpg: key 063938BA42CFA724: public key "Marek Marczykowski-Górecki (Qubes OS signing key)" imported gpg: qubes-secpack/keys/core-devs/retired: read error: Is a directory gpg: no valid OpenPGP data found. gpg: key 8C05216CE09C093C: 1 signature not checked due to a missing key gpg: key 8C05216CE09C093C: public key "HW42 (Qubes Signing Key)" imported gpg: key DA0434BC706E1FCF: public key "Simon Gaiser (Qubes OS signing key)" imported gpg: key 8CE137352A019A17: 2 signatures not checked due to missing keys gpg: key 8CE137352A019A17: public key "Andrew David Wong (Qubes Documentation Signing Key)" imported gpg: key AAA743B42FBC07A9: public key "Brennan Novak (Qubes Website & Documentation Signing)" imported gpg: key B6A0BB95CA74A5C3: public key "Joanna Rutkowska (Qubes Documentation Signing Key)" imported gpg: key F32894BE9684938A: public key "Marek Marczykowski-Górecki (Qubes Documentation Signing Key)" imported gpg: key 6E7A27B909DAFB92: public key "Hakisho Nukama (Qubes Documentation Signing Key)" imported gpg: key 485C7504F27D0A72: 1 signature not checked due to a missing key gpg: key 485C7504F27D0A72: public key "Sven Semmler (Qubes Documentation Signing Key)" imported gpg: key BB52274595B71262: public key "unman (Qubes Documentation Signing Key)" imported gpg: key DC2F3678D272F2A8: 1 signature not checked due to a missing key gpg: key DC2F3678D272F2A8: public key "Wojtek Porczyk (Qubes OS documentation signing key)" imported gpg: key FD64F4F9E9720C4D: 1 signature not checked due to a missing key gpg: key FD64F4F9E9720C4D: public key "Zrubi (Qubes Documentation Signing Key)" imported gpg: key DDFA1A3E36879494: "Qubes Master Signing Key" not changed gpg: key 1848792F9E2795E9: public key "Qubes OS Release 4 Signing Key" imported gpg: qubes-secpack/keys/release-keys/retired: read error: Is a directory gpg: no valid OpenPGP data found. gpg: key D655A4F21830E06A: public key "Marek Marczykowski-Górecki (Qubes security pack)" imported gpg: key ACC2602F3F48CB21: public key "Qubes OS Security Team" imported gpg: qubes-secpack/keys/security-team/retired: read error: Is a directory gpg: no valid OpenPGP data found. gpg: key 4AC18DE1112E1490: public key "Simon Gaiser (Qubes Security Pack signing key)" imported gpg: Total number processed: 17 gpg: imported: 16 gpg: unchanged: 1 gpg: marginals needed: 3 completes needed: 1 trust model: pgp gpg: depth: 0 valid: 1 signed: 6 trust: 0-, 0q, 0n, 0m, 0f, 1u gpg: depth: 1 valid: 6 signed: 0 trust: 6-, 0q, 0n, 0m, 0f, 0u 7. Verify signed Git tags. $ cd qubes-secpack/ $ git tag -v `git describe` object 266e14a6fae57c9a91362c9ac784d3a891f4d351 type commit tag marmarek_sec_266e14a6 tagger Marek Marczykowski-Górecki 1677757924 +0100 Tag for commit 266e14a6fae57c9a91362c9ac784d3a891f4d351 gpg: Signature made Thu 02 Mar 2023 03:52:04 AM PST gpg: using RSA key 2D1771FE4D767EDC76B089FAD655A4F21830E06A gpg: Good signature from "Marek Marczykowski-Górecki (Qubes security pack)" [full] The exact output will differ, but the final line should always start with `gpg: Good signature from...` followed by an appropriate key. The `[full]` indicates full trust, which this key inherits in virtue of being validly signed by the QMSK. 8. Verify PGP signatures, e.g.: $ cd QSBs/ $ gpg --verify qsb-087-2022.txt.sig.marmarek qsb-087-2022.txt gpg: Signature made Wed 23 Nov 2022 04:05:51 AM PST gpg: using RSA key 2D1771FE4D767EDC76B089FAD655A4F21830E06A gpg: Good signature from "Marek Marczykowski-Górecki (Qubes security pack)" [full] $ gpg --verify qsb-087-2022.txt.sig.simon qsb-087-2022.txt gpg: Signature made Wed 23 Nov 2022 03:50:42 AM PST gpg: using RSA key EA18E7F040C41DDAEFE9AA0F4AC18DE1112E1490 gpg: Good signature from "Simon Gaiser (Qubes Security Pack signing key)" [full] $ cd ../canaries/ $ gpg --verify canary-034-2023.txt.sig.marmarek canary-034-2023.txt gpg: Signature made Thu 02 Mar 2023 03:51:48 AM PST gpg: using RSA key 2D1771FE4D767EDC76B089FAD655A4F21830E06A gpg: Good signature from "Marek Marczykowski-Górecki (Qubes security pack)" [full] $ gpg --verify canary-034-2023.txt.sig.simon canary-034-2023.txt gpg: Signature made Thu 02 Mar 2023 01:47:52 AM PST gpg: using RSA key EA18E7F040C41DDAEFE9AA0F4AC18DE1112E1490 gpg: Good signature from "Simon Gaiser (Qubes Security Pack signing key)" [full] Again, the exact output will differ, but the final line of output from each `gpg --verify` command should always start with `gpg: Good signature from...` followed by an appropriate key. For this announcement (Qubes Canary 045), the commands are: $ gpg --verify canary-045-2025.txt.sig.marmarek canary-045-2025.txt $ gpg --verify canary-045-2025.txt.sig.simon canary-045-2025.txt You can also verify the signatures directly from this announcement in addition to or instead of verifying the files from the qubes-secpack. Simply copy and paste the Qubes Canary 045 text into a plain text file and do the same for both signature files. Then, perform the same authentication steps as listed above, substituting the filenames above with the names of the files you just created.

We’re pleased to announce that the fourth release candidate (RC) for Qubes OS 4.3.0 is now available for testing. This minor release includes many new features and improvements over Qubes OS 4.2. ## What’s new in Qubes 4.3? * Dom0 upgraded to Fedora 41 (#9402). * Xen upgraded to version 4.19 (#9420). * Default Fedora template upgraded to Fedora 42 (older versions not supported). * Default Debian template upgraded to Debian 13 (versions older than 12 not supported). * Default Whonix templates upgraded to Whonix 18 (upgraded from 17.4.3 in RC2; versions older than 18 no longer supported). * Preloaded disposables (#1512) * Device “self-identity oriented” assignment (a.k.a. New Devices API) (#9325) * Qubes Windows Tools reintroduced with improved features (#1861). These are just a few highlights from the many changes included in this release. For a more comprehensive list of changes, see the Qubes OS 4.3 release notes. ## When is the stable release? That depends on the number of bugs discovered in this RC and their severity. As explained in our release schedule documentation, our usual process after issuing a new RC is to collect bug reports, triage the bugs, and fix them. If warranted, we then issue a new RC that includes the fixes and repeat the process. We continue this iterative procedure until we’re left with an RC that’s good enough to be declared the stable release. No one can predict, at the outset, how many iterations will be required (and hence how many RCs will be needed before a stable release), but we tend to get a clearer picture of this as testing progresses. Barring any surprises uncovered by testing, we expect this fourth RC to be the final one, which means that we hope to declare this RC to be the stable 4.3.0 release at the conclusion of its testing period. ## How to test Qubes 4.3.0-rc4 Thanks to those who tested earlier 4.3 RCs and reported bugs they encountered, 4.3.0-rc4 now includes fixes for several bugs that were present in those prior RCs! If you’d like to help us test this RC, you can upgrade to Qubes 4.3.0-rc4 with either a clean installation or an in-place upgrade from Qubes 4.2. (Note for in-place upgrade testers: `qubes-dist-upgrade` now requires `--releasever=4.3` and may require `--enable-current-testing` for testing releases like this RC.) As always, we strongly recommend making a full backup beforehand and updating Qubes OS immediately afterward in order to apply all available bug fixes. If you’re currently using an earlier 4.3 RC and wish to update to 4.3.0-rc4, please update normally with `current-testing` enabled. If you use Whonix, please also upgrade from Whonix 17 to 18, if you have not already done so. Please help us improve the eventual stable release by reporting any bugs you encounter. If you’re an experienced user, we encourage you to join the testing team. ## Known issues in Qubes OS 4.3.0-rc4 It is possible that templates restored in 4.3.0-rc4 from a pre-4.3 backup may continue to target their original Qubes OS release repos. This does not affect fresh templates on a clean 4.3.0-rc4 installation. For more information, see issue #8701. View the full list of known bugs affecting Qubes 4.3 in our issue tracker. ## What’s a release candidate? A release candidate (RC) is a software build that has the potential to become a stable release, unless significant bugs are discovered in testing. RCs are intended for more advanced (or adventurous!) users who are comfortable testing early versions of software that are potentially buggier than stable releases. You can read more about Qubes OS supported releases and the version scheme in our documentation. ## What’s a minor release? The Qubes OS Project uses the semantic versioning standard. Version numbers are written as `major].minor].[patch]`. Hence, releases that increment the second value are known as “minor releases.” Minor releases generally include new features, improvements, and bug fixes that are backward-compatible with earlier versions of the same major release. See our [supported releases for a comprehensive list of major and minor releases and our [version scheme documentation for more information about how Qubes OS releases are versioned.

The Qubes OS Project will have a stand at FOSDEM 2026, which will take place in Brussels, Belgium on January 31 and February 1, 2026. FOSDEM is a top annual meeting for free and open source software developers. Entry is free, and no registration is required. If you attend, stop by and say hello!

Fedora 41 is currently scheduled to reach end of life (EOL) on 2025-11-19 (approximately two weeks from the date of this announcement). Please upgrade all of your Fedora templates and standalones by that date. For more information, see Upgrading to avoid EOL. There are two ways to upgrade a template to a new Fedora release: * **Recommended:** Install a new template to replace an existing one. This option is simpler for less experienced users, but it won’t preserve any modifications you’ve made to your template. After you install the new template, you’ll have to redo your desired template modifications (if any) and switch everything that was set to the old template to the new template. If you choose to modify your template, you may wish to write those modifications down so that you remember what to redo on each fresh install. To see a log of package manager actions, open a terminal in the old Fedora template and use the `dnf history` command. * **Advanced:** Perform an in-place upgrade of an existing Fedora template. This option will preserve any modifications you’ve made to the template, but it may be more complicated for less experienced users. Please note that no user action is required regarding the OS version in dom0 (see our note on dom0 and EOL).

New Debian 13 templates are now available for both Qubes OS 4.2 (stable) and Qubes OS 4.3 (release candidates) in standard, minimal, and Xfce varieties. There are two ways to upgrade a template to a new Debian release: * **Recommended:** Install a fresh template to replace the existing one. This option is simpler for less experienced users, but it won’t preserve any modifications you’ve made to your template. After you install the new template, you’ll have to redo your desired template modifications (if any) and switch everything that was set to the old template to the new template. If you choose to modify your template, you may wish to write those modifications down so that you remember what to redo on each fresh install. In the old Debian template, see `/var/log/dpkg.log` and `/var/log/apt/history.log` for logs of package manager actions. * **Advanced:** Perform an in-place upgrade of an existing Debian template. This option will preserve any modifications you’ve made to the template, but it may be more complicated for less experienced users. **Note:** No user action is required regarding the OS version in dom0 (see our note on dom0 and EOL).

We’re pleased to announce that the third release candidate (RC) for Qubes OS 4.3.0 is now available for testing. This minor release includes many new features and improvements over Qubes OS 4.2. ## What’s new in Qubes 4.3? * Dom0 upgraded to Fedora 41 (#9402). * Xen upgraded to version 4.19 (#9420). * Default Fedora template upgraded to Fedora 42 (versions older than 41 not supported). * Default Debian template upgraded to Debian 13 (versions older than 12 not supported). * Default Whonix templates upgraded to Whonix 18 (upgraded from 17.4.3 in RC2; versions older than 18 no longer supported). * Preloaded disposables (#1512) * Device “self-identity oriented” assignment (a.k.a. New Devices API) (#9325) * Qubes Windows Tools reintroduced with improved features (#1861). These are just a few highlights from the many changes included in this release. For a more comprehensive list of changes, see the Qubes OS 4.3 release notes. ## When is the stable release? That depends on the number of bugs discovered in this RC and their severity. As explained in our release schedule documentation, our usual process after issuing a new RC is to collect bug reports, triage the bugs, and fix them. If warranted, we then issue a new RC that includes the fixes and repeat the process. We continue this iterative procedure until we’re left with an RC that’s good enough to be declared the stable release. No one can predict, at the outset, how many iterations will be required (and hence how many RCs will be needed before a stable release), but we tend to get a clearer picture of this as testing progresses. At this time, we expect that there will likely be a fourth release candidate, which will probably be the final one. ## How to test Qubes 4.3.0-rc3 Thanks to those who tested earlier 4.3 RCs and reported bugs they encountered, 4.3.0-rc3 now includes fixes for several bugs that were present in those prior RCs! If you’d like to help us test this RC, you can upgrade to Qubes 4.3.0-rc3 with either a clean installation or an in-place upgrade from Qubes 4.2. (Note for in-place upgrade testers: `qubes-dist-upgrade` now requires `--releasever=4.3` and may require `--enable-current-testing` for testing releases like this RC.) As always, we strongly recommend making a full backup beforehand and updating Qubes OS immediately afterward in order to apply all available bug fixes. If you’re currently using an earlier 4.3 RC and wish to update to 4.3.0-rc3, please update normally with `current-testing` enabled. If you use Whonix, please also upgrade from Whonix 17 to 18. Please help us improve the eventual stable release by reporting any bugs you encounter. If you’re an experienced user, we encourage you to join the testing team. ## Known issues in Qubes OS 4.3.0-rc3 It is possible that templates restored in 4.3.0-rc3 from a pre-4.3 backup may continue to target their original Qubes OS release repos. This does not affect fresh templates on a clean 4.3.0-rc3 installation. For more information, see issue #8701. View the full list of known bugs affecting Qubes 4.3 in our issue tracker. ## What’s a release candidate? A release candidate (RC) is a software build that has the potential to become a stable release, unless significant bugs are discovered in testing. RCs are intended for more advanced (or adventurous!) users who are comfortable testing early versions of software that are potentially buggier than stable releases. You can read more about Qubes OS supported releases and the version scheme in our documentation. ## What’s a minor release? The Qubes OS Project uses the semantic versioning standard. Version numbers are written as `major].minor].[patch]`. Hence, releases that increment the second value are known as “minor releases.” Minor releases generally include new features, improvements, and bug fixes that are backward-compatible with earlier versions of the same major release. See our [supported releases for a comprehensive list of major and minor releases and our [version scheme documentation for more information about how Qubes OS releases are versioned.

The Xen Project has released one or more Xen security advisories (XSAs). The security of Qubes OS is **not** affected. ## XSAs that DO affect the security of Qubes OS The following XSAs **do affect** the security of Qubes OS: * (none) ## XSAs that DO NOT affect the security of Qubes OS The following XSAs **do not affect** the security of Qubes OS, and no user action is necessary: * XSA-476 * Qubes OS does not hot unplug PCI devices. ## About this announcement Qubes OS uses the Xen hypervisor as part of its architecture. When the Xen Project publicly discloses a vulnerability in the Xen hypervisor, they issue a notice called a Xen security advisory (XSA). Vulnerabilities in the Xen hypervisor sometimes have security implications for Qubes OS. When they do, we issue a notice called a Qubes security bulletin (QSB). (QSBs are also issued for non-Xen vulnerabilities.) However, QSBs can provide only _positive_ confirmation that certain XSAs _do_ affect the security of Qubes OS. QSBs cannot provide _negative_ confirmation that other XSAs do _not_ affect the security of Qubes OS. Therefore, we also maintain an XSA tracker, which is a comprehensive list of all XSAs publicly disclosed to date, including whether each one affects the security of Qubes OS. When new XSAs are published, we add them to the XSA tracker and publish a notice like this one in order to inform Qubes users that a new batch of XSAs has been released and whether each one affects the security of Qubes OS.

The Xen Project has released one or more Xen security advisories (XSAs). The security of Qubes OS is **not** affected. ## XSAs that DO affect the security of Qubes OS The following XSAs **do affect** the security of Qubes OS: * (none) ## XSAs that DO NOT affect the security of Qubes OS The following XSAs **do not affect** the security of Qubes OS, and no user action is necessary: * XSA-475 * Due to a bug, Viridian extensions are currently not enabled in Qubes OS. Although Viridian extensions are enabled in our libvirt config, this setting is mostly ignored by libvirt. While it is used when libvirt converts the XML config to the xl config format, it is _not_ used when actually creating a VM. Advanced users who wish to confirm this on their own systems may do so by executing the command `sudo xl list -l <NAME_OF_HVM>` in dom0 and noting the absence of a `"viridian": true` line. ## About this announcement Qubes OS uses the Xen hypervisor as part of its architecture. When the Xen Project publicly discloses a vulnerability in the Xen hypervisor, they issue a notice called a Xen security advisory (XSA). Vulnerabilities in the Xen hypervisor sometimes have security implications for Qubes OS. When they do, we issue a notice called a Qubes security bulletin (QSB). (QSBs are also issued for non-Xen vulnerabilities.) However, QSBs can provide only _positive_ confirmation that certain XSAs _do_ affect the security of Qubes OS. QSBs cannot provide _negative_ confirmation that other XSAs do _not_ affect the security of Qubes OS. Therefore, we also maintain an XSA tracker, which is a comprehensive list of all XSAs publicly disclosed to date, including whether each one affects the security of Qubes OS. When new XSAs are published, we add them to the XSA tracker and publish a notice like this one in order to inform Qubes users that a new batch of XSAs has been released and whether each one affects the security of Qubes OS.

Qubes OS Summit 2025 has concluded! Thank you to our sponsors, presenters, attendees, and organizers for making this year’s summit a success! If you missed the summit, or if you’d like to review any of the presentations, live stream recordings from this year’s summit are available below. Presentation descriptions and slides are available on the Qubes OS Summit 2025 Schedule. ## Qubes OS Summit 2025: Day 1 playlist ## Qubes OS Summit 2025: Day 2 playlist

We’re pleased to announce that the second release candidate (RC) for Qubes OS 4.3.0 is now available for testing. This minor release includes many new features and improvements over Qubes OS 4.2. ## What’s new in Qubes 4.3? * Dom0 upgraded to Fedora 41 (#9402). * Xen upgraded to version 4.19 (#9420). * Default Fedora template upgraded to Fedora 42 (versions older than release 41 not supported). * Default Debian template upgraded to Debian 13 (versions older than release 12 not supported). * Default Whonix templates upgraded to Whonix 17.4.3 (versions older than release 17 not supported). * Preloaded disposables (#1512) * Device “self-identity oriented” assignment (a.k.a. New Devices API) (#9325) * Qubes Windows Tools reintroduced with improved features (#1861). These are just a few highlights from the many changes included in this release. For a more comprehensive list of changes, see the Qubes OS 4.3 release notes. ## When is the stable release? That depends on the number of bugs discovered in this RC and their severity. As explained in our release schedule documentation, our usual process after issuing a new RC is to collect bug reports, triage the bugs, and fix them. If warranted, we then issue a new RC that includes the fixes and repeat the process. We continue this iterative procedure until we’re left with an RC that’s good enough to be declared the stable release. No one can predict, at the outset, how many iterations will be required (and hence how many RCs will be needed before a stable release), but we tend to get a clearer picture of this as testing progresses. At this time, we expect that there will likely be a third release candidate. ## How to test Qubes 4.3.0-rc2 Thanks to those who tested 4.3.0-rc1 and reported bugs they encountered, 4.3.0-rc2 now includes fixes for several bugs that were present in the first release candidate! If you’d like to help us test this release candidate, you can upgrade to Qubes 4.3.0-rc2 with either a clean installation or an in-place upgrade from Qubes 4.2. (Note for in-place upgrade testers: `qubes-dist-upgrade` now requires `--releasever=4.3` and may require `--enable-current-testing` for testing releases like this RC.) As always, we strongly recommend making a full backup beforehand and updating Qubes OS immediately afterward in order to apply all available bug fixes. Existing 4.3.0-rc1 users can update normally with `current-testing` enabled in order to make their systems effectively equivalent to 4.3.0-rc2. Please help us improve the eventual stable release by reporting any bugs you encounter. If you’re an experienced user, we encourage you to join the testing team. ## Known issues in Qubes OS 4.3.0-rc2 It is possible that templates restored in 4.3.0-rc2 from a pre-4.3 backup may continue to target their original Qubes OS release repos. This does not affect fresh templates on a clean 4.3.0-rc2 installation. For more information, see issue #8701. View the full list of known bugs affecting Qubes 4.3 in our issue tracker. ## What’s a release candidate? A release candidate (RC) is a software build that has the potential to become a stable release, unless significant bugs are discovered in testing. RCs are intended for more advanced (or adventurous!) users who are comfortable testing early versions of software that are potentially buggier than stable releases. You can read more about Qubes OS supported releases and the version scheme in our documentation. ## What’s a minor release? The Qubes OS Project uses the semantic versioning standard. Version numbers are written as `major].minor].[patch]`. Hence, releases that increment the second value are known as “minor releases.” Minor releases generally include new features, improvements, and bug fixes that are backward-compatible with earlier versions of the same major release. See our [supported releases for a comprehensive list of major and minor releases and our [version scheme documentation for more information about how Qubes OS releases are versioned.

The migration of the Qubes documentation to Read the Docs is now complete! As of today, the new documentation hosted by Read the Docs has officially replaced the old documentation, and all old documentation URLs will automatically redirect to their new counterparts at https://doc.qubes-os.org from now on. We’re incredibly grateful to the Qubes community for making this migration a success. Special thanks go to parulin and tokideveloper for reviewing the new documentation during our 20-day community testing period, to maiska for managing the migration, and to Solène Rapenne for helping to push the merge through the final stretch. In addition, maiska has provided us with an updated guide for how to edit the documentation and a new reStructuredText documentation style guide! If you’d like to request any features or improvements to the documentation, or if you’d like to report a bug, please open an issue. If you have any questions or feedback, please let us know on our mailing lists or forum.

The Xen Project has released one or more Xen security advisories (XSAs). The security of Qubes OS is **not** affected. ## XSAs that DO affect the security of Qubes OS The following XSAs **do affect** the security of Qubes OS: * (none) ## XSAs that DO NOT affect the security of Qubes OS The following XSAs **do not affect** the security of Qubes OS, and no user action is necessary: * XSA-472 * Due to a bug, Viridian extensions are currently not enabled in Qubes OS. Although Viridian extensions are enabled in our libvirt config, this setting is mostly ignored by libvirt. While it is used when libvirt converts the XML config to the xl config format, it is _not_ used when actually creating a VM. Advanced users who wish to confirm this on their own systems may do so with the command `sudo xl list -l <NAME_OF_HVM>` in dom0. * XSA-473 * This XSA affects only ARM devices. Qubes OS does not currently support ARM devices. * XSA-474 * This XSA affects only XAPI, which is an alternative toolstack. Qubes OS uses libxl instead of XAPI. ## About this announcement Qubes OS uses the Xen hypervisor as part of its architecture. When the Xen Project publicly discloses a vulnerability in the Xen hypervisor, they issue a notice called a Xen security advisory (XSA). Vulnerabilities in the Xen hypervisor sometimes have security implications for Qubes OS. When they do, we issue a notice called a Qubes security bulletin (QSB). (QSBs are also issued for non-Xen vulnerabilities.) However, QSBs can provide only _positive_ confirmation that certain XSAs _do_ affect the security of Qubes OS. QSBs cannot provide _negative_ confirmation that other XSAs do _not_ affect the security of Qubes OS. Therefore, we also maintain an XSA tracker, which is a comprehensive list of all XSAs publicly disclosed to date, including whether each one affects the security of Qubes OS. When new XSAs are published, we add them to the XSA tracker and publish a notice like this one in order to inform Qubes users that a new batch of XSAs has been released and whether each one affects the security of Qubes OS.

We have published Qubes Canary 044. The text of this canary and its accompanying cryptographic signatures are reproduced below. For an explanation of this announcement and instructions for authenticating this canary, please see the end of this announcement. ## Qubes Canary 044 ---===[ Qubes Canary 044 ]===--- Statements ----------- The Qubes security team members who have digitally signed this file [1] state the following: 1. The date of issue of this canary is September 02, 2025. 2. There have been 109 Qubes security bulletins published so far. 3. The Qubes Master Signing Key fingerprint is: 427F 11FD 0FAA 4B08 0123 F01C DDFA 1A3E 3687 9494 4. No warrants have ever been served to us with regard to the Qubes OS Project (e.g. to hand out the private signing keys or to introduce backdoors). 5. We plan to publish the next of these canary statements in the first fourteen days of December 2025. Special note should be taken if no new canary is published by that time or if the list of statements changes without plausible explanation. Special announcements ---------------------- None. Disclaimers and notes ---------------------- We would like to remind you that Qubes OS has been designed under the assumption that all relevant infrastructure is permanently compromised. This means that we assume NO trust in any of the servers or services which host or provide any Qubes-related data, in particular, software updates, source code repositories, and Qubes ISO downloads. This canary scheme is not infallible. Although signing the declaration makes it very difficult for a third party to produce arbitrary declarations, it does not prevent them from using force or other means, like blackmail or compromising the signers' laptops, to coerce us to produce false declarations. The proof of freshness provided below serves to demonstrate that this canary could not have been created prior to the date stated. It shows that a series of canaries was not created in advance. This declaration is merely a best effort and is provided without any guarantee or warranty. It is not legally binding in any way to anybody. None of the signers should be ever held legally responsible for any of the statements made here. Proof of freshness ------------------- Tue, 02 Sep 2025 10:14:02 +0000 Source: DER SPIEGEL - International (https://www.spiegel.de/international/index.rss) Rugby: "What Is Going On in My Head?!" Ex Professional Alix Popham Opens Up about His Damaged Brain Photographing the Suffering in Gaza: A Palestinian Photojournalist Finds Himself at the Center of Controversy Secret Documents from the 1990s: How Close Was Russia to NATO Membership? "Have We Done It?": How Is Germany Doing 10 Years after the Refugee Crisis? Merz Under Fire: German Conservatives Roiled by Chancellor's Decision on Arms for Israel Source: NYT > World News (https://rss.nytimes.com/services/xml/rss/nyt/World.xml) Putin Finds a Growing Embrace on the Global Stage Xi’s Parade to Showcase China’s Military Might and Circle of Autocrats Ukraine Pursues a Weapons Buildup More Potent Than Any Security Guarantee How Jair Bolsonaro Tried, and Failed, to Stage a Coup in Brazil Landslide Kills More Than 1,000 People in Sudan, Rebel Group Says Source: BBC News (https://feeds.bbci.co.uk/news/world/rss.xml) Russia's Putin hails 'unprecedented' ties with China at talks in Beijing Beijing tightens control ahead of Xi's big moment on world stage Aerial search for survivors after Afghan quake kills 800 people Hundreds killed in Sudan landslide, UN says Body seen in secret mortuary could solve 50-year mystery of vanished religious leader Source: Blockchain.info 00000000000000000001850c13d0c4fbfa4c41b6cfaa598c032820713209a633 Footnotes ---------- [1] This file should be signed in two ways: (1) via detached PGP signatures by each of the signers, distributed together with this canary in the qubes-secpack.git repo, and (2) via digital signatures on the corresponding qubes-secpack.git repo tags. [2] [2] Don't just trust the contents of this file blindly! Verify the digital signatures! Instructions for doing so are documented here: https://www.qubes-os.org/security/pack/ -- The Qubes Security Team https://www.qubes-os.org/security/ Source: canary-044-2025.txt ## Marek Marczykowski-Górecki’s PGP signature -----BEGIN PGP SIGNATURE----- iQIzBAABCAAdFiEELRdx/k12ftx2sIn61lWk8hgw4GoFAmi2xfMACgkQ1lWk8hgw 4GrNxQ/+JC6CQzhPlnWqIHMVYhioKAMf/dXICnOa3nf8V7M6HLpcR+AMlanS0dIo uHyBNyga9fm93T7wXm3n2dbEqGSCVhyhE0napSkemg6zmrHXESgGJoutZN+WxQ37 w6eLbI6fAsDAbXqEoyDRcf+QekgjwX0XRu5J+aSyJlp3uYMr0E9M3PuP2vqco85m MIkh8O9aYi3tC5CIr5UrpKZj+mWAq1KXG+oEB0C/+7u8WFTOJ5M6896EM7CgK58T f1K5BpwFbexK/VtLvOb89YI95AjvRQ9B5JA5CC+xbrKRumDPBlIN9W8MVy0scQ3e 3eHKr++yC4iZgwx/BR1Vlebucq6EQfKbDxZ6nAdj06QS+xv0Th3UL6TrMrvbP2Fw 1GFid7DwVa9HSHCfs8aV4WjAgOs0z0Wysj3duBxDeSfNjV5Qdw7MZz1opwEKGfVu bL7UchEXWP2n/+JumzhnfCnRGn4l+SSJLrFwA8VehuJwE0SC2dTwYyQ0YKPHPZcU wgFZoH+kHYKHxEiBZ8rS+T9jcBp+5Vi3Vssfr4dUt8TZe3oumYRm7HxC0cwSaCY6 VToaIgFDF6FCmtrjwvbMs1BF3bpR2TN71wKLtxg7K+RqgQsP7fLgzsmA8AUn2Uj4 8VAz1FVs4TzNpoA5dCz5cp6ygJnanMrDednNx6xYZIk5x9+Rqgc= =x5Dc -----END PGP SIGNATURE----- Source: canary-044-2025.txt.sig.marmarek ## Simon Gaiser (aka HW42)’s PGP signature -----BEGIN PGP SIGNATURE----- iQIzBAABCgAdFiEE6hjn8EDEHdrv6aoPSsGN4REuFJAFAmi2198ACgkQSsGN4REu FJBFcxAAh2DCz4XIZGdZX0vcbJct3dub84HDZlOTiTW9tB4Pmgej93Aq7RFfQMA/ 3428txM1p7b/9CF0XMP9AOajp6/Cc5ErdDxfBDrMADgLQLDO/O+2t4HcP0fdjNh9 FO7nCDSPMBokHnLmG8o/pHSoKufPDx9RaEpIcTEsOGz0RtMpvPawi9yji7+qmsuX FR27XbZe1JekU7Zr+IOt07dMPqGHMVo47pT/R/ureRPgul7fjJsdAy2OsTXdxsSE /x+vYs3u8F5PrmHEKGHNaLY0YPMkMIHEw0cf+5aXkpLeeNTJh+jmTzyK8eL6+ZVj cLrJyQ3ONAjALCf0h6PfyLJf4jTJFg2F6PJVofN4VFdBMH9QHaWgQbVI4/69soQi Y3j8z5j7hzerdE3zu+FFs5hQJV+nSoT2qLOKROTqjUrl6abSmnSaIeIADjgLK9Pk vIyMypWixiPgkRjLwEoAt6wHhXhS9yPmmjkNkpeuwVp/EKokdG8nUemZHQjMMAeO PtMlCpR8+CscNva7Uwv4f8JHM77dDBwaKnQTcFNthNfBr5MSZbGHUOBDyMn8675K tlylkF7qpx0TywkiiCqYvCfNqgedF2tDYANN6/xFFFjcgZ3+BUrzcl8kQHToMmBA koFWD39lSuvuMOLtOZZ+YDCXBbs1D2qkrfDx68+Mo0zSy5cWbPo= =XUVz -----END PGP SIGNATURE----- Source: canary-044-2025.txt.sig.simon ## What is the purpose of this announcement? The purpose of this announcement is to inform the Qubes community that a new Qubes canary has been published. ## What is a Qubes canary? A Qubes canary is a security announcement periodically issued by the Qubes security team consisting of several statements to the effect that the signers of the canary have not been compromised. The idea is that, as long as signed canaries including such statements continue to be published, all is well. However, if the canaries should suddenly cease, if one or more signers begin declining to sign them, or if the included statements change significantly without plausible explanation, then this may indicate that something has gone wrong. The name originates from the practice in which miners would bring caged canaries into coal mines. If the level of methane gas in the mine reached a dangerous level, the canary would die, indicating to miners that they should evacuate. (See the Wikipedia article on warrant canaries for more information, but bear in mind that Qubes Canaries are not strictly limited to legal warrants.) ## Why should I care about canaries? Canaries provide an important indication about the security status of the project. If the canary is healthy, it’s a strong sign that things are running normally. However, if the canary is unhealthy, it could mean that the project or its members are being coerced in some way. ## What are some signs of an unhealthy canary? Here is a non-exhaustive list of examples: * **Dead canary.** In each canary, we state a window of time during which you should expect the next canary to be published. If no canary is published within that window of time and no good explanation is provided for missing the deadline, then the canary has died. * **Missing statement(s).** Canaries include a set of numbered statements at the top. These statements are generally the same across canaries, except for specific numbers and dates that have changed since the previous canary. If an important statement was present in older canaries but suddenly goes missing from new canaries with no correction or explanation, then this may be an indication that the signers can no longer truthfully make that statement. * **Missing signature(s).** Qubes canaries are signed by the members of the Qubes security team (see below). If one of them has been signing all canaries but suddenly and permanently stops signing new canaries without any explanation, then this may indicate that this person is under duress or can no longer truthfully sign the statements contained in the canary. ## Does every unexpected or unusual occurrence related to a canary indicate something bad? No, there are many canary-related possibilities that should _not_ worry you. Here is a non-exhaustive list of examples: * **Unusual reposts.** The only canaries that matter are the ones that are validly signed in the Qubes security pack (qubes-secpack). Reposts of canaries (like the one in this announcement) do not have any authority (except insofar as they reproduce validly-signed text from the qubes-secpack). If the actual canary in the qubes-secpack is healthy, but reposts are late, absent, or modified on the website, mailing lists, forum, or social media platforms, you should not be concerned about the canary. * **Last-minute signature(s).** If the canary is signed at the last minute but before the deadline, that’s okay. (People get busy and procrastinate sometimes.) * **Signatures at different times.** If one signature is earlier or later than the other, but both are present within a reasonable period of time, that’s okay. (For example, sometimes one signer is out of town, but we try to plan the deadlines around this.) * **Permitted changes.** If something about a canary changes without violating any of the statements in prior canaries, that’s okay. (For example, canaries are usually scheduled for the first fourteen days of a given month, but there’s no rule that says they have to be.) * **Unusual but planned changes.** If something unusual happens, but it was announced in advance, and the appropriate statements are signed, that’s okay (e.g., when Joanna left the security team and Simon joined it). In general, it would not be realistic for an organization to exist that never changed, had zero turnover, and never made mistakes. Therefore, it would be reasonable to expect such events to occur periodically, and it would be unreasonable to regard _every_ unusual or unexpected canary-related event as a sign of compromise. For example, if something usual happens with a canary, and we say it was a mistake and correct it (with valid signatures), you will have to decide for yourself whether it’s more likely that it really was just a mistake or that something is wrong and that this is how we chose to send you a subtle signal about it. This will require you to think carefully about which among many possible scenarios is most likely given the evidence available to you. Since this is fundamentally a matter of judgment, canaries are ultimately a _social_ scheme, not a technical one. ## What are the PGP signatures that accompany canaries? A PGP signature is a cryptographic digital signature made in accordance with the OpenPGP standard. PGP signatures can be cryptographically verified with programs like GNU Privacy Guard (GPG). The Qubes security team cryptographically signs all canaries so that Qubes users have a reliable way to check whether canaries are genuine. The only way to be certain that a canary is authentic is by verifying its PGP signatures. ## Why should I care whether a canary is authentic? If you fail to notice that a canary is unhealthy or has died, you may continue to trust the Qubes security team even after they have signaled via the canary (or lack thereof) that they been compromised or coerced. Alternatively, an adversary could fabricate a canary in an attempt to deceive the public. Such a canary would not be validly signed, but users who neglect to check the signatures on the fake canary would not be aware of this, so they may mistakenly believe it to be genuine, especially if it closely mimics the language of authentic canaries. Such falsified canaries could include manipulated text designed to sow fear, uncertainty, and doubt about the security of Qubes OS or the status of the Qubes OS Project. ## How do I verify the PGP signatures on a canary? The following command-line instructions assume a Linux system with `git` and `gpg` installed. (For Windows and Mac options, see OpenPGP software.) 1. Obtain the Qubes Master Signing Key (QMSK), e.g.: $ gpg --fetch-keys https://keys.qubes-os.org/keys/qubes-master-signing-key.asc gpg: directory '/home/user/.gnupg' created gpg: keybox '/home/user/.gnupg/pubring.kbx' created gpg: requesting key from 'https://keys.qubes-os.org/keys/qubes-master-signing-key.asc' gpg: /home/user/.gnupg/trustdb.gpg: trustdb created gpg: key DDFA1A3E36879494: public key "Qubes Master Signing Key" imported gpg: Total number processed: 1 gpg: imported: 1 (For more ways to obtain the QMSK, see How to import and authenticate the Qubes Master Signing Key.) 2. View the fingerprint of the PGP key you just imported. (Note: `gpg>` indicates a prompt inside of the GnuPG program. Type what appears after it when prompted.) $ gpg --edit-key 0x427F11FD0FAA4B080123F01CDDFA1A3E36879494 gpg (GnuPG) 2.2.27; Copyright (C) 2021 Free Software Foundation, Inc. This is free software: you are free to change and redistribute it. There is NO WARRANTY, to the extent permitted by law. pub rsa4096/DDFA1A3E36879494 created: 2010-04-01 expires: never usage: SC trust: unknown validity: unknown [ unknown] (1). Qubes Master Signing Key gpg> fpr pub rsa4096/DDFA1A3E36879494 2010-04-01 Qubes Master Signing Key Primary key fingerprint: 427F 11FD 0FAA 4B08 0123 F01C DDFA 1A3E 3687 9494 3. **Important:** At this point, you still don’t know whether the key you just imported is the genuine QMSK or a forgery. In order for this entire procedure to provide meaningful security benefits, you _must_ authenticate the QMSK out-of-band. **Do not skip this step!** The standard method is to obtain the QMSK fingerprint from _multiple independent sources in several different ways_ and check to see whether they match the key you just imported. For more information, see How to import and authenticate the Qubes Master Signing Key. **Tip:** After you have authenticated the QMSK out-of-band to your satisfaction, record the QMSK fingerprint in a safe place (or several) so that you don’t have to repeat this step in the future. 4. Once you are satisfied that you have the genuine QMSK, set its trust level to 5 (“ultimate”), then quit GnuPG with `q`. gpg> trust pub rsa4096/DDFA1A3E36879494 created: 2010-04-01 expires: never usage: SC trust: unknown validity: unknown [ unknown] (1). Qubes Master Signing Key Please decide how far you trust this user to correctly verify other users' keys (by looking at passports, checking fingerprints from different sources, etc.) 1 = I don't know or won't say 2 = I do NOT trust 3 = I trust marginally 4 = I trust fully 5 = I trust ultimately m = back to the main menu Your decision? 5 Do you really want to set this key to ultimate trust? (y/N) y pub rsa4096/DDFA1A3E36879494 created: 2010-04-01 expires: never usage: SC trust: ultimate validity: unknown [ unknown] (1). Qubes Master Signing Key Please note that the shown key validity is not necessarily correct unless you restart the program. gpg> q 5. Use Git to clone the qubes-secpack repo. $ git clone https://github.com/QubesOS/qubes-secpack.git Cloning into 'qubes-secpack'... remote: Enumerating objects: 4065, done. remote: Counting objects: 100% (1474/1474), done. remote: Compressing objects: 100% (742/742), done. remote: Total 4065 (delta 743), reused 1413 (delta 731), pack-reused 2591 Receiving objects: 100% (4065/4065), 1.64 MiB | 2.53 MiB/s, done. Resolving deltas: 100% (1910/1910), done. 6. Import the included PGP keys. (See our PGP key policies for important information about these keys.) $ gpg --import qubes-secpack/keys/*/* gpg: key 063938BA42CFA724: public key "Marek Marczykowski-Górecki (Qubes OS signing key)" imported gpg: qubes-secpack/keys/core-devs/retired: read error: Is a directory gpg: no valid OpenPGP data found. gpg: key 8C05216CE09C093C: 1 signature not checked due to a missing key gpg: key 8C05216CE09C093C: public key "HW42 (Qubes Signing Key)" imported gpg: key DA0434BC706E1FCF: public key "Simon Gaiser (Qubes OS signing key)" imported gpg: key 8CE137352A019A17: 2 signatures not checked due to missing keys gpg: key 8CE137352A019A17: public key "Andrew David Wong (Qubes Documentation Signing Key)" imported gpg: key AAA743B42FBC07A9: public key "Brennan Novak (Qubes Website & Documentation Signing)" imported gpg: key B6A0BB95CA74A5C3: public key "Joanna Rutkowska (Qubes Documentation Signing Key)" imported gpg: key F32894BE9684938A: public key "Marek Marczykowski-Górecki (Qubes Documentation Signing Key)" imported gpg: key 6E7A27B909DAFB92: public key "Hakisho Nukama (Qubes Documentation Signing Key)" imported gpg: key 485C7504F27D0A72: 1 signature not checked due to a missing key gpg: key 485C7504F27D0A72: public key "Sven Semmler (Qubes Documentation Signing Key)" imported gpg: key BB52274595B71262: public key "unman (Qubes Documentation Signing Key)" imported gpg: key DC2F3678D272F2A8: 1 signature not checked due to a missing key gpg: key DC2F3678D272F2A8: public key "Wojtek Porczyk (Qubes OS documentation signing key)" imported gpg: key FD64F4F9E9720C4D: 1 signature not checked due to a missing key gpg: key FD64F4F9E9720C4D: public key "Zrubi (Qubes Documentation Signing Key)" imported gpg: key DDFA1A3E36879494: "Qubes Master Signing Key" not changed gpg: key 1848792F9E2795E9: public key "Qubes OS Release 4 Signing Key" imported gpg: qubes-secpack/keys/release-keys/retired: read error: Is a directory gpg: no valid OpenPGP data found. gpg: key D655A4F21830E06A: public key "Marek Marczykowski-Górecki (Qubes security pack)" imported gpg: key ACC2602F3F48CB21: public key "Qubes OS Security Team" imported gpg: qubes-secpack/keys/security-team/retired: read error: Is a directory gpg: no valid OpenPGP data found. gpg: key 4AC18DE1112E1490: public key "Simon Gaiser (Qubes Security Pack signing key)" imported gpg: Total number processed: 17 gpg: imported: 16 gpg: unchanged: 1 gpg: marginals needed: 3 completes needed: 1 trust model: pgp gpg: depth: 0 valid: 1 signed: 6 trust: 0-, 0q, 0n, 0m, 0f, 1u gpg: depth: 1 valid: 6 signed: 0 trust: 6-, 0q, 0n, 0m, 0f, 0u 7. Verify signed Git tags. $ cd qubes-secpack/ $ git tag -v `git describe` object 266e14a6fae57c9a91362c9ac784d3a891f4d351 type commit tag marmarek_sec_266e14a6 tagger Marek Marczykowski-Górecki 1677757924 +0100 Tag for commit 266e14a6fae57c9a91362c9ac784d3a891f4d351 gpg: Signature made Thu 02 Mar 2023 03:52:04 AM PST gpg: using RSA key 2D1771FE4D767EDC76B089FAD655A4F21830E06A gpg: Good signature from "Marek Marczykowski-Górecki (Qubes security pack)" [full] The exact output will differ, but the final line should always start with `gpg: Good signature from...` followed by an appropriate key. The `[full]` indicates full trust, which this key inherits in virtue of being validly signed by the QMSK. 8. Verify PGP signatures, e.g.: $ cd QSBs/ $ gpg --verify qsb-087-2022.txt.sig.marmarek qsb-087-2022.txt gpg: Signature made Wed 23 Nov 2022 04:05:51 AM PST gpg: using RSA key 2D1771FE4D767EDC76B089FAD655A4F21830E06A gpg: Good signature from "Marek Marczykowski-Górecki (Qubes security pack)" [full] $ gpg --verify qsb-087-2022.txt.sig.simon qsb-087-2022.txt gpg: Signature made Wed 23 Nov 2022 03:50:42 AM PST gpg: using RSA key EA18E7F040C41DDAEFE9AA0F4AC18DE1112E1490 gpg: Good signature from "Simon Gaiser (Qubes Security Pack signing key)" [full] $ cd ../canaries/ $ gpg --verify canary-034-2023.txt.sig.marmarek canary-034-2023.txt gpg: Signature made Thu 02 Mar 2023 03:51:48 AM PST gpg: using RSA key 2D1771FE4D767EDC76B089FAD655A4F21830E06A gpg: Good signature from "Marek Marczykowski-Górecki (Qubes security pack)" [full] $ gpg --verify canary-034-2023.txt.sig.simon canary-034-2023.txt gpg: Signature made Thu 02 Mar 2023 01:47:52 AM PST gpg: using RSA key EA18E7F040C41DDAEFE9AA0F4AC18DE1112E1490 gpg: Good signature from "Simon Gaiser (Qubes Security Pack signing key)" [full] Again, the exact output will differ, but the final line of output from each `gpg --verify` command should always start with `gpg: Good signature from...` followed by an appropriate key. For this announcement (Qubes Canary 044), the commands are: $ gpg --verify canary-044-2025.txt.sig.marmarek canary-044-2025.txt $ gpg --verify canary-044-2025.txt.sig.simon canary-044-2025.txt You can also verify the signatures directly from this announcement in addition to or instead of verifying the files from the qubes-secpack. Simply copy and paste the Qubes Canary 044 text into a plain text file and do the same for both signature files. Then, perform the same authentication steps as listed above, substituting the filenames above with the names of the files you just created.

We have published Qubes Security Bulletin (QSB) 109: Intel microcode updates. The text of this QSB and its accompanying cryptographic signatures are reproduced below, followed by a general explanation of this announcement and authentication instructions. ## Qubes Security Bulletin 109 ---===[ Qubes Security Bulletin 109 ]===--- 2025-08-14 Intel microcode updates User action ------------ Continue to update normally [1] in order to receive the security updates described in the "Patching" section below. No other user action is required in response to this QSB. Summary -------- On 2025-08-12, Intel published the following security advisories and accompanying microcode updates [3]: - INTEL-SA-01249 [4] - INTEL-SA-01308 [5] - INTEL-SA-01310 [6] - INTEL-SA-01311 [7] - INTEL-SA-01313 [8] - INTEL-SA-01367 [9] However, these advisories do not provide enough information for us to make a definitive assessment about the extent to which these vulnerabilities affect the security of Qubes OS. Based on the limited information available, we surmise that it is likely that INTEL-SA-01249 and INTEL-SA-01308 affect Qubes, while it is less likely that INTEL-SA-01310 affects Qubes, and not at all likely that the rest affect Qubes. Impact ------- On affected systems, a compromised qube might be able to escalate its privileges to that of dom0 or Xen. Affected systems ----------------- INTEL-SA-01249 affects 12th Generation Intel Core and newer CPU models (see [4] for a more complete and detailed list). Note that the fixes for some CPU models were already included in the microcode updates released on 2025-05-12 (see note in [3]). INTEL-SA-01308 and INTEL-SA-01310 affect only certain Intel server CPU models (see [5] and [6] for a list). Patching --------- The following packages contain security updates that address the vulnerabilities described in this bulletin: For Qubes OS 4.2 and 4.3, in dom0: - microcode_ctl version 2.1.20250812 These packages will migrate from the security-testing repository to the current (stable) repository over the next two weeks after being tested by the community. [2] Once available, the packages should be installed via the Qubes Update tool or its command-line equivalents. [1] Dom0 must be restarted afterward in order for the updates to take effect. If you use Anti Evil Maid, you will need to reseal your secret passphrase to new PCR values, as PCR18+19 will change due to the new microcode updates. Credits -------- See the original Intel Security Advisories. References ----------- [1] https://www.qubes-os.org/doc/how-to-update/ [2] https://www.qubes-os.org/doc/testing/ [3] https://github.com/intel/Intel-Linux-Processor-Microcode-Data-Files/blob/main/releasenote.md#microcode-20250812 [4] https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01249.html [5] https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01308.html [6] https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01310.html [7] https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01311.html [8] https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01313.html [9] https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01367.html -- The Qubes Security Team https://www.qubes-os.org/security/ **Source:** qsb-109-2025.txt ## Marek Marczykowski-Górecki’s PGP signature _**Note:** Marek Marczykowski-Górecki is currently traveling. He will add his signature when he returns in a few days._ ## Simon Gaiser (aka HW42)’s PGP signature -----BEGIN PGP SIGNATURE----- iQIzBAABCgAdFiEE6hjn8EDEHdrv6aoPSsGN4REuFJAFAmieWtMACgkQSsGN4REu FJBD0g//fAp15yflne35sU8iEwIertGZaOBR/tGPEUg3WoEMoil5qKW+4RKfdOWw LyhNlCVWea/k8pCs+6x2KazMvi30hvaD9QxDcxYweGqtldulmLLTA/GQ1V1OFABV xspUa3v9YyEsU6e9C6jVTiEu9DFWGFlbQiOapT0A3Qn3BBY1i7KZw/5RcmoDxo8X t8oak0Rz0Je/6w6H9CHxZGjWX4qFLJMgHAAA3wheoDU2xIvOM6a0HgxIstzOK5yH oUlyPYbrkYW9zGf1fjc8kBhZbya1SJ7oh+oh5Id6FSmlxbRC70dN2XAynb5bQOow ovGD0LmO2LBk59wZcldVl56sjUdrqghcjOaekSqTyCsz/kCaiAdIC7S3tVP4sUhm nKuXg9N5O8ivL7MwWIVeZogRfzFy6ZAQYusRYk36epeyVm3QYhOBFvGTMtOrVVas +7FbMhFbPzq7OLpYY+MbJIFmpL0fiv5JkLTWTyD+clXH8vkwokwnbFKoHfEiQVwf yt1bPVMpbcEeMsPdNO42XrBw/qLtK65GPaE17xhG5sW1PQoTNAbmsRpNkcSsfOrP JmgHsxbCHCBz0dnPUkVfh8nmDgDuFTs/ygyAz4rY1YYRvme3IuShG1BmUgKJgcrf c/t0JI7E2ItLbzXt264/6it7vd96PBwOxAowigbYHESanlHgVu0= =dOk8 -----END PGP SIGNATURE----- **Source:** qsb-109-2025.txt.sig.simon ## What is the purpose of this announcement? The purpose of this announcement is to inform the Qubes community that a new Qubes security bulletin (QSB) has been published. ## What is a Qubes security bulletin (QSB)? A Qubes security bulletin (QSB) is a security announcement issued by the Qubes security team. A QSB typically provides a summary and impact analysis of one or more recently-discovered software vulnerabilities, including details about patching to address them. ## Why should I care about QSBs? QSBs tell you what actions you must take in order to protect yourself from recently-discovered security vulnerabilities. In most cases, security vulnerabilities are addressed by updating normally. However, in some cases, special user action is required. In all cases, the required actions are detailed in QSBs. ## What are the PGP signatures that accompany QSBs? A PGP signature is a cryptographic digital signature made in accordance with the OpenPGP standard. PGP signatures can be cryptographically verified with programs like GNU Privacy Guard (GPG). The Qubes security team cryptographically signs all QSBs so that Qubes users have a reliable way to check whether QSBs are genuine. The only way to be certain that a QSB is authentic is by verifying its PGP signatures. ## Why should I care whether a QSB is authentic? A forged QSB could deceive you into taking actions that adversely affect the security of your Qubes OS system, such as installing malware or making configuration changes that render your system vulnerable to attack. Falsified QSBs could sow fear, uncertainty, and doubt about the security of Qubes OS or the status of the Qubes OS Project. ## How do I verify the PGP signatures on a QSB? The following command-line instructions assume a Linux system with `git` and `gpg` installed. (For Windows and Mac options, see OpenPGP software.) 1. Obtain the Qubes Master Signing Key (QMSK), e.g.: $ gpg --fetch-keys https://keys.qubes-os.org/keys/qubes-master-signing-key.asc gpg: directory '/home/user/.gnupg' created gpg: keybox '/home/user/.gnupg/pubring.kbx' created gpg: requesting key from 'https://keys.qubes-os.org/keys/qubes-master-signing-key.asc' gpg: /home/user/.gnupg/trustdb.gpg: trustdb created gpg: key DDFA1A3E36879494: public key "Qubes Master Signing Key" imported gpg: Total number processed: 1 gpg: imported: 1 (For more ways to obtain the QMSK, see How to import and authenticate the Qubes Master Signing Key.) 2. View the fingerprint of the PGP key you just imported. (Note: `gpg>` indicates a prompt inside of the GnuPG program. Type what appears after it when prompted.) $ gpg --edit-key 0x427F11FD0FAA4B080123F01CDDFA1A3E36879494 gpg (GnuPG) 2.2.27; Copyright (C) 2021 Free Software Foundation, Inc. This is free software: you are free to change and redistribute it. There is NO WARRANTY, to the extent permitted by law. pub rsa4096/DDFA1A3E36879494 created: 2010-04-01 expires: never usage: SC trust: unknown validity: unknown [ unknown] (1). Qubes Master Signing Key gpg> fpr pub rsa4096/DDFA1A3E36879494 2010-04-01 Qubes Master Signing Key Primary key fingerprint: 427F 11FD 0FAA 4B08 0123 F01C DDFA 1A3E 3687 9494 3. **Important:** At this point, you still don’t know whether the key you just imported is the genuine QMSK or a forgery. In order for this entire procedure to provide meaningful security benefits, you _must_ authenticate the QMSK out-of-band. **Do not skip this step!** The standard method is to obtain the QMSK fingerprint from _multiple independent sources in several different ways_ and check to see whether they match the key you just imported. For more information, see How to import and authenticate the Qubes Master Signing Key. **Tip:** After you have authenticated the QMSK out-of-band to your satisfaction, record the QMSK fingerprint in a safe place (or several) so that you don’t have to repeat this step in the future. 4. Once you are satisfied that you have the genuine QMSK, set its trust level to 5 (“ultimate”), then quit GnuPG with `q`. gpg> trust pub rsa4096/DDFA1A3E36879494 created: 2010-04-01 expires: never usage: SC trust: unknown validity: unknown [ unknown] (1). Qubes Master Signing Key Please decide how far you trust this user to correctly verify other users' keys (by looking at passports, checking fingerprints from different sources, etc.) 1 = I don't know or won't say 2 = I do NOT trust 3 = I trust marginally 4 = I trust fully 5 = I trust ultimately m = back to the main menu Your decision? 5 Do you really want to set this key to ultimate trust? (y/N) y pub rsa4096/DDFA1A3E36879494 created: 2010-04-01 expires: never usage: SC trust: ultimate validity: unknown [ unknown] (1). Qubes Master Signing Key Please note that the shown key validity is not necessarily correct unless you restart the program. gpg> q 5. Use Git to clone the qubes-secpack repo. $ git clone https://github.com/QubesOS/qubes-secpack.git Cloning into 'qubes-secpack'... remote: Enumerating objects: 4065, done. remote: Counting objects: 100% (1474/1474), done. remote: Compressing objects: 100% (742/742), done. remote: Total 4065 (delta 743), reused 1413 (delta 731), pack-reused 2591 Receiving objects: 100% (4065/4065), 1.64 MiB | 2.53 MiB/s, done. Resolving deltas: 100% (1910/1910), done. 6. Import the included PGP keys. (See our PGP key policies for important information about these keys.) $ gpg --import qubes-secpack/keys/*/* gpg: key 063938BA42CFA724: public key "Marek Marczykowski-Górecki (Qubes OS signing key)" imported gpg: qubes-secpack/keys/core-devs/retired: read error: Is a directory gpg: no valid OpenPGP data found. gpg: key 8C05216CE09C093C: 1 signature not checked due to a missing key gpg: key 8C05216CE09C093C: public key "HW42 (Qubes Signing Key)" imported gpg: key DA0434BC706E1FCF: public key "Simon Gaiser (Qubes OS signing key)" imported gpg: key 8CE137352A019A17: 2 signatures not checked due to missing keys gpg: key 8CE137352A019A17: public key "Andrew David Wong (Qubes Documentation Signing Key)" imported gpg: key AAA743B42FBC07A9: public key "Brennan Novak (Qubes Website & Documentation Signing)" imported gpg: key B6A0BB95CA74A5C3: public key "Joanna Rutkowska (Qubes Documentation Signing Key)" imported gpg: key F32894BE9684938A: public key "Marek Marczykowski-Górecki (Qubes Documentation Signing Key)" imported gpg: key 6E7A27B909DAFB92: public key "Hakisho Nukama (Qubes Documentation Signing Key)" imported gpg: key 485C7504F27D0A72: 1 signature not checked due to a missing key gpg: key 485C7504F27D0A72: public key "Sven Semmler (Qubes Documentation Signing Key)" imported gpg: key BB52274595B71262: public key "unman (Qubes Documentation Signing Key)" imported gpg: key DC2F3678D272F2A8: 1 signature not checked due to a missing key gpg: key DC2F3678D272F2A8: public key "Wojtek Porczyk (Qubes OS documentation signing key)" imported gpg: key FD64F4F9E9720C4D: 1 signature not checked due to a missing key gpg: key FD64F4F9E9720C4D: public key "Zrubi (Qubes Documentation Signing Key)" imported gpg: key DDFA1A3E36879494: "Qubes Master Signing Key" not changed gpg: key 1848792F9E2795E9: public key "Qubes OS Release 4 Signing Key" imported gpg: qubes-secpack/keys/release-keys/retired: read error: Is a directory gpg: no valid OpenPGP data found. gpg: key D655A4F21830E06A: public key "Marek Marczykowski-Górecki (Qubes security pack)" imported gpg: key ACC2602F3F48CB21: public key "Qubes OS Security Team" imported gpg: qubes-secpack/keys/security-team/retired: read error: Is a directory gpg: no valid OpenPGP data found. gpg: key 4AC18DE1112E1490: public key "Simon Gaiser (Qubes Security Pack signing key)" imported gpg: Total number processed: 17 gpg: imported: 16 gpg: unchanged: 1 gpg: marginals needed: 3 completes needed: 1 trust model: pgp gpg: depth: 0 valid: 1 signed: 6 trust: 0-, 0q, 0n, 0m, 0f, 1u gpg: depth: 1 valid: 6 signed: 0 trust: 6-, 0q, 0n, 0m, 0f, 0u 7. Verify signed Git tags. $ cd qubes-secpack/ $ git tag -v `git describe` object 266e14a6fae57c9a91362c9ac784d3a891f4d351 type commit tag marmarek_sec_266e14a6 tagger Marek Marczykowski-Górecki 1677757924 +0100 Tag for commit 266e14a6fae57c9a91362c9ac784d3a891f4d351 gpg: Signature made Thu 02 Mar 2023 03:52:04 AM PST gpg: using RSA key 2D1771FE4D767EDC76B089FAD655A4F21830E06A gpg: Good signature from "Marek Marczykowski-Górecki (Qubes security pack)" [full] The exact output will differ, but the final line should always start with `gpg: Good signature from...` followed by an appropriate key. The `[full]` indicates full trust, which this key inherits in virtue of being validly signed by the QMSK. 8. Verify PGP signatures, e.g.: $ cd QSBs/ $ gpg --verify qsb-087-2022.txt.sig.marmarek qsb-087-2022.txt gpg: Signature made Wed 23 Nov 2022 04:05:51 AM PST gpg: using RSA key 2D1771FE4D767EDC76B089FAD655A4F21830E06A gpg: Good signature from "Marek Marczykowski-Górecki (Qubes security pack)" [full] $ gpg --verify qsb-087-2022.txt.sig.simon qsb-087-2022.txt gpg: Signature made Wed 23 Nov 2022 03:50:42 AM PST gpg: using RSA key EA18E7F040C41DDAEFE9AA0F4AC18DE1112E1490 gpg: Good signature from "Simon Gaiser (Qubes Security Pack signing key)" [full] $ cd ../canaries/ $ gpg --verify canary-034-2023.txt.sig.marmarek canary-034-2023.txt gpg: Signature made Thu 02 Mar 2023 03:51:48 AM PST gpg: using RSA key 2D1771FE4D767EDC76B089FAD655A4F21830E06A gpg: Good signature from "Marek Marczykowski-Górecki (Qubes security pack)" [full] $ gpg --verify canary-034-2023.txt.sig.simon canary-034-2023.txt gpg: Signature made Thu 02 Mar 2023 01:47:52 AM PST gpg: using RSA key EA18E7F040C41DDAEFE9AA0F4AC18DE1112E1490 gpg: Good signature from "Simon Gaiser (Qubes Security Pack signing key)" [full] Again, the exact output will differ, but the final line of output from each `gpg --verify` command should always start with `gpg: Good signature from...` followed by an appropriate key. For this announcement (QSB-109), the commands are: $ gpg --verify qsb-109-2025.txt.sig.marmarek qsb-109-2025.txt $ gpg --verify qsb-109-2025.txt.sig.simon qsb-109-2025.txt You can also verify the signatures directly from this announcement in addition to or instead of verifying the files from the qubes-secpack. Simply copy and paste the QSB-109 text into a plain text file and do the same for both signature files. Then, perform the same authentication steps as listed above, substituting the filenames above with the names of the files you just created.

We’re pleased to announce that the first release candidate (RC) for Qubes OS 4.3.0 is now available for testing. This minor release includes many new features and improvements over Qubes OS 4.2. ## What’s new in Qubes 4.3? * Dom0 upgraded to Fedora 41 (#9402). * Xen upgraded to version 4.19 (#9420). * Default Fedora template upgraded to Fedora 42 (versions older than release 41 not supported). * Default Debian template upgraded to Debian 13 (versions older than release 12 not supported). * Default Whonix templates upgraded to Whonix 17.4.3 (versions older than release 17 not supported). * Preloaded disposables (#1512) * Device “self-identity oriented” assignment (a.k.a. New Devices API) (#9325) * Qubes Windows Tools reintroduced with improved features (#1861). These are just a few highlights from the many changes included in this release. For a more comprehensive list of changes, see the Qubes OS 4.3 release notes. (This is a temporary link to an early preview of the release notes, which are continually being updated as we progress toward the eventual stable release.) ## When is the stable release? That depends on the number of bugs discovered in this RC and their severity. As explained in our release schedule documentation, our usual process after issuing a new RC is to collect bug reports, triage the bugs, and fix them. If warranted, we then issue a new RC that includes the fixes and repeat the process. We continue this iterative procedure until we’re left with an RC that’s good enough to be declared the stable release. No one can predict, at the outset, how many iterations will be required (and hence how many RCs will be needed before a stable release), but we tend to get a clearer picture of this as testing progresses. ## How to test Qubes 4.3.0-rc1 If you’re willing to test this release candidate, you can help us improve the eventual stable release by reporting any bugs you encounter. You can upgrade to Qubes 4.3.0-rc1 with either a clean installation or an in-place upgrade from Qubes 4.2. (Note for in-place upgrade testers: `qubes-dist-upgrade` now requires `--releasever=4.3` and may require `--enable-current-testing` for testing releases like this RC.) As always, we strongly recommend making a full backup beforehand and updating Qubes OS immediately afterward in order to apply all available bug fixes. We encourage experienced users to join the testing team. ## Known issues in Qubes OS 4.3.0-rc1 Templates restored in 4.3.0-rc1 from a pre-4.3 backup continue to target their original Qubes OS release repos. This does not affect fresh templates on a clean 4.3.0-rc1 installation. For more information, see issue #8701. View the full list of known bugs affecting Qubes 4.3 in our issue tracker. ## What’s a release candidate? A release candidate (RC) is a software build that has the potential to become a stable release, unless significant bugs are discovered in testing. RCs are intended for more advanced (or adventurous!) users who are comfortable testing early versions of software that are potentially buggier than stable releases. You can read more about Qubes OS supported releases and the version scheme in our documentation. ## What’s a minor release? The Qubes OS Project uses the semantic versioning standard. Version numbers are written as `major].minor].[patch]`. Hence, releases that increment the second value are known as “minor releases.” Minor releases generally include new features, improvements, and bug fixes that are backward-compatible with earlier versions of the same major release. See our [supported releases for a comprehensive list of major and minor releases and our [version scheme documentation for more information about how Qubes OS releases are versioned.

New Fedora 42 templates are now available for Qubes OS 4.2 in standard, minimal, and Xfce varieties. There are two ways to upgrade a template to a new Fedora release: * **Recommended:** Install a fresh template to replace an existing one. This option is simpler for less experienced users, but it won’t preserve any modifications you’ve made to your template. After you install the new template, you’ll have to redo your desired template modifications (if any) and switch everything that was set to the old template to the new template. If you choose to modify your template, you may wish to write those modifications down so that you remember what to redo on each fresh install. To see a log of package manager actions, open a terminal in the template and use the `dnf history` command. * **Advanced:** Perform an in-place upgrade of an existing Fedora template. This option will preserve any modifications you’ve made to the template, but it may be more complicated for less experienced users. **Note:** No user action is required regarding the OS version in dom0 (see our note on dom0 and EOL).

We’re pleased to announce that we’re officially migrating to Read the Docs as our documentation generation and hosting platform. Our documentation source files will continue to reside in the qubes-doc Git repository with PGP-signed tags and commits, and the live documentation published on the web will continue to be located on the official Qubes website, but Read the Docs will handle generating the documentation from our source files and hosting the generated documentation on the backend so that it can be served to Qubes website visitors. Migrating to Read the Docs will enable us to localize the documentation, maintain release-specific documentation, support offline documentation, and more. Today marks the beginning of a 20-day community testing period for the new documentation, which is already live at https://doc.qubes-os.org/en/latest/. ## What is Read the Docs? Read the Docs is an open-source platform that hosts software documentation. It’s a popular choice among open-source projects, because it simplifies the process of generating documentation from Git repositories and offers many useful features that would be difficult for small projects to implement themselves in a polished way, such as versioning, integrated search, and pull request previews. ## Why is the documentation migrating? There are new and increasing demands on the Qubes documentation, such as localization (i.e., translations), release-specific documentation, and offline documentation. With these new demands, it has become increasingly difficult for the current system to meet our needs. Before we tried to address these kinds of needs, our documentation setup was simpler and served us well. The backend was smaller, easier to understand, and easier to maintain, since it didn’t need to do much. There was only a single, canonical version of every documentation page. However, the reality is that not all Qubes users read English, not everyone uses the same version of Qubes OS at the same time, and not everyone is comfortable cloning a Git repo and sorting through plain text files written in a lightweight markup language. We have users and contributors of all technical levels from around the world, and we sometimes support multiple Qubes releases simultaneously. Even when there’s only one currently-supported release, there’s usually a new one in development or testing that folks want to start documenting. This means that we have to support a separate version of each relevant documentation page for every translated language and for every supported and in-development Qubes version, not to mention historical documentation for releases that have reached end of life (EOL). We also have users who want to be able to access the documentation offline in a user-friendly format, such as HTML, PDF, or EPUB. Trying to implement all of these features and manage all of this complexity manually by ourselves isn’t practical. We need a system that’s designed for managing complex software documentation, and that’s precisely what Read the Docs is. ## How is the documentation currently set up, and what will change? At present, the official Qubes documentation consists of a set of plain text Markdown source files that are stored in the qubes-doc Git repository, which is a subrepository of the Qubes website repository, qubesos.github.io. We then use GitHub Pages to generate the Qubes website, which includes the current documentation. Read the Docs also generates documentation from plain text source files in Git repositories. However, it primarily uses reStructuredText instead of Markdown. Furthermore, Read the Docs hosts HTML content that is usually generated using tools like Sphinx, whereas GitHub Pages uses Jekyll for static site generation. Accordingly, the Qubes documentation source files will continue to reside in the qubes-doc repository, but the Markdown content is being converted to reStructuredText. Furthermore, the documentation will be generated using Sphinx and hosted by Read the Docs rather than generated using Jekyll and hosted by GitHub. The web version of the new documentation will continue to be located on the Qubes website, but it will be under a new subdomain (https://doc.qubes-os.org). In addition, images and other binary files used in the documentation will be stored in qubes-doc rather than the qubes-attachment repository. ## How will this affect the security of the documentation? The source files for all official Qubes documentation will continue to be stored in the qubes-doc Git repository with PGP-signed tags and commits, just as they are now. In that sense, the security of the documentation won’t change at all. The main change is that Read the Docs will replace GitHub as the platform that generates the documentation from the source files and hosts the generated documentation. ## How will the migration proceed? Over the next 20 days, between now and 2025-08-12, the community will test the new documentation. During this period, the current documentation will be frozen, which means that no pull requests will be merged. After the testing period has concluded, the documentation team will evaluate the results and make any changes that are needed. Once the migration is complete, we’ll make a final announcement, and the new documentation hosted on Read the Docs will officially replace the current documentation. ## What can I do to help? Please review the new documentation located at https://doc.qubes-os.org/en/latest/. It would be especially helpful to compare the new documentation to the current documentation located at https://qubes-os.org/doc and point out any inconsistencies. (When doing this, please focus on accuracy and correctness rather than visual aspects.) There’s a full list of new documentation pages to be reviewed in issue #8180. After you’ve reviewed a page, please leave a comment on that issue to let us know your findings. You can simply copy the entries you reviewed from that list into your comment and add a brief note on what you found problematic, found acceptable, and so on. If you’d like to report a more significant bug or request a feature, you can also open a separate issue. If you’re familiar with reStructuredText and would like to submit a change to the new documentation, please open a pull request against this branch: https://github.com/QubesOS/qubes-doc/tree/rst. While we want to know about any problems you spot, please feel free to share any positive feedback you have, as well! ## Acknowledgments This migration is the culmination of many hours of work over the course of several years, for which the Qubes OS Project owes a debt of gratitude. The Sphinx conversion tooling was done by Maiska (aka m), with support from Marek Marczykowski-Górecki. Tobias Killer (aka tokidev) thoroughly and repeatedly tested the converted and deployed reStructuredText documentation. More recently, unman and Solène Rapenne have supported the transition in the capacities as documentation maintainers.