I'm not sure what the deal with Qubes OS is. When I get some time I'll play with it and see if I can figure out what's going on. I can't make any guarantees, though; it seems they have a completely different security model and who knows what it will need to run the bitcoin server successfully.
Qubes is interesting, it uses the Xen virtualisation software to created an OS built around compartmentalising
everything, all using Fedora as the template distro. The GUI/desktop is bundled with with a set of presiding commands, libraries and scripts that provide an interface between the hypervisor and the layer for running VMs with actual applications. All the networking is run through dedicated network interface VM's, where the actual hardware adapter is assigned to that VM only at the hypervisor level (similarly possible with all the hardware devices, i.e. USB bus can be assigned to a single VM with no networking access at all). Further network proxy VM's can be run to enforce firewall rules, and are easy to configure. So, you can chain multiple network proxies together each with different network setting, e.g. WAN -> VPN -> Tor. It's a pretty smart concept.
It's still a bit immature, so there's the occasional upstream bug that can break some functionality, but it's come a long way since I first gave it a trial install. Playing with the most recent release has given me a pretty solid security environment for running Armory (Armory Offline runs in a VM without network, special secure hypervisor level copy-paste function lets you shuttle unsigned/signed transactions between online and offline domains).
Right now, though, the more important thing is doing something about this horrible configuration file handling code. It's old, old code from Bitcoin that isn't at all object oriented and is very brittle. It got even more brittle with the 0.9 refactoring, which is where this latest issue came from. I _finally_ think I have a workaround, but I'm going to give it a few rounds of testing locally before I push it out. Eventually all this code really needs to be scrapped and rewritten.
Sounds like a struggle. It is a little surprising to find such disharmony between the development projects and all the distros in the Linux world, although I'm beginning to understand just how many levels of interoperation there are (packaging format, desktop, architecture, repo & EOL distros/libraries all play their part, I'll hazard a guess that there are more...). Seems like the secret is to have as consumate a knowledge of Linux in all it's incarnations and permutations as possible, then it's possible to fix most things yourself
.
Unfortunately I don't get paid for this and the donations have been pitifully small so far. Oh well. I'll keep at it. 
