Exclude VMs with skip-update boolean feature

fixes: QubesOS/qubes-issues#9029

doc/tools/qubes-vm-update.rst

@@ -85,6 +85,8 @@ Targeting is used to choose the VMs that will be checked for available updates,
 
 Additionally, not all VMs in the system can be updated directly (such as AppVMs), and to update them, you must use one of the "propagation" options. This means, after updating the template, restarting the VM and applying the installed updates to it. Using at least the `--apply-to-sys` flag is recommended, which restarts all service VMs. Keep in mind that during this process, unsaved data may be lost.
 
+VMs with `skip-update` feature set to True will be excluded from update, unless directly targeted with `--targets` option.
+
 RETURN CODES
 ============
 

vmupdate/vmupdate.py

@@ -208,6 +208,12 @@ def preselect_targets(args, app) -> Set[qubesadmin.vm.QubesVM]:
         print("Skipping dom0. To update AdminVM use `qubes-dom0-update`")
     targets = {vm for vm in targets
                if vm.name != 'dom0' and vm.name not in to_skip}
+
+    # exclude vms with `skip-update` feature, but allow --targets to override it
+    if not args.targets:
+        targets = {vm for vm in targets
+               if not bool(vm.features.get('skip-update', False))}
+
     return targets