According to the Tor release note [archive], there are usually several different major versions of Tor supported by the Tor project. However, due to the the limited time the Tor packager has, only a few major versions are packaged and ready to be used.
For example, at the time of writing (December, 2017), five major versions of Tor are supported. Specifically:
- Debian stretch repository only contains another LTS which is version 0.2.9.
- , also known as TPO repository, contains only the latest stable Tor which is version 0.3.1.9.
A major consideration in choosing the most suitable Tor version for Whonix ™ is that the latest stable found in the TPO repository may lead to network breakage.  The reason is the "stable" tag indicates it is stable version of Tor, which does not necessarily match the "stable" Debian version that Whonix ™ is actually using. 
There are three primary Tor options for Whonix ™ developers and each of them has pros and cons:
1. Use the Tor LTS version from the official Debian package repository:
- Advantages: Minimal effort is required in Whonix ™.
- Disadvantages: Misses the advantages of later versions (see below).
2. Use latest stable in TPO repository and allow testers to use the Tor nightly build in Whonix ™, with bug reporting bug to TPO
- Advantages: Latest features, better security, improved Tor Browser compatibility (using SocksPort with flags and even better connectivity performance). 
- Disadvantages: From the Whonix ™ perspective, these packages are uploaded to at random times. These packages are not guaranteed to be compatible with Whonix ™. While there are no security concerns, these packages could break a system's apt-get package management (due to incompatible dependencies) or connectivity, in case Tor refuses to start. This can arise due to a configuration incompatibility in a newer version of Tor, or for other reasons such as systemd or apparmor related changes.
3. Versions are downloaded from, verified to work, and then migrated to
- Advantages: Flexibility in version selection, a guaranteed way to confirm that only stable Tor versions which are functional in Whonix ™ will be uploaded.
- Disadvantages: A few testers are needed, manual uploads are required, and Whonix ™ touches Tor.
Whonix ™ developers have chosen the third method for now.  However, the comparison above suggests better security and compatibility is afforded by the second option. This approach requires a lot of active testers who can use the Tor nightly build and report bugs to the Tor project or Whonix ™. 
Tor Config Files
Rationale for Tor Drop-In Configuration Folder
Having a Tor Configuration Drop-In Folder makes implementation of additional features that require additional Tor settings much easier. For example it could improve usability to provide a
whonix-gw-hidden-webserver package, that automates the Whonix-Gateway ™ specific instructions for Onion Services. Such a package could just drop the configuration snippet there, and if the feature gets disabled or the package installed, that configuration snippet gets purged. Adding additions to
/etc/tor/torrc with a script is problematic, because those additions cannot be removed by a script if the user slightly modified those lines and because these can cause a
dpkg interactive conflict resolution dialog.
The implementation is as it follows.
/etc/tor/torrcholds minimal content, so ideally it will need as few updates as possible or never again in the future. The only effective command is
%include /etc/torrc.d/which results in parsing folder
- The lexical high file
/etc/torrc.d/95_whonix.conf[archive] instructions to
- Instructions in
/etc/tor/torrcand documentation instructs users to not edit that file and use use
/etc/tor/torrc.examplescontains configuration examples.
- Some Whonix ™ Tor settings unfortunately still go into
/usr/share/tor/tor-service-defaults-torrc[archive] due to Qubes-Whonix eth1 static networking [archive] feature not being implemented yet.
- Most users probably ignore
/usr/share/tor/tor-service-defaults-torrc, because this file is barely advertised and barely popular.
/usr/share/tor/tor-service-defaults-torrccan be modified by Qubes-Whonix
replace-ips[archive] without any conflicts with user modifications or
dpkg interactive conflict resolution dialog.
torrc.dcleaner [archive] by Whonix ™ developers moves files in folder
/etc/torrc.d/that do not have the
.conffile extension out of the way. This is to workaround a Tor upstream issue [archive], namely only supporting parsing all files in a folder which can include which end have a
~file extension (backup files created by file editors) or start with a dot ("
.") ("hidden files") which can then result in effective configurations other than what the user expects. These superfluous files users are unaware off often contain settings the user already changed in the real (non-backup) file.
- Debian feature request: add torrc.d configuration directory [archive]
- Initial Tor feature request: torrc.d-style configuration directories [archive]
- Improvement Tor feature request: Parse only .torrc files in torrc.d directory [archive]
- https://github.com/Whonix/anon-gw-anonymizer-config [archive]
Only Two Config Files
- Using only /usr/share/tor/tor-service-defaults-torrc and /etc/tor/torrc, not using /etc/tor/torrc.examples.
- And having configuration examples (instructions) in /usr/share/tor/tor-service-defaults-torrc. Using a minimal /etc/tor/torrc to tell them to look into /usr/share/tor/tor-service-defaults-torrc for configuration examples.
- This is a bad idea, because users get tempted comment in things in /usr/share/tor/tor-service-defaults-torrc.
- When they do this, they settings would get lost and overwritten without asking next time they update anon-gw-anonymizer-config [archive], because /usr/share/tor/tor-service-defaults-torrc is not a configuration file (since in /usr, not /etc folder).
Only One Config File
- Using only /etc/tor/torrc, leaving /usr/share/tor/tor-service-defaults-torrc with defaults (from Debian), not using /etc/tor/torrc.examples.
- Using /etc/tor/torrc for user examples, user's own modifications and Whonix ™ Tor settings.
- This is bad, because when users have edited /etc/tor/torrc and anon-gw-anonymizer-config gets updated, it will throw an
dpkg interactive conflict resolution dialog. Users might decide to keep their old config file and will miss (security) improvements.
Why Waste Network Bandwidth by Downloading Operating System Updates over Tor?
The short answer is this option was discussed with The Tor Project and Whonix ™ was granted permission to do so.
Interested readers who want to learn more should review the following:
- Tor Project thread about this issue; see updates over Tor, should not waste Tor bandwidth [archive].
- The Tor Project was asked directly, after this issue and possible solutions were discussed thoroughly by the Whonix ™ team; see tor-talk Operating system updates / software installation behind Tor Transparent Proxy [archive]. 
- Andrew Lewman, a former Executive Director, Director and press contact for Tor downloads a lot of updates over the network and did not complain [archive].
- https://forums.whonix.org/t/whonix-gateway-tor-0-2-9-9-unrecommended-no-update-unsafe/4240/8 [archive]
- The Debian target is usually the stable package, which is currently: buster) or Whonix ™.
- Patrick: "Historically when there was a botnet starting to use Tor, the LTS version barely connected while the latest stable had the ntor handshake which worked." See  [archive].
- Relative Whonix ™ Forum discussion: https://forums.whonix.org/t/tor-releases-discussion/4578 [archive]
- Please contact us if you would like to be a Tor nightly build tester for Whonix ™.
- Click here [archive] for an overview of all answers.
This is a wiki. Want to improve this page? Help is welcome and volunteer contributions are happily considered! Read, understand and agree to Conditions for Contributions to Whonix ™, then Edit! Edits are held for moderation. Policy of Whonix Website and Whonix Chat and Policy On Nonfreedom Software applies.
Copyright (C) 2012 - 2021 ENCRYPTED SUPPORT LP. Whonix ™ is a trademark. Whonix ™ is a licensee [archive] of the Open Invention Network [archive]. Unless otherwise noted, the content of this page is copyrighted and licensed under the same Freedom Software license as Whonix ™ itself. (Why?)
The personal opinions of moderators or contributors to the Whonix ™ project do not represent the project as a whole.