Whonix ™ for macOS: Download and Installation

Version: 15.0.1.7.3

Type	Connection	Link	Download Security without Verification	Download Security with Verification
		Download (TLS)	Medium	High [1]
		Download (Onion)	Medium	High
		OpenPGP Signature (TLS) sha512 sha512 OpenPGP sha512 Signify	-	-
		OpenPGP Signature (Onion) sha512 sha512 OpenPGP sha512 Signify	-	-
		Verify images using this Signing Key

Verify the Whonix ™ Images Whonix ™ virtual machine images are cryptographically signed by Whonix developer Patrick Schleizer using OpenPGP. ^[2]

If you know how to use an OpenPGP key, download the Whonix ™ Signing Key and the Whonix ™ signatures straight away.

Otherwise, use the following instructions:

• For Linux: Using KGpg
• For Linux: Using the command line
• For Windows
• For macOS

Start VirtualBox

Click on Filethen choose Import Appliance...

Navigate and select the Whonix ™ image and press next

Do NOT change anything! Just click on Import

Then press Agree

Wait until Whonix-Gateway.ova has been imported

Repeat the import step for Whonix-Workstation.ova

Miscellaneous

Video Tutorials are also available.

If you still need help, please check the Support page.

After the Whonix ™ .ova files are imported they can be removed. VirtualBox will make a new directory with the live virtual machines Whonix-Gateway.vbox and Whonix-Workstation.vbox, and they are contained in directories of the same name. By default this is /Users/(yourusername)/VirtualBox VMs

First things first

• This is in active development. Right now, you need to build Whonix to get it running on Apple Silicon.
• This can be improved in the future. If you want to help, please visit this forum thread ^[archive].
• Please understand that this is only for advanced users for now!

1. Environment Setup

• Git
• Homebrew
• QEMU (with latest macOS HVF patches ^[archive], still not upstream)

The below has only been tested on Debian buster running under QEMU ^[archive] on a Mac M1. Firstly, we need to use patches on top of QEMU. This Brew repository ^[archive] has those patches baked in thus it is advisable to use that.

Note: getting Debian running on Apple Silicon is a bit out of scope of this documentation, however we have referenced below some helpful links.^[3]

2. Initial Build

Follow the build documentation here and be sure to set --arch arm64 when running the build script as part of the Dev/Build_Documentation/15_full#VM_Creation step. This means your build commands should look as follows:

sudo ./whonix_build --target raw --flavor whonix-workstation-xfce --build --arch arm64

sudo ./whonix_build --target raw --flavor whonix-gateway-xfce --build --arch arm64

Notes on the above:

• For now, you will need to build from master which means running git checkout master after cloning the repo and adding --allow-untagged true to the end of the build command. Once arm64 support is in a new git tag, this will not be necessary.

Thus, much more sensible build commands for macOS on Apple Silicon are as follows:

sudo ./whonix_build --target raw --flavor whonix-workstation-xfce --build --arch arm64 --allow-untagged true

sudo ./whonix_build --target raw --flavor whonix-gateway-xfce --build --arch arm64 --allow-untagged true

Provided you have built correctly, you will now have two .raw files in the ~/whonix_binary (they will look something like Whonix-<flavour>-XFCE-15.0.1.7.3-XX-<git commit hash>.raw), one for the Workstation and one for the Gateway.

You'll need to get these files onto your host Mac. It is recommended to tar them with the S option, this means that sparse files will be archived correctly ^[archive]. You can run:

tar -zcvSf whonix.workstation.tar.gz Whonix-Workstation-XFCE-15.0.1.7.3-XX-<git commit hash>.raw
tar -zcvSf whonix.gateway.tar.gz Whonix-Gateway-XFCE-15.0.1.7.3-XX-<git commit hash>.raw

to do this (your files may have slightly different file names, but should follow the same format).

3. Running the VM

1. Copy the two tar files into some directory on your host Mac.
2. Run the below to extract them (notice the S flag again which respects sparse files and thus doesn't count the holes in the files towards your disk usage ^[archive]).

tar -zxvSf whonix.workstation.tar.gz
tar -zxvSf whonix.gateway.tar.gz

3. Run the below command to run the gateway:

qemu-system-aarch64 \
         -machine virt,accel=hvf,highmem=off \
         -cpu cortex-a72 -smp 4 -m 2G \
         -device intel-hda -device hda-output \
         -device virtio-gpu-pci \
         -device usb-ehci \
         -device usb-kbd \
         -device usb-tablet \
         -device virtio-net-pci,netdev=external \
         -device virtio-net-pci,netdev=internal \
         -netdev user,id=external,ipv6=off,net=10.0.2.0/24 \
         -netdev socket,id=internal,listen=:8010 \
         -display cocoa \
         -drive "if=pflash,format=raw,file=./edk2-aarch64-code.fd,readonly=on" \
         -drive "if=virtio,format=raw,file=./Whonix-Gateway-XFCE.raw,discard=on"

4. In another terminal, run the below command to run the workstation:

qemu-system-aarch64 \
         -machine virt,accel=hvf,highmem=off \
         -cpu cortex-a72 -smp 8 -m 4G \
         -device intel-hda -device hda-output \
         -device virtio-gpu-pci \
         -device usb-ehci \
         -device usb-kbd \
         -device usb-tablet \
         -device virtio-net-pci,netdev=external \
         -device virtio-net-pci,netdev=internal \
         -netdev user,id=external,ipv6=off,net=10.0.2.0/24 \
         -netdev socket,id=internal,listen=:8010 \
         -display cocoa \
         -drive "if=pflash,format=raw,file=./edk2-aarch64-code.fd,readonly=on" \
         -drive "if=virtio,format=raw,file=./Whonix-Workstation-XFCE.raw,discard=on"

Notes on QEMU:

• The edk2-aarch64-code.fd file in the QEMU commands is a BIOS file. It's packaged with QEMU, so you can easily copy it into your directory with cp $(dirname $(which qemu-img))/../share/qemu/edk2-aarch64-code.fd ..
• -smp X -m YG controls CPU count (X) and RAM amount (Y in gigabytes). You can change these to better suit your needs.
• Currently we are using the default cocoa display type for QEMU. This has issues such as no copy and paste and poor HDPI scaling. It is possible to connect via VNC or Spice which solves those issues. Active development is occuring here and we hope this wiki can be updated with those details soon.

At this point two QEMU windows should open up which lead you into the wonderful world of Whonix.