Update Qubes-Whonix ™

From Whonix

< Qubes(Redirected from Qubes/Binary Update)


End-of-life Software[edit]

It is inadvisable to run software that has reached end-of-life status. Developers do not fix existing defects, bugs or vulnerabilities in this case, leading to serious security risks.

For example, in 2018 VLC Media Player in Debian jessie [archive] had reached end-of-life status in May of that year. In that case, Whonix ™ users who did not utilize a different media player were at risk, because VLC in Debian jessie has unpatched security vulnerabilities. This VLC vulnerability does not apply to the current stable Whonix ™ 16 release which is based on Debian bullseye.

Installing Additional Software[edit]

See Install Software.


Standard Upgrade vs Release Upgrade[edit]

This procedure is for every day upgrading of Qubes-Whonix ™ and will not perform a Release Upgrade.

Before applying a release upgrade, it is useful to first complete a standard upgrade in both the whonix-gw-16 and whonix-ws-16 Templates, via Konsole:

  • Qubes App Menu(blue/grey "Q")Template: whonix-gw-16Konsole
  • Qubes App Menu(blue/grey "Q")Template: whonix-ws-16Konsole

Then perform the Standard Upgrade Steps below in both terminals.

Standard Upgrade Steps[edit]

Info Note: Updating Tor Browser is a separate issue; see Update Tor Browser.

1. Update the Package Lists

Info At least once a day, Qubes users should update the system package lists in all Templates, Standalone VMs and dom0 with the latest version information on new and updated packages that are available for download. [1]

To update the whonix-gw-16 and whonix-ws-16 Template packages lists, simplest is using Qube Manager:
Qube Managerleft-click whonix-gw-16 or whonix-ws-16Update qube system (blue arrow)

Alternatively, open a terminal in the Template and run.

sudo apt-get update

The output should look similar to this.

sudo apt-get update
Hit:1 tor+ buster/updates InRelease
Hit:2 tor+ buster InRelease                              
Hit:3 buster InRelease                        
Hit:4 tor+ buster InRelease
Reading package lists... Done

If an error message like this appears. [2]

Ign:1 stretch InRelease
Hit:2 stretch InRelease
Err:12 tor+http://sgvtcaew4bxjd7ln.onion stretch/updates Release
Connection failed
Reading package lists... Done
E: The repository 'tor+http://sgvtcaew4bxjd7ln.onion stretch/updates Release' does no longer have a Release file.
N: Updating from such a repository can't be done securely, and is therefore disabled by default.
N: See apt-secure(8) manpage for repository creation and user configuration details.

Or this.

500  Unable to connect

Then something went wrong. It could be:

  1. A temporary Tor exit relay or server failure that should resolve itself; or
  2. One or more Onion Services might be non-functional.

In the first case, check if the network connection is functional by changing the Tor circuit and/or run whonixcheck to try and diagnose the problem. In the second case, try setting clearnet repository links before attempting to update again.

Sometimes a message like this will appear.

Could not resolve ''

It that case, it helps to run.


And then try again.

2. Upgrade

If using a terminal, run the following command to install the latest system package versions. [3]

sudo apt-get dist-upgrade

Please note that if the Whonix APT Repository was disabled (see Disable Whonix APT Repository), then manual checks are required for new Whonix releases along with manual installation from source code.

3. Never Install Unsigned Packages!

If a message like this appears.

WARNING: The following packages cannot be authenticated!
Install these packages without verification [y/N]?

Then do not proceed! Press N and <enter>. Running apt-get update again should fix the problem. If not, something is broken or it is a Man-in-the-Middle Attack, which is not that unlikely since updates are retrieved over Tor exit relays and some of them are malicious. Changing the Tor circuit is recommended if this message appears.

4. Signature Verification Warnings

There should be no signature verification warnings at present; if it occurs, it will look similar to this.

W: A error occurred during the signature verification. The repository is not updated and the previous index files will be used. GPG error: stable Release: The following signatures were invalid: KEYEXPIRED 1409325681 KEYEXPIRED 1409325681 KEYEXPIRED 1409325681 KEYEXPIRED 1409325681

Caution is required in this case, even though apt-get will automatically ignore repositories with expired keys or signatures, and no upgrades will be received from that repository. Unless the issue is already known or documented, it should be reported for further investigation.

There are two possible reasons why this could happen. Either there is an issue with the repository that the contributors have yet to fix or the user is the victim of a Man-in-the-Middle Attack. [4] The latter is not a big issue, since no malicious packages are installed. Further, it may automatically resolve itself after a period of time when a different, non-malicious Tor exit relay is used, or following a manual change of the Tor circuit.

In the past, various apt repositories were signed with an expired key. To inspect how the documentation appeared at that point, please click on Expand on the right.

For instance, the Tor Project's apt repository key had expired [archive] and the following warning appeared.

W: A error occurred during the signature verification. The repository is not updated and the previous index files will be used. GPG error: stable Release: The following signatures were invalid: KEYEXPIRED 1409325681 KEYEXPIRED 1409325681 KEYEXPIRED 1409325681 KEYEXPIRED 1409325681

W: Failed to fetch  

W: Some index files failed to download. They have been ignored, or old ones used instead.

This issue had already been reported [archive]. There was no immediate danger and it could have safely been ignored. Just make sure to never install unsigned packages as explained above.

For another example, see the more recent Whonix apt repository keyexpired error.

Although an unlikely outcome, please report any other signature verification errors if/when they appear.

5. Changed Configuration Files

If a message like this appears.

Setting up ifupdown ...
Configuration file `/etc/network/interfaces'
 ==> Modified (by you or by a script) since installation.
 ==> Package distributor has shipped an updated version.
   What would you like to do about it ?  Your options are:
    Y or I  : install the package contributor's version
    N or O  : keep your currently-installed version
      D     : show the differences between the versions
      Z     : background this process to examine the situation
 The default action is to keep your current version.
*** interfaces (Y/I/N/O/D/Z) [default=N] ? N

Be careful. If the updated file is not coming from a Whonix ™-specific package (some are called whonix-...), then press n. Otherwise, Whonix settings affecting anonymity, privacy, and security might be lost. Advanced users who know better can of course manually check the differences and merge them.

To determine if the file is coming from a Whonix ™-specific package or not, follow this advice:

  • Whonix ™-specific packages are sometimes called whonix-.... In the example above it states "Setting up ifupdown ...", so the file does not come from a Whonix ™-specific package. In this case it is recommended to press n as previously advised.
  • If the package name includes whonix-..., it is a Whonix ™-specific package. In that case, it is safest to press y, but any customized settings will be lost (these can be re-added afterwards). Conflicts like these are relatively rare if Whonix's modular flexible .d style configuration folders are used.

6. Shutdown the Template

Shutdown the Template from Qube Manager: Qube Managerright-click on TemplateShutdown VM or via the contextual menu.

7. Restart/Update Whonix VMs

If new updates were available and installed, it is necessary to either:

  • Restart any running Whonix-Gateway ™ ProxyVMs (sys-whonix) or Whonix-Workstation ™ App Qube instances (anon-whonix) so they are updated; or
  • Apply the same update process in any running VMs if an immediate restart is inconvenient.

Note: If any dom0 packages were upgraded during Qubes system updates, reboot the computer to profit from any security updates.

Non-functional Onion Services[edit]

Sometimes the Debian, Whonix or Qubes onion servers are non-functional. This means updates cannot be completed automatically and an error message similar to below will appear.

user@host:~$ sudo apt-get update
Hit:1 buster/updates InRelease
Hit:2 tor+http://deb.dds6qkxpwdeubwucdiaord2xgbbeyds25rbsgr73tbfpqpt4a6vjwsyd.onion buster InRelease
Ign:3 buster InRelease
Hit:4 buster InRelease
Hit:5 buster Release
Err:7 tor+http://sgvtcaew4bxjd7ln.onion buster/updates InRelease
SOCKS proxy socks5h://localhost:9050 could not connect to sgvtcaew4bxjd7ln.onion ( due to: Host unreachable (6)
Err:8 tor+http://vwakviie2ienjx6t.onion/debian buster InRelease
SOCKS proxy socks5h://localhost:9050 could not connect to vwakviie2ienjx6t.onion ( due to: Host unreachable (6)
Reading package lists… Done
W: Failed to fetch tor+http://sgvtcaew4bxjd7ln.onion/dists/{{Stable project version based on Debian codename}}/updates/InRelease SOCKS proxy socks5h://localhost:9050 could not connect to sgvtcaew4bxjd7ln.onion ( due to: Host unreachable (6)
W: Failed to fetch tor+http://vwakviie2ienjx6t.onion/debian/dists/{{Stable project version based on Debian codename}}/InRelease SOCKS proxy socks5h://localhost:9050 could not connect to vwakviie2ienjx6t.onion ( due to: Host unreachable (6)
W: Some index files failed to download. They have been ignored, or old ones used instead.

Until the onion service is re-established, complete the following steps in Whonix-Gateway ™ (whonix-gw-16) and Whonix-Workstation ™ (whonix-ws-16) to circumvent the issue. [5] [6]

1. Open Debian sources.list in an editor.

Open file /etc/apt/sources.list.d/debian.list in an editor with root rights.

(Qubes-Whonix ™: In TemplateVM)

This box uses sudoedit for better security [archive]. This is an example and other tools could also achieve the same goal. If this example does not work for you or if you are not using Whonix, please refer to this link.

sudoedit /etc/apt/sources.list.d/debian.list

2. Comment (#) the .onion address lines and uncomment the clearnet address lines.

The first two code blocks should look like this; only these blocks require editing.

#deb tor+http://sgvtcaew4bxjd7ln.onion buster/updates main contrib non-free
deb tor+ buster/updates main contrib non-free

#deb tor+http://vwakviie2ienjx6t.onion/debian buster main contrib non-free
deb tor+ buster main contrib non-free

Save and exit.

3. Confirm the clearnet repositories are functional.

sudo apt-get update

4. Optional: Revert and update the package lists.

Consider reverting these changes later on because onion repositories have various security advantages. Afterwards, apply Updates to refresh the package lists.

Updating with Extra Care[edit]

See How-to: Install or Update with Utmost Caution.


  1. See: Installing and updating software in VMs [archive].
  2. [archive]
  3. Steps 1 and 2 can be combined with: upgrade-nonroot
  4. Rollback or indefinite freeze attacks as defined by The Update Framework (TUF) - Threat Model - Attacks and Weaknesses - [archive] - [archive].
  5. If similar issues occur with Whonix or Qubes onion services then follow the same procedure and modify the derivative.list and qubes-r4.list files, respectively.
  6. [archive]

Fosshost is sponsors Kicksecure ™ stage server Whonix old logo.png
Fosshost About Advertisements

Search engines: YaCy | Qwant | ecosia | MetaGer | peekier | Whonix ™ Wiki

Follow: 1024px-Telegram 2019 Logo.svg.png Iconfinder Apple Mail 2697658.png Twitter.png Facebook.png Rss.png Reddit.jpg 200px-Mastodon Logotype (Simple).svg.png

Support: 1024px-Telegram 2019 Logo.svg.png Discourse logo.png Matrix logo.svg.png

Donate: Donate Bank Wire Paypal Bitcoin accepted here Monero accepted here Contriute

Whonix donate bitcoin.png Monero donate Whonix.png United Federation of Planets 1000px.png

Twitter-share-button.png Facebook-share-button.png Telegram-share.png Iconfinder Apple Mail 2697658.png Reddit.jpg 200px-Mastodon Logotype (Simple).svg.png

Do you wonder why Whonix ™ will always be free? Check out Why Whonix ™ is Freedom Software.

https link onion link Priority Support | Investors | Professional Support

Whonix | © ENCRYPTED SUPPORT LP | Heckert gnu.big.png Freedom Software / Osi standard logo 0.png Open Source (Why?)

The personal opinions of moderators or contributors to the Whonix ™ project do not represent the project as a whole.

By using our website, you acknowledge that you have read, understood and agreed to our Privacy Policy, Cookie Policy, Terms of Service, and E-Sign Consent.