Actions

Installing Newer Tor Versions

From Whonix


Introduction[edit]

Info Testers only.

It is possible to install newer Tor versions from either:

  • the Whonix ™ repository; or
  • Tor Project APT repositories; or
  • Tor Project source code.

Note that a later Tor version will not always be installed from The Tor Project APT repository -- in the recent past, the Debian buster repositories for packages.debian.org and deb.torproject.org had identical Tor versions. In general, as the Debian stable release ages, the likelihood of receiving a newer Tor version from deb.torproject.org increases.

Whonix ™ APT Repository[edit]

Newer Tor versions can be installed by enabling the Whonix ™ stable-proposed-updates repository in Whonix-Gateway ™ (whonix-gw-15) and then upgrading the system as usual.

The Tor Project APT Repository[edit]

Info If the latest Tor version from deb.torproject.org has not been fully tested by Whonix ™ developers at a specific point in time, then problems can emerge such as broken connectivity. [1] [2] Testers should always maintain a separate, working version of Whonix-Gateway ™ (sys-whonix) so future connectivity problems can be averted.

If you wish to proceed despite the risk, two steps are required:

  • The deb.torproject.org repository must be enabled.
  • The anon-shared-build-apt-sources-tpo [archive] package must be installed, since it enables The Tor Project's apt-get signing key and installs the apt source torproject.list [3]

1. In Whonix-Gateway ™ (whonix-gw-15), update the package lists.

sudo apt-get update

2. Install anon-shared-build-apt-sources-tpo.

sudo apt-get install anon-shared-build-apt-sources-tpo

3. Optional: select an alternative Tor Project distribution for the Tor package.

Open file /etc/apt/sources.list.d/torproject.list in an editor with root rights.

(Qubes-Whonix ™: In TemplateVM)

This box uses sudoedit for better security [archive]. This is an example and other tools could also achieve the same goal. If this example does not work for you or if you are not using Whonix, please refer to this link.

sudoedit /etc/apt/sources.list.d/torproject.list

Comment out deb tor+https://deb.torproject.org/torproject.org [archive] buster main by adding a hash (#) in front of it. Comment in a different distribution [archive] by removing the hash in front of it or by adding a newer deb URI line.

Save the file.

4. Refresh the package lists. [4]

sudo apt-get update

5. Install the (potentially) newer version of the tor package.

This step also installs the deb.torproject.org-keyring package which keeps the Tor Project repository apt key up-to-date.

sudo apt-get install tor deb.torproject.org-keyring

Onionize Tor Project APT Repository[edit]

Only follow these instructions if Newer Tor versions from The Tor Project Repository was configured. Note that The Tor Project deb apt signing key must be added first (see the prior link), or error messages will appear when completing these steps.

Non-Qubes-Whonix[edit]

The following commands are run in Whonix-Gateway ™.

1. Create a torproject.list file using an editor.

Open file /etc/apt/sources.list.d/torproject.list in an editor with root rights.

(Qubes-Whonix ™: In TemplateVM)

This box uses sudoedit for better security [archive]. This is an example and other tools could also achieve the same goal. If this example does not work for you or if you are not using Whonix, please refer to this link.

sudoedit /etc/apt/sources.list.d/torproject.list

2. Cut and paste the following text and comment out (#) the corresponding http repository.

#Tor Project Mirror
#deb http://deb.torproject.org/torproject.org buster main
deb tor+http://sdscoq7snqtznauu.onion/torproject.org buster main

Save and exit.

Qubes[edit]

Info In Qubes R4.0 and above, TemplateVMs do not have network connections by default. This means any attempt to download the apt key in whonix-gw-15 will fail. [5]

Add the Tor Signing Key[edit]

As a workaround, the Tor apt singing key can be fetched from a (networked) anon-whonix AppVM, then copied over to whonix-gw-15 in a text file.

1. Add the Tor Project deb apt signing key.

Run the following command in anon-whonix.

Whonix first time users warning Warning:

The following command using gpg with --recv-keys is not recommended for security reasons and is often non-functional. [6] This is not a Whonix ™-specific issue. The OpenPGP public key should be downloaded from the web instead; see also Secure Downloads. This procedure is currently undocumented and can be resolved as per the Free Support Principle. Documentation contributions will be happily considered.

sudo apt-key adv --keyserver jirk5u4osbsr34t5.onion --recv-keys A3C4F0F979CAA22CDBA8F512EE8CBC9E886DDD89

2. Display the key's fingerprint.

Run.

sudo apt-key adv --fingerprint A3C4F0F979CAA22CDBA8F512EE8CBC9E886DDD89

3. Examine the key's fingerprint.

Compare the fingerprint displayed in the terminal with the one listed at this link: https://2019.www.torproject.org/docs/signing-keys.html [archive] (v2 onion [archive]).

4. Copy the Tor signing key to whonix-gw-15.

In anon-whonix, copy the Tor singing key to a new text file named tor.key.

sudo apt-key export A3C4F0F979CAA22CDBA8F512EE8CBC9E886DDD89 > /tmp/tor.key

In anon-whonix, copy the tor.key text file over to whonix-gw-15.

qvm-copy /tmp/tor.key whonix-gw-15

If the following error appears, it can be safely ignored (hit "OK" when prompted).

 qfile-agent: Fatal error: stat whonix-gw-15-version (error type: No such file or directory)

5. Add the Tor signing key to the list of trusted keys

In whonix-gw-15, run.

sudo apt-key add ~/QubesIncoming/anon-whonix/tor.key

Onionize the Sources File[edit]

1. To onionize Tor Project updates, first create a torproject.list file using an editor.

Open file /etc/apt/sources.list.d/torproject.list in an editor with root rights.

(Qubes-Whonix ™: In TemplateVM)

This box uses sudoedit for better security [archive]. This is an example and other tools could also achieve the same goal. If this example does not work for you or if you are not using Whonix, please refer to this link.

sudoedit /etc/apt/sources.list.d/torproject.list

2. Next, cut and paste the following text and comment out (#) the corresponding http repository.

#Tor Project Mirror
#deb http://deb.torproject.org/torproject.org buster main
deb tor+http://sdscoq7snqtznauu.onion/torproject.org buster main

Save and exit.

Install Tor from Source Code[edit]

All steps should be performed inside Whonix-Gateway ™ (sys-whonix).

1. Add the Debian buster source repository.

echo "deb-src tor+https://deb.debian.org/debian buster main" | sudo tee /etc/apt/sources.list.d/debian-source.list

2. Update the package lists.

sudo apt update

3. Install build dependencies for Tor.

sudo apt-get build-dep tor

4. Fetch the signing key. [7]

Whonix first time users warning Warning:

The following command using gpg with --recv-keys is not recommended for security reasons and is often non-functional. [8] This is not a Whonix ™-specific issue. The OpenPGP public key should be downloaded from the web instead; see also Secure Downloads. This procedure is currently undocumented and can be resolved as per the Free Support Principle. Documentation contributions will be happily considered.

gpg --keyserver keys.gnupg.net --recv-keys 7A02B3521DC75C542BA015456AFEE6D49E92B601

5. Download the Tor source code archive.

scurl-download https://dist.torproject.org/tor-0.4.2.5.tar.gz

6. Download and verify the Tor source code OpenPGP signature.

scurl-download https://dist.torproject.org/tor-0.4.2.5.tar.gz.asc

gpg --verify tor-0.4.2.5.tar.gz.asc

The output should show.

gpg: assuming signed data in 'tor-0.4.2.5.tar.gz'
gpg: Signature made Mon 09 Dec 2019 06:21:51 PM UTC
gpg:                using RSA key 7A02B3521DC75C542BA015456AFEE6D49E92B601
gpg: Good signature from "Nick Mathewson <nickm@alum.mit.edu>" [unknown]
gpg:                 aka "Nick Mathewson <nickm@wangafu.net>" [unknown]
gpg:                 aka "Nick Mathewson <nickm@freehaven.net>" [unknown]
gpg:                 aka "Nick Mathewson <nickm@torproject.org>" [unknown]
gpg: WARNING: This key is not certified with a trusted signature!
gpg:          There is no indication that the signature belongs to the owner.
Primary key fingerprint: 2133 BC60 0AB1 33E1 D826  D173 FE43 009C 4607 B1FB
     Subkey fingerprint: 7A02 B352 1DC7 5C54 2BA0  1545 6AFE E6D4 9E92 B601

7. Extract the Tor source code archive.

tar xvzf tor-0.4.2.5.tar.gz

8. Navigate to the Tor source code folder.

cd tor-0.4.2.5/

9. Run configure and build the binary package.

./configure

make

The build should now be finished.

10. Check the version of the built binary.

./src/app/tor --version

The output should show.

Tor version 0.4.2.5.

11. Qubes-Whonix ™ only: copy the newly built binary to Whonix-Gateway ™ TemplateVM (whonix-gw-15).

qvm-copy ./src/app/tor

12. Stop Tor.

sudo systemctl stop tor

13. Copy the newly build Tor binary to the system.

sudo cp ./src/app/tor /usr/sbin/tor

Copy the binary again. [9]

sudo cp ./src/app/tor /usr/bin/tor

14. Restart Tor.

sudo systemctl start tor

The process of installing Tor from source code is now complete.

Footnotes[edit]

  1. One example in the recent past was a Tor release that contained AppArmor changes which were incompatible with one of Whonix-Gateway ™ (whonix-gw-15)'s configuration files (anon-gw-anonymizer-config [archive]'s /etc/apparmor.d/local/system_tor.anondist [archive]) causing Tor's systemd unit to fail.
  2. Also, at the time of writing Tor v4.2.5 is non-functional in Whonix ™.
  3. Alternatively, The Tor Project's native instructions for Debian [archive] can be used, but the manual steps are more difficult and involved. The verification of The Tor Project apt-get signing key is also harder. Since you already trust Whonix ™, the logical choice is to trust another Whonix ™ package to install the right signing key.
  4. So the newly installed /etc/apt/sources.list.d/torproject.list takes effect.
  5. https://github.com/QubesOS/qubes-issues/issues/1854 [archive]
  6. https://forums.whonix.org/t/gpg-recv-keys-fails-no-longer-use-keyservers-for-anything/5607 [archive]
  7. https://forums.whonix.org/t/gpg-recv-keys-fails-no-longer-use-keyservers-for-anything/5607 [archive]
  8. apt-file list tor shows both locations /usr/bin/tor and /usr/sbin/tor.


Follow: Twitter.png Facebook.png 1280px-Gab text logo.svg.png Rss.png Matrix logo.svg.png 1024px-Telegram 2019 Logo.svg.png Discourse logo.svg

Donate: Donate Bank Wire Paypal Bitcoin accepted here Monero accepted here Contriute

Whonix donate bitcoin.png Monero donate whonix.png

Share: Twitter | Facebook

Please consider a recurring donation [archive]!

https link onion link

This is a wiki. Want to improve this page? Help is welcome and volunteer contributions are happily considered! Read, understand and agree to Conditions for Contributions to Whonix ™, then Edit! Edits are held for moderation.

Copyright (C) 2012 - 2019 ENCRYPTED SUPPORT LP. Whonix ™ is a trademark. Whonix ™ is a licensee [archive] of the Open Invention Network [archive]. Unless otherwise noted, the content of this page is copyrighted and licensed under the same Freedom Software license as Whonix ™ itself. (Why?)

Whonix ™ is a derivative of and not affiliated with Debian [archive]. Debian is a registered trademark [archive] owned by Software in the Public Interest, Inc [archive].

Whonix ™ is produced independently from the Tor® [archive] anonymity software and carries no guarantee from The Tor Project [archive] about quality, suitability or anything else.

By using our website, you acknowledge that you have read, understood and agreed to our Privacy Policy, Cookie Policy, Terms of Service, and E-Sign Consent. Whonix ™ is provided by ENCRYPTED SUPPORT LP. See Imprint.