Archive | Contribute RSS for this section

(End of testing.) Testers-Only version Whonix 7.7.2 Debian Packages

No more testing of this version required.

testers-only, which means apt-get could hang in half-broken state which
can likely be manually fixed. (Advanced Linux users, those comfortable
with Debian sid or so can even fix them themselves.) There is never 100%
security. Having snapshots/backups around is recommended. No
anonymity/privacy/security issues expected. By switching to the
testers-only repository you’ll help a lot improving Whonix and speeding
up development (more eyeballs catching bugs). Stable releases will then
work better for everyone.

If you want to build images from source code:

Currently not possible (or at least very difficult), due to two bugs which have been recently introduced in Debian testing.

It might take a while until these get fixed. I plan to base next Whonix version on Debian stable instead of Debian testing to avoid that kind of build bugs and to avoid

If you want to upgrade from Whonix’s repository:

Switch to Whonix’s ”’testers-only”’ apt repository.

First do these steps on Whonix-Gateway, then repeat on
Whonix-Workstation. There might be small bugs related to
whonixcheck/timesync, and you may need to reboot.


Apply changes to which Whonix apt repository will be used.

sudo -E whonix_repository

The usage of the whonix_repository tool will be greatly simplified after
this upgrade, because a graphical user interface has been added so it
becomes easier to switch around.

Update and upgrade.

sudo apt-get update
sudo apt-get dist-upgrade

If you want to upgrade from source code:

The tag for this ”’testers-only”’ version is ”’7.7.2”’ (don’t use 7.3.7). Please refer to and see “Build Documentation for upgrading Whonix debian packages from source code”.

Bonus: this is the first upload of Whonix’s Debian Packages that is
verifiable [1]. If one would care to check if they can get the same
checksums as uploaded to Whonix’s repository, that’ll be awesome.


Changelog between Whonix 7 and Whonix 7.7.2 (testers-only version):

  • In new installations, automatic updates of Whonix’s debian packages are disabled by default. During first start, users can decide if they want to enable Whonix’s APT repository or want to leave it disabled.
  •  Fixed Whonix’s Tor Browser download and start script for TBB 3.5.
  • Fixed physical isolation build script.
  • Verifiable Builds. Whonix now has a feature which allows the community to check that Whonix .ova releases are verifiably created from project’s own source code. Also made ade Whonix’s APT repository verifiable (even deterministic!). Please see for details.
  • Made Whonix build script configurable (can now build terminal-only Whonix-Gateway’s and/or Whonix-Workstations; 64 bit builds and more)
  • Improved Whonix News’s security. All Whonix News Files are now inside one tarball, which is signed. This stops leaking how many users are using a particular version.
  • whonixcheck’s Whonix News download now checks if Whonix News are still valid (currently up to 4 weeks) and therefore detects indefinite freeze and replay attacks.
  • whonix_repository tool now has a graphical user interface; added more command line switches.
  • Set default locale to en_US.UTF-8.
  • Simplified custom user installation of TorChat, thanks to dummytor.(Protecting from Tor over Tor.)
  • Removed apper and synaptic from default installation, because they are too confusing / have too many bugs, do not always work in all cases for all users, #104, can still be manually installed if wanted, see also
  • whonixcheck: more configuration options, any function can now be disabled, this is useful for users who wish to disable control port filter proxy, they can disable the check_tor_bootstrap function
  • whonixcheck: added protection against possibly malicious strings from (in case of a bug, compromise of check.tpo server or CA compromise), IP strings are now max 50 characters long. User will be warned in case the limit is exceeded.
  • Whonix-Workstation: no longer installing Tor Browser by default, this simplified implementing verifiable builds (#113), installing iceweasel by default, which can be used to download Tor Browser, added local iceweasel browser homepage saying that iceweasel should not be used for anything other than downloading Tor Browser, unless one knows what one is doing.
  • Removed galternatives from whonix-workstation-default-applications because galternatives has been (temporarily) removed from Debian testing
  • Building Whonix from frozen repository, from to make the build script more resistant from upstream changes and also to
    make Whonix verifiable.
  • The Whonix Team can now use separate keys for Whonix’s APT Repository and Whonix News.
  • Added technical documentation about keys in Whonix whonix_shared/usr/share/whonix/keys/readme.
  • new man page: man/whonix_shared/sdwdate.8.ronn
  • Deactivated Maximizing Windows by dragging them to the top of the screen to prevent users from accidentally maximizing their browser window when they are using resolutions higher than 1024×768. See ; and for more information. #108
  • added udisks to whonix-shared-packages-recommended for mounting removable drives
  • KDE settings changes, set to oxygen as suggested by scarp in “[Whonix-devel] Plastique kwin style & Widget Style”
  • whonixcheck: increased timeout for the tor utility from 5 to 10 seconds to make it compatible with slow systems as per bug report….html
  • added secure-delete, because it contains sfill, which can be used to zero out free space, which is required for disk shrinking
  • Deactivated running update-command-not-found during build, since not deterministic (verifiable). Manually running is of course still possible.
  • whonix_shared/etc/apt/sources.list.d/torproject.list: removed the “deb tor-0.2.4.x-jessie main” repository, since that repository has been removed by The Tor Project (Tor is now in their Debian testing repository, which is already added)
  • fixed a bug reported by scarp, whonix_shared/usr/share/whonix/postinst.d/70_disable_kdm_autostart: was not disabling other display managers other than kdm. Now using the more generic
  • msgcollector: fix race condition not always closing progress bar when it reached 100%
  • Whonix-Gateway: Workaround for
    new_tor_and_debian_updates_today….html Set in /etc/default/tor: USE_AA_EXEC=”no” Can be commented out when that bug gets fixed.
  • optionally (opt-in) building qcow2 images, first rudimentary implementation, build target (VirtualBox or qcow2 or both) should probably be configurable in whonix_build script (#122)
  • Whonix News Blog Download / Whonix News: Whonix News Blogs (Whonix Feature Blog and Whonix Important Blog) are now deployed over the same mechanism as Whonix News.
  • Improved messages.
  • Lots of smaller fixes.
  • Code refactoring.
  • For more details, see the git log.


Hosting a Whonix Mirror (New Wiki Entry)

We are making some DNS changes, so the site may be a little broken for a few days. The .onion address should continue to work 100%.

Running a mirror for Whonix can be immensely helpful, but takes some knowledge, proper configuration and adequate resources to be truly useful.

Other Desktop Environments (New Wiki Entry)

Downloadable Whonix versions come with KDE installed by default. It is possible to uninstall KDE, although doing so is a bit difficult, especially if you want to uninstall all of it and/or to to use a CLI version and/or to install their own desktop environment such as Gnome, LXDE, etc.

Users who build Whonix from source code using Dev/Build Documentation can use optional Terminal-Only build configuration option. And then decide from there.

Read more:

Whonix Project looking for Translations Coordinator

Whonix is an anonymous general purpose operating system based on Virtual Box, Debian GNU/Linux and Tor. It has its focus on anonymity, privacy, security and usability.

The Whonix project is looking for a volunteer.

Your task:

– Join us with
– Reading translation extension’s documentation for mediawiki. [1] – Getting new translators started.
– Maybe translate into your native language.
– Coordinate translations.

If you are interested, please sign up for the Whonix Developer Mailing List [2] and say hello.

[1] [2]

MAC Spoofing Development

Tails developers are working on MAC spoofing. If you care about this feature which might get used in Whonix some day. At least their thoughts on that topic are very valuable. You may be interested to join their Whonix unspecific development discussion:

[Tails-dev] [RFC] Design (and prototype) for MAC spoofing in Tails

Physical Isolation instructions available for Whonix 7.3.7! Testers wanted!

Advanced users only!

The Whonix 7 build script has been fixed for users of Whonix with physical isolation.

The instructions for building a physically isolated Whonix-Gateway and Whonix-Workstation have been updated and improved:

Please test and leave feedback.

Whonix 7.3.7 Source-Code-Only no download Version Released! Testers Wanted!

The original Whonix 7 source code can be no longer build, because several packages have been removed from Debian Testing’s and Torproject’s apt repository. This version is intended for those who want to build from source code. The build script has been fixed.

Users of the Whonix 7 Default-Download-Version do not have to do anything yet.

To make the build script more resistant against changes in upstream apt repositories, it is planned to build from frozen repositories, i.e. from


* Fixed physical isolation build script.
* (Temporarily) removed galternatives from Whonix-Workstation because it has been (temporarily) removed from Debian.
* Whonix APT Repository disabled with default settings for physical isolation users.
* Whonix APT Repository disabled with default settings for builders from source code.
* Added new optional /etc/whonix_buildconfig.d folder.
* Added new optional Terminal-Only build configuration.
* Added new optional NoDefaultApps build configuration.
* Fixed build script (because torsocks and tor-arm have been apparently removed from torproject’s apt repository, because apt-cacher-ng and galternatives has been (temporarily) removed from Debian Testing). * Reduced steps required for an optional installation of TorChat. * Set default $LANG and locale to en_US.UTF-8.
* Lots of other improvements and bug fixes which can be found under the git log.

Known bugs:

* If you want to use the whonix_repository GUI tool on
Whonix-Workstation, you need to install the dialog package.

Building Whonix From Source Code, Whonix APT Repository, Trust and Terminal-Only

Whonix APT Repository and Trust 

Your feedback has been appreciated. Users who build Whonix VMs or physical isolation from source code will do no longer have to change any settings or environment variables in order to disable Whonix’s APT Repository. It is now disabled by default. You could opt-in if you wanted. You could also later update Whonix debian packages from source code if you wanted. This has been implemented in Whonix’s source version 7.3.3 and above. (Latest git tag at time of writing: 7.3.7.)

Build documentation [1], Physical Isolation instructions [2], and the Trust page [3] has been updated accordingly.




Terminal-Only (No-GUI) (No-KDE) Whonix-Gateway/Workstation 

The optional possibility to easily build your own Terminal-Only Whonix-Gateway and or Whonix-Workstation, VM or physically isolated machine has been added to Whonix’s source code.