All packages must stay up-to-date for security and anonymity purposes.

As Whonix ™ is based on the stable Debian distribution, software is normally "frozen" to the stable Debian version ^[archive] at the point of each major Debian release ^[archive]. The Debian packages page notes: ^[1]

This is the latest official release of the Debian distribution. This is stable and well tested software, which changes only if major security or usability fixes are incorporated.

1. Save Progress and Backup

On rare occasions ^[3] the machine might freeze during the upgrade process. In this case any materials already in progress might be lost, for example documents or other drafts that were created. If this is applicable, save the progress before installing operating system updates. If required, backup all user data -- it is ideal to have a copy of the VM(s) so it is possible to try again (if necessary).

2. Flatpak Update

This step is only required if the user previously manually installed any software using flatpak. Can be skipped otherwise.

• Non-Qubes-Whonix ™

  flatpak update

  flatpak update

• Qubes-Whonix ™ Template:

  http_proxy=http://127.0.0.1:8082 flatpak update

  http_proxy=http://127.0.0.1:8082 flatpak update

3. Update the APT Package Lists

System package lists should be updated at least once per day ^[4] with the latest version information for new/updated packages that are available. To update Whonix-Gateway ™ and Whonix-Workstation ™ packages lists, run.

sudo apt update

The output should be similar to this.

Hit:1 tor+https://deb.debian.org/debian bullseye InRelease                     
Hit:2 tor+https://deb.whonix.org bullseye bullseye                            
Hit:3 tor+https://deb.debian.org/debian bullseye-updates InRelease             
Hit:4 tor+https://fasttrack.debian.net/debian bullseye-fasttrack InRelease
Hit:5 tor+https://deb.debian.org/debian-security bullseye-security InRelease
Hit:6 tor+https://deb.debian.org/debian bullseye-backports InRelease
Reading package lists... Done

If an error message like this appears.

W: Failed to fetch http://ftp.us.debian.org/debian/dist/bullseye/contrib/binary-amd64/Packages 404 Not Found

W: Failed to fetch http://ftp.us.debian.org/debian/dist/bullseye/non-free/binary-amd64/Packages 404 Not Found

E: Some index files failed to download. They have been ignored, or old ones used instead.

Err http://ftp.us.debian.org bullseye Release.gpg
  Could not resolve 'ftp.us.debian.org'
Err http://deb.torproject.org bullseye Release.gpg
  Could not resolve 'deb.torproject.org'
Err http://security.debian.org bullseye/updates Release.gpg
  Could not resolve 'security.debian.org'
Reading package lists... Done
W: Failed to fetch http://security.debian.org/dists/bullseye/updates/Release.gpg  Could not resolve 'security.debian.org'

W: Failed to fetch http://ftp.us.debian.org/debian/dists/bullseye/Release.gpg  Could not resolve 'ftp.us.debian.org'

W: Failed to fetch http://deb.torproject.org/torproject.org/dists/bullseye/Release.gpg  Could not resolve 'deb.torproject.org'

W: Some index files failed to download. They have been ignored, or old ones used instead.

Or this.

500  Unable to connect

Then something went wrong. It could be a temporary Tor exit relay or server failure that should resolve itself. Check if the network connection is functional by changing the Tor circuit and trying again. Running systemcheck might also help to diagnose the problem.

Sometimes a message like this will appear.

Could not resolve 'security.debian.org'

It that case, it helps to run.

nslookup security.debian.org

And then try again.

4. APT Upgrade

To install the newest versions of the current packages installed on the system, run.

sudo apt full-upgrade

Please note that if the Whonix ™ APT Repository was disabled (see Disable Whonix ™ APT Repository), then manual checks are required for new Whonix ™ releases and manual installation from source code.

5. Never Install Unsigned Packages!

If a message like this appears.

WARNING: The following packages cannot be authenticated!
  thunderbird
Install these packages without verification [y/N]?

Then do not proceed! Press N and <enter>. Running apt update again should fix the problem. If not, something is broken or it might be a man-in-the-middle attack, which is not that unlikely because updates are retrieved via Tor exit relays and some are malicious. Changing the Tor circuit is recommended if this message appears.

6. Signature Verification Warnings

No signature verification warnings should appear. If it does occur, it will look like this.

W: A error occurred during the signature verification. The repository is not updated and the previous index files will be used. GPG error: http://deb.torproject.org stable Release: The following signatures were invalid: KEYEXPIRED 1409325681 KEYEXPIRED 1409325681 KEYEXPIRED 1409325681 KEYEXPIRED 1409325681

Caution is warranted even though APT will automatically ignore repositories with expired keys or signatures, and no upgrades will be received from that repository. Unless the issue is already known or documented, it should be reported for further investigation.

There are two possible reasons for this occurrence. Either there is a problem with the repository that is unfixed by contributors or a man-in-the-middle attack has taken place. ^[5] The latter is not a big issue, since no malicious packages are installed. It may also automatically resolve itself after a period of time when a different, non-malicious Tor exit relay is used, or following a manual change of the Tor circuit.

W: A error occurred during the signature verification. The repository is not updated and the previous index files will be used. GPG error: http://deb.torproject.org stable Release: The following signatures were invalid: KEYEXPIRED 1409325681 KEYEXPIRED 1409325681 KEYEXPIRED 1409325681 KEYEXPIRED 1409325681

W: Failed to fetch http://deb.torproject.org/torproject.org/dists/stable/Release  

W: Some index files failed to download. They have been ignored, or old ones used instead.

7. Changed Configuration Files [ link]

Be careful if a message like this appears.

Setting up ifupdown ...
Configuration file `/etc/network/interfaces'
 ==> Modified (by you or by a script) since installation.
 ==> Package distributor has shipped an updated version.
   What would you like to do about it ?  Your options are:
    Y or I  : install the package contributor's version
    N or O  : keep your currently-installed version
      D     : show the differences between the versions
      Z     : background this process to examine the situation
 The default action is to keep your current version.
*** interfaces (Y/I/N/O/D/Z) [default=N] ? N

It is safest to press y, but any customized settings will be lost (these can be re-added afterwards). ^{[6] [7]}

Conflicts like these should be rare if modular flexible .d style configuration folders are used.

See also:

• Reset Configuration Files to Vendor Default
• Configuration Files

8. Restart Services After Updating

To restart services after updating, either reboot.

sudo reboot

Or use the (harder) needrestart method to avoid rebooting. For readers interested in the needrestart method, please click on Expand on the right side.

sudo apt update
sudo apt install needrestart

sudo needrestart

sudo needrestart

No services need to be restarted.

9. Restart After Kernel Updates

When linux-image-... is upgraded, a reboot is required for any security updates to be in effect.

1. Open Debian sources.list in an editor.

Open file /etc/apt/sources.list.d/debian.list in an editor with root rights.

sudoedit /etc/apt/sources.list.d/debian.list

2. Comment (#) the .onion address lines and uncomment the clearnet address lines.

The code blocks should look like this; only these entries require editing. ^[11]

deb tor+https://deb.debian.org/debian bullseye main contrib non-free
deb tor+https://deb.debian.org/debian bullseye-updates main contrib non-free
deb tor+https://deb.debian.org/debian-security bullseye-security main contrib non-free
deb tor+https://deb.debian.org/debian bullseye-backports main contrib non-free
deb tor+https://fasttrack.debian.net/debian bullseye-fasttrack main contrib non-free

#deb tor+http://2s4yqjx5ul6okpp3f2gaunr2syex5jgbfpfvhxxbbjwnrsvbk5v3qbid.onion/debian bullseye main contrib non-free
#deb tor+http://2s4yqjx5ul6okpp3f2gaunr2syex5jgbfpfvhxxbbjwnrsvbk5v3qbid.onion/debian bullseye-updates main contrib non-free
#deb tor+http://5ajw6aqf3ep7sijnscdzw77t7xq4xjpsy335yb2wiwgouo7yfxtjlmid.onion/debian-security bullseye-security main contrib non-free
#deb tor+http://2s4yqjx5ul6okpp3f2gaunr2syex5jgbfpfvhxxbbjwnrsvbk5v3qbid.onion/debian bullseye-backports main contrib non-free

Save and exit.

3. Confirm the clearnet repositories are functional.

sudo apt update

4. Optional: Revert and update the package lists.

Consider reverting these changes later on because onion repositories have various security advantages. Afterwards, apply Updates to refresh the package lists.

Whonix ™ is Supported by Evolution Host DDoS Protected VPS. Stay private and get your VPS with Bitcoin or Monero.

Please help us to improve the Whonix ™ Wikipedia Page. Also see the feedback thread.