Whonix ™ 16 Changelog[edit]

Whonix ™ 16 was released on September 11 and 12, 2021 for KVM and VirtualBox. ^{[1] [2]} Qubes-Whonix ™ 16 was released on 28 September, 2021. ^[3] As per the Support Schedule, Whonix ™ 15 was deprecated on 14 November, 2021 -- all users should upgrade as soon as possible. ^[4]

Significantly, Whonix ™ 16 is based on the Debian bullseye (Debian 11) distribution which was officially released ^[archive] on August 14, 2021 instead of Debian buster (Debian 10). The bullseye release has nearly 60,000 packages and around 72 per cent of them were updated. ^[5]

This means users have access to many new software packages in concert with existing packages. In addition, this release will serve as a development foundation for many exciting upcoming security enhancements such as Hardened Malloc Kicksecure ™ (HMK), Linux Kernel Runtime Guard (LKRG) and other items on the Whonix ™ Security Roadmap.

Major Changes[edit]

• Ported the Debian base from Debian 10 buster to Debian 11 bullseye. ^[6]
• Updated Monero GUI wallet (XMR) to version 0.17.2.3.
• Updated Electrum Bitcoin (BTC) wallet to version 4.0.9 (Debian stable version).
• Deprecated the binaries-freedom package; Electrum is now installed from packages.debian.org stable repository. ^[7]
• Switched the tor package back from deb.torproject.org to packages.debian.org stable version. ^[8]
• Enabled Debian Fast Track repository ^[archive] by default. ^[9]
• Updated paths from /usr/lib to /usr/libexec where appropriate as per lintian Debian File System Hierarchy Standard (FHS) ^[archive].
• VirtualBox version: this release utilizes VirtualBox guest additions version 6.1.26-dfsg-3 from fasttrack.debian.net. ^[10]

Known Issues[edit]

• The desktop background image is currently the same for both Whonix-Gateway ™ and Whonix-Workstation ™. This will be corrected in a future release.

Notable Changes[edit]

anon-apt-sources-list ^[archive]:

• Added and enabled fasttrack.debian.net by default. ^{[11] [12]}
• Enabled backports repository by default. ^[13]

anon-gw-anonymizer-config ^[archive]:

• Corrected the setting to ControlPort 9052. ^[14]
• ControlPort 9052 is required for onion-grater updates. ^{[15] [16]}

anon-meta-packages ^[archive]:

• Changed the binaries-freedom dummy dependency to electrum. ^[17]
• whonix-shared-packages-recommended-cli: added kicksecure-recommended-cli. ^[18]
• Removed flashproxy-client and fteproxy from Whonix-Gateway ™ because it is deprecated in Debian bullseye. ^[19]
• Removed obfsproxy (deprecated obfsproxy version 3) but kept obfs4proxy. ^[20]

anon-ws-disable-stacked-tor ^[archive]:

• Provides: obfsproxy, obfs4proxy. ^[21]

apparmor-profile-dist ^[archive] changed settings:

• security-misc /run/faillock/** rwc, ^[22]
• pam security-misc bullseye ^[23]
• /etc/security/ r, ^[24]
• /etc/security/faillock.conf r, ^[25]

apparmor-profile-everything ^[archive]:

• Removed the following file because it was renamed due to usrmerge: rm_conffile /etc/apparmor.d/sbin.networking-aae. ^[26]
• usrmerge - renamed etc/apparmor.d/sbin.networking-aae to etc/apparmor.d/usr.sbin.networking-aae. ^[27]
• usrmerge - renamed sbin/networking-aae to usr/sbin/networking-aae. ^[28]

genmkfile ^[archive]:

• genmkfile deb-install: now install using apt install instead of dpkg -i for dependency resolution (sdwdate vs time-deamon). ^[29]
• Updated make_dependencies_filter_helper. ^[30]
• Excluded the /debian folder from upstream tarball to avoid lintian warning no-debian-changes. ^[31]
• Now force the inclusion of the original source if the Debian package revision number is higher than 1. Also implemented a LKRG package compatibility fix. ^[32]
• Added and improved support for debian/changelog file without epoch. ^{[33] [34]}
• Ensured LKRG v0.9.1 compatibility. ^[35]
• Cleaned up the temporary file debian/$package.dkms.debhelper. ^[36]

helper-scripts ^[archive]:

• etc/apparmor.d/abstractions/tor-circuit-established-check: deny /etc/ssl/openssl.cnf r, is not needed. ^{[37] [38]}
• Implemented /usr/libexec/helper-scripts/first-boot-skel force to ease Default Home Folder Configuration Files Reset. ^[39]
• Moved usr/lib/helper-scripts/ to usr/libexec/helper-scripts and moved usr/lib/curl-scripts to usr/libexec/helper-scripts as per lintian FHS. ^[40]

kicksecure-base-files ^[archive]:

• Set /etc/kicksecure_version to 16. ^[41]

kicksecure-meta-packages ^[archive]:

• Added Chromium to dummy-dependency so it can be removed. ^[42]
• binaries-freedom was replaced with electrum. ^[43]
• Moved obfs4proxy from kicksecure-dependencies-cli to kicksecure-recommended-cli. ^{[44] [45]}
• kicksecure-cli Depends: kicksecure-recommended-cli. ^[46]
• Introduce kicksecure-recommended-cli and install fasttrack-archive-keyring by default. ^{[47] [48]}
• bullseye: ugprade libexo-1-0 to libexo-2-0. ^[49]
• Merged branch "HulaHoop0-master-patch-35409" into "master" and added obfs4proxy and firefox-esr. ^{[50] [51]}
• Added obfs4proxy and firefox-esr. ^[52]

onion-grater ^[archive]:

• Upgraded to a newer onion-grater version by Tails. ^[53]

open-link-confirmation ^[archive]:

• Upgraded to a new upstream version. ^[54]

qubes-whonix ^[archive]:

• Migrated from yum to dnf. ^[55]
• Honor skip-torified-updates-proxy-check qvm-service and reintroduced the ability (from Qubes-Whonix ™ < v15.4) to skip the torified-updates-proxy-check script by enabling a qvm-service. ^{[56] [57]}

rads ^[archive]:

• Ensure a display manager is not started if it was disabled (for example using sudo systemctl disable lightdm). ^[58]

repository-dist ^[archive]:

• Added further legacy tests. ^[59]
• Required change: /etc/apt/trusted.gpg.d/derivative.gpg to /etc/apt/trusted.gpg.d/derivative.asc. ^[60]
• Now use an ASCII armored gpg key; this simplifies code since APT folder /etc/apt/trusted.gpg.d supports ASCII armored gpg keys from Debian bullseye. ^[61]
• Migrated from gnupg2 (dummy transitional package) to gnupg. ^[62]

sdwdate ^[archive] setting changes:

• deny /usr/sbin/ldconfig rix, ^[63]
• Conflicts: time-daemon ^[64]
• Replaces: time-daemon ^[65]
• Reverted “bullseye”: this reverts commit 67222afa9b01c8bba1f814d5c57b1c7632355d6d. ^[66]
• Provides: time-daemon to avoid systemd pulling Depends: systemd-timesyncd. ^[67]
• config-test ^[68]

security-misc ^[archive]:

• Added hardened malloc compatibility for haveged workaround /lib/systemd/system/haveged.service.d/30_security-misc.conf SystemCallFilter=getrandom. ^{[69] [70]}
• Ported from pam_tally2 to pam_faillock since pam_tally2 was deprecated upstream. ^{[71] [72]}
• Enabled apt --error-on=any by default. This makes apt exit non-zero for transient failures, see: /etc/apt/apt.conf.d/40error-on-any. ^{[73] [74]}
• Replaced the no longer required /usr/lib/security-misc/apt-get-wrapper with apt --error-on=any. ^[75]
• Ported LKRG compatibility settings automation for VirtualBox hosts from systemd to dpkg trigger. ^[76]
• Improved the LKRG VirtualBox host configuration, see: VirtualBox host software compatibility ^[archive]. ^[77]
• Added LKRG compatibility settings automation for VirtualBox hosts, see: VirtualBox host software compatibility ^[archive]. ^[78]

systemcheck ^[archive] improved settings:

• Implemented necessary AppArmor changes for bullseye. ^[79]
• Added @{PROC}/sys/kernel/osrelease r, for the systemcheck canary. ^[80]
• Replaced the no longer required /usr/lib/security-misc/apt-get-wrapper with apt --error-on=any. ^[81]

tb-starter ^[archive]:

• Improved the function of tb_prefs_js_file_patches. ^[82]
• Updated the path to the local browser homepage. ^{[83] [84]}
• Deleted /usr/share/tb-profile-i2p/profile.i2p/bookmarks.html because it is unused. ^[85]
• Migrated usr/share/homepage to usr/share/doc/homepage. ^[86]

tb-updater ^[archive] updated versions:

• alpha tbb_hardcoded_version=“11.0a4” ^[87]
• tbb_hardcoded_version=“10.5.5” ^[88]

usability-misc ^[archive]:

• Replaced the no longer required /usr/lib/security-misc/apt-get-wrapper with apt --error-on=any. ^[89]

uwt ^[archive]:

• Migrated usr/lib/uwt_settings_show to usr/bin/uwt_settings_show. ^[90]

vm-config-dist ^[archive]:

• VirtualBox guest additions installer: switched to interest-await trigger. ^{[91] [92]}
• Removed a folder existence conditional to prevent a catch-22 situation. ^[93]

whonix-base-files ^[archive]:

• Updated /etc/whonix_version to 16. ^[94]
• Renamed usr/lib/whonix/whonix.sh to usr/libexec/whonix-base-files/whonix.sh. ^[95]

whonix-developer-meta-files ^[archive]:

• Renamed migrate_to_buster_proposed_updates_repository to migrate_to_proposed_updates_repository.
• Renamed migrate_to_buster_repository to migrate_to_stable_repository.
• Renamed migrate_to_buster_testers_repository to migrate_to_testers_repository. ^[96]
• Modified the warrant canary text as per this change ^[archive]. ^{[97] [98]}

whonix-firewall ^[archive] setting changes:

• TODO: /{,usr/}bin/qubesdb-cmd rUx, ^[99]
• owner /run/updatesproxycheck/** rw, ^[100]
• TODO: /{,usr/}bin/qubesdb-read rUx ^[101]
• After=systemd-modules-load.service is required for LKRG, otherwise iptables modules cannot be auto loaded. ^[102]
• /var/log/journal/{,**} r, ^[103]

whonix-initializer ^[archive]:

• Changed the path. ^[104]

whonix-legacy ^[archive]:

• Updated the version. ^{[105] [106] [107]}
• Multiple improvements to release-upgrade. ^{[108] [109] [110] [111] [112] [113] [114] [115] [116]}
• release-upgrade: fixed and ensure onion sources are respected. ^[117]
• Added a workaround for Qubes-specific perl: warning: Setting locale failed issue. ^{[118] [119]}
• Legacy fixes. ^{[120] [121]}
• Implemented forward port release-upgrade improvements. ^[122]
• Renamed usr/libexec/release-upgrade to usr/sbin/release-upgrade. ^[123]
• release-upgrade script: replaced the apt functionality test package python-qt4 with nano since the former installs too many packages (dependencies) and the latter is installed by default. ^{[124] [125]}
• Ported the release upgrade script to bullseye. ^[126]

whonix-welcome-page ^[archive]:

• Migrated usr/share/homepage to usr/share/doc/homepage. ^[127]

Whonix build script ^[archive]:

• Removed virtualbox-guest-dkms; it is deprecated in Debian (integrated into the kernel). ^[128]
• Implemented fasttrack changes. ^{[129] [130] [131]}
• Migrated .gpg to .asc. ^[132]
• Reverted “build sources, Debian fasttrack: disable temporarily”; this reverts commit 288323a86e2dc037b03e004c62ab3f8ce2b1f616. ^[133]
• Avoided a build dependency on ftpsync (for rsync test script). ^[134]
• VirtualBox builds: switched back to guest additions packages - virtualbox-guest-utils, virtualbox-guest-dkms and virtualbox-guest-x11. (Previously virtualbox-guest-additions-iso.) ^[135]
• VirtualBox builds: temporarily download the virtualbox package from Debian sid until it becomes available from either Debian fasttrack or virtualbox.org. ^{[136] [137]}
• VirtualBox builds: accept both sources of VirtualBox packages - either package virtualbox (by Debian), or package virtualbox-6.1 (by virtualbox.org). ^[138]
• Build sources, Debian fasttrack: disabled temporarily until https://salsa.debian.org/fasttrack-team/support/-/issues/24 ^[archive] is fixed. ^{[139] [140]}
• help-steps/repo_download_chroot_script: fixed for Debian bullseye - updated the order of parameters passed to APT. ^[141]
• Disabled download_virtualbox_packages_virtualbox_guest_additions_iso_from_debian_sid moving to Debian fasttrack version. ^[142]
• Disabled download_virtualbox_packages_virtualbox_org moving to Debian fasttrack version. ^[143]
• Default whonix_build_auto_retry=“0” auto retry function error handler trap lacks variables such as variable APTGETOPT. ^{[144] [145]}
• Added backports and fasttrack to build sources by default to support downloading VirtualBox from Debian fasttrack. ^[146]
• Added build dependencies for maintainers. ^[147]
• Removed python from cowbuilder image. It is no longer necessary because the apt-get-update wrapper is no longer required. ^{[148] [149]}
• Reverted to the Tor version from packages.debian.org (instead of the earlier deb.torproject.org), see: Tor integration in Whonix ™ Development Notes. ^{[150] [151]}
• Removed mmdebstrap copy from the source code; it is no longer required as the Debian bullseye package is sufficient. ^[152]
• python3.9 is no longer required in grml_packages because apt --error-on=any obsoleted any need for a python-based apt wrapper. ^[153]
• Replaced the unnecessary /usr/lib/security-misc/apt-get-wrapper with apt --error-on=any. ^{[154] [155]}

Whonix ™ 16 Updates[edit]

As Whonix ™ is a rolling distribution, users will benefit from regular small security and usability improvements, features and bug fixes as they enter the Whonix ™ stable repository. Those will be announced here.

Whonix ™ 16.0.2.7[edit]

Notable Changes[edit]

anon-gw-base-files ^[archive]:

• Fixed the bullseye background image. ^{[159] [160]}

anon-meta-packages ^[archive]:

• Integrated kicksecure-dependencies-system. ^{[161] [162]}

anon-ws-base-files ^[archive]:

• Fixed the bullseye background image. ^{[163] [164]}

binaries-freedom ^[archive]:

• Added the Debian install file (generated using genmkfile debinstfile). ^[165]
• binaries-freedom is an empty package at present. ^{[166] [167]}

debug-misc ^[archive]:

• dracut. ^[168]
• Removed ‘rhgb’ from GRUB_CMDLINE_LINUX_DEFAULT. ^[169]
• add_dracutmodules+=" debug " ^[170]

grub-live ^[archive]:

• dracut. ^{[171] [172]}
• Fixed and removed dracut kernel_cmdline="rootovl" since that is already conditionally set in the grub boot menu (otherwise the system will always boot into live mode). ^[173]
• Removed dracut hostonly="yes" since that is already the Debian default. ^[174]
• Added dracut support based on friedrich12 / dracut-grub-live ^[archive]. ^{[175] [176]}

helper-scripts ^[archive]:

• Improved diagnostic messages. ^[177]

kicksecure-meta-packages ^[archive]:

• Installed flatpak by default and added it to kicksecure-recommended-cli. ^{[178] [179] [180]}
• Installed extrepo by default and added it to kicksecure-recommended-cli. ^{[181] [182]}
• Switched from lightdm to gdm3 because lightdm autologin is non-functional. ^[183]
• kicksecure-dependencies-system Depends: linux-initramfs-tool, dracut and initramfs-tools. ^{[184] [185]}
• Introduced and integrated kicksecure-dependencies-system. ^{[186] [187] [188]}
• Removed initramfs-tools from non-qubes-vm-enhancements-cli for dracut support. ^[189]
• Introduced kicksecure-qubes-cli and kicksecure-qubes-gui. ^[190]

monero-gui ^[archive]:

• Updated to monero-gui-linux-x64-v0.17.2.3.tar.bz2. ^{[191] [192] [193] [194]}

qubes-whonix ^[archive]:

• Dropped initramfs-tools from qubes-whonix-shared-packages-recommended; this is left to Qubes for dracut support. ^{[195] [196]}

sdwdate ^[archive]:

• Fixed a dependency issue. ^[197]

security-misc ^[archive] improvements:

• Do not set kernel parameter quiet loglevel=0 for recovery boot option for easier debugging. ^[198]
• Moved grub quiet to a separate configuration file /etc/default/grub.d/41_quiet.cfg. ^[199]
• dracut reproducible=yes. ^[200]
• Depends: libpam-modules-bin. ^[201]
• Fixed faillock implementation - dovecot / ssh are exempted. ^[202]
• Fixed and added sshd to pam_service_exclusion_list to avoid faillock. ^[203]

systemcheck ^[archive]:

• Now run check_sudo earlier. ^[204]

usability-misc ^[archive]:

• Removed /etc/lightdm/lightdm.conf.d/autologin.conf (comments only) since it might interfere with autologin. ^[205]

vm-config-dist ^[archive]:

• config-package-dev displaces /etc/gdm3/daemon.conf. ^[206]
• Added and enabled gdm autologin. ^{[207] [208] [209]}
• Added the original /etc/gdm3/daemon.conf. ^[210]
• Fixed autologin. ^{[211] [212]}
• Disabled dracut module resume in VMs since it might break the boot process if built inside chroot. ^[213]
• vbox-guest-installer: recommend, migrate from VirtualBox guest addition ISO to VirtualBox guest addition packages. ^{[214] [215]}

whonix-legacy ^[archive]:

• Updated version. ^[216]
• Improved release-upgrade. ^{[217] [218]}

whonix-xfce-desktop-config ^[archive]:

• Fixed the bullseye background image (actually still broken). ^{[219] [220]}

Whonix ™ 16.0.3.1[edit]

Notable Changes[edit]

anon-gw-base-files ^[archive]:

• Fixed the background image. ^[221]

anon-ws-base-files ^[archive]:

• Fixed the desktop background. ^{[222] [223]}

corridor ^[archive]:

• Changelog. ^[224]

grub-live ^[archive]:

• Fixed grub-live (initramfs-tools version). ^{[225] [226] [227]}

hardened-kernel ^[archive]:

• Added --remote-name. ^[228]

helper-scripts ^[archive]:

• Added `/usr/libexec/helper-scripts/desktop-background-skel-test`. ^[229]
• terminal-wrapper: xfce4-terminal --hold supported since Debian bullseye. ^[230]

kicksecure-meta-packages ^[archive]:

• Fixed and installed policykit-1-gnome by default. ^{[231] [232]}

repository-dist ^[archive]:

• Legacy. ^[233]
• Legacy: upgraded existing `/etc/apt/sources.list.d/derivative.list` to use `[signed-by=/usr/share/keyrings/derivative.asc]`. ^[234]
• Changed `Depends: python3` to `Depends: python3:any` ^[235]
• Removed the no loner required `Depends: gnupg`. ^[236]
• Implemented `Depends: helper-scripts`. ^[237]
• Cleanup and removed legacy transitional package whonix-repository. ^[238]
• Renamed: `usr/share/keyrings/derivative-distribution-signing-key.asc` to `usr/share/keyrings/derivative.asc` and renamed `usr/share/keyrings/derivative-distribution-signify-key.pub` to `usr/share/keyrings/derivative.pub`. ^[239]
• Deleted legacy `/etc/apt/trusted.gpg.d/derivative.asc` because now using `signed-by` and `/usr/share/keyrings/derivative.asc` ^[240]
• Ported to APT sources.list `signed-by`. ^[241]
• Renamed:
  • `usr/share/repository-dist/derivative-distribution-signing-key.asc` to `usr/share/keyrings/derivative-distribution-signing-key.asc` (gpg)
  • `usr/share/repository-dist/derivative-distribution-signify-key.pub` to `usr/share/keyrings/derivative-distribution-signify-key.pub (signify) <sup>[242]</sup>
• Use APT sources.list `signed-by`. ^{[243] [244]}

sdwdate ^[archive]:

• AppArmor fix. ^[245]

security-misc ^[archive]:

• Fixed: unduplicate kernel command line. ^[246]
• Removed Debian buster support in `/etc/default/grub.d`. ^[247]

systemcheck ^[archive]:

• Updated the path APT `signed-by`. ^{[248] [249]}

tb-updater ^[archive]:

• alpha tbb_hardcoded_version="11.0a6". ^[250]
• tbb_hardcoded_version="10.5.6" ^[251]

usability-misc ^[archive]:

• Added --remote-name. ^[252]
• Ported to APT `signed-by`. ^{[253] [254]}

whonix-xfce-desktop-config ^[archive]:

• Fixed the desktop background. ^{[255] [256]}

Whonix ™ 16.0.3.7[edit]

Notable Changes[edit]

anon-apt-sources-list ^[archive]:

• Depends: fasttrack-archive-keyring. ^[257]

anon-gw-anonymizer-config ^[archive]:

• Moved anon-consensus-delete to helper-scripts (as anon-consensus-del). ^[258]

anon-gw-base-files ^[archive]:

• KVM desktop background. ^[259]

anon-meta-packages ^[archive]:

• Moved kicksecure-recommended-cli from whonix-shared-packages-recommended-cli to kicksecure-recommended-cli. ^[260]
• Removed packages pwgen, codecrypt, gpg, gpg-agent, dirmngr, magic-wormhole, diceware, and makepasswd from whonix-workstation-packages-recommended-cli since these will be moved to kicksecure-meta-packages. ^[261]
• No longer install python3-msgpack by default; it is no longer needed and was removed from whonix-workstation-packages-recommended-cli. ^[262]
• Remove legacy packages. ^{[263] [264]}

anon-shared-build-apt-sources-tpo ^[archive]:

• Ensure compatibility with APT signed-by; port to `apt-key-install` by package helper-scripts. ^[265]
• `/etc/apt/sources.list.d/torproject.list`: use APT `signed-by`. ^{[266] [267] [268]}

anon-ws-base-files ^[archive]:

• KVM desktop background. ^[269]

apparmor-profile-everything ^[archive]:

• `sdwdate-aae.service`: Backported changes from sdwdate. ^[270]

grub-live ^[archive]:

• Fixed dependencies. ^[271]

helper-scripts ^[archive]:

• Disabled anondate AppArmor profiles because they are not ready. ^[272]
• `onion-time-pre-script`: Do not use `anondate-set` on Whonix-Workstation ™ because sdwdate can establish onion connections irrespective of Whonix-Workstation ™ system clock (so long as Whonix-Gateway ™ Tor is functional). ^[273]
• `/usr/libexec/helper-scripts/terminal-wrapper`: Added support for adding window title for `xfce4-terminal` emulator through the `terminal_emulator_window_title` environment variable. ^[274]
• anondate-get: If Tor consensus time is later than the system clock, but minimum time is later than the Tor consensus time, show the minimum time instead of no result. ^[275]
• onion-time-pre-script: Added a user check to prevent broken file permissions. ^[276]
• anondate-set: Disabled Tor restart code since it is not needed. ^[277]
• Added `usr/sbin/anon-consensus-del-files`. ^[278]
• Split into `anon-consensus-del` and `anon-consensus-del-files`. ^[279]
• Created a more descriptive file name: `/run/sdwdate/request_tor_restart` → `/run/sdwdate/request_anondate-set`. ^[280]
• anondate: Unduplicated output in journal ^[281] and lowered verbosity to avoid spamming logs. ^[282]
• onion-time-pre-script: Added a counter for how many times a script was run; output. ^[283]
• Added `/usr/libexec/helper-scripts/origins-parser`. ^[284]
• anondate-set: Ensure the system clock is not set backwards. ^[285]
• Updated `minimum_unixtime`. ^[286]
• aa-logprof corrections. ^[287]
• anondate-get: The minimum time is shown instead if it is later than Tor certificate lifetime. ^[288]
• Fixed certificate lifetime parsing by anondate. ^[289]
• Fixed parsing Tor consensus time if Tor has not fetched a Tor consensus yet. ^[290]
• Added anondate output to journal (and therefore sdwdate-log-viewer). ^[291]
• Rebased AppArmor profiles on aa-logprof. ^[292]
• Redesigned recovery from a slow clock. ^[293]
• Imported anon-consensus-del from anon-gw-anonymizer-config. ^[294]

kicksecure-meta-packages ^[archive]:

• Removed fasttrack-archive-keyring from kicksecure-recommended-cli (added to anon-apt-sources-list). ^[295]
• Added pwgen, codecrypt, gpg, gpg-agent, dirmngr, magic-wormhole, diceware, makepasswd to kicksecure-recommended-cli. ^[296]
• Added firefox-esr. ^{[297] [298]}
• Continued removal of Chromium. ^{[299] [300] [301]}
• Legacy fixes. ^[302]

msgcollector ^[archive]:

• Improved `/usr/lib/systemd/user/usertest.service`. ^[303]
• `/usr/libexec/msgcollector/one-time-popup`: Create a folder if not existing (mkdir -p). ^[304]

rads ^[archive]:

• Removed unnecessary `--no-restart-after-upgrade` ("Undo a previous --restart-after-upgrade (or the default of compat 10). If no other options are given, this will cause the service to be stopped in the prerm script and started again in the postinst script."). ^[305]
• Removed `--no-restart-on-upgrade` ("Note that the --no-restart-on-upgrade alias is deprecated and will be removed in compat 14. This is to avoid confusion with the --no-restart-after-upgrade option."). ^[306]
• Added a hint on how to switch virtual console, see: Virtual Consoles. ^[307]
• Added a workaround for issue "no login prompt / getty started on tty1 anymore in Whonix 16 (Debian bullseye based)". Gnome's gdm display manager's systemd unit replaces tty1 even in case gdm is not started. ^{[308] [309]}

sdwdate ^[archive]:

• Improved tests. ^[310]
• Run `/usr/libexec/sdwdate/sdwdate-start-anondate-set-file-watcher` under user/group `sdwdate`. ^[311]
• Renamed: `lib/systemd/system/sdwdate-restart-tor-request-file-watcher.service` → `lib/systemd/system/sdwdate-start-anondate-set-file-watcher.service`. ^[312]
• Renamed: `usr/libexec/sdwdate/sdwdate-restart-tor-request-file-watcher` → `usr/libexec/sdwdate/sdwdate-start-anondate-set-file-watcher`. ^[313]
• Implemented a more descriptive file name: `/usr/libexec/sdwdate/sdwdate-restart-tor-request-file-watcher` → `/usr/libexec/sdwdate/sdwdate-start-anondate-set-file-watcher`. ^[314]
• Implemented a more descriptive file name: `/run/sdwdate/request_tor_restart` → `/run/sdwdate/request_anondate-set`. ^[315]
• Added `/usr/libexec/sdwdate/sdwdate-test`. ^[316]
• Moved sclockadj compilation from a postinst to systemd unit to allow simplification of dependency resolution during release upgrade. ^[317]
• Ported to pathlib fix TypeError: 'missing_ok' is an invalid keyword argument for remove(). ^{[318] [319] [320]}
• Added seccomp utimensat Sep 23 15:37:39 host audit[33040]: SECCOMP auid=4294967295 uid=111 gid=121 ses=4294967295 subj==/usr/bin/sdwdate (enforce) pid=33040 comm="touch" exe="/usr/bin/touch" sig=31 arch=c000003e syscall=280 compat=0 ip=0x70ca67e4bafa code=0x80000000. ^[321]
• Added sdwdate-log-viewer. ^[322]
• Rewrite profile using aa-logprof. ^[323]
• Redesigned recovery from a slow clock. ^[324]
• Ensure Tor consensus is deleted before restarting Tor in `/usr/libexec/sdwdate/sdwdate-restart-tor-request-file-watcher` to increase robustness of recovering from skewed time. ^{[325] [326]}
• Fixed and excluded sdwdate-pre (addgroup) from SystemCallFilter. ^{[327] [328]}
• `usr/libexec/sdwdate/sdwdate-addgroup` → `usr/libexec/sdwdate/sdwdate-pre`. ^[329]
• Fixed sdwdate addgroup if failed during build process. ^[330]

sdwdate-gui ^[archive]:

• sdwdate-gui log viewer: set the window title. ^[331]
• Fixed harmless but nuisance warnings in Qubes R4.1 ^[332] by preventing `sdwdate-gui-shutdown-notify.service` from running inside the Template. ^{[333] [334] [335]}

swap-file-creator ^[archive]:

• `dh_installsystemd --no-stop-on-upgrade`: Use --no-stop-on-upgrade to not stop (and therefore not restart) the swap-file-creator systemd unit after package upgrade since there is no reason to re-create the swap file during upgrade of this package. --no-start is unused because a swap file should be created after installation of this package. dh_installsystemd manpage: --no-stop-on-upgrade "Do not stop service on upgrade. This has the side-effect of not restarting the service as a part of the upgrade." ^[336]
• Lowered the verbosity of output during boot to avoid a "swap file created" message overwriting the console login prompt. ^{[337] [338]}

systemcheck ^[archive]:

• Moved the location of the deprecation popup. ^[339]
• Ensure the deprecation notice is shown during a package upgrade. ^[340]
• Added a deprecation notice popup. ^[341]
• `usr/libexec/systemcheck/canary-download.py` → `usr/libexec/systemcheck/canary-download`. ^[342]
• `etc/apparmor.d/usr.lib.systemcheck.canary` → `etc/apparmor.d/usr.libexec.systemcheck.canary`. ^[343]

tb-updater ^[archive]:

• Update: tbb_hardcoded_version="11.0.1". ^[344]
• Took out the passage about removed backup functionality. ^{[345] [346]}
• Update: alpha tbb_hardcoded_version="11.0a10". ^[347]
• Update: tbb_hardcoded_version="11.0". ^[348]
• Update: alpha tbb_hardcoded_version="11.0a9". ^[349]
• Update: tbb_hardcoded_version="10.5.10". ^[350]
• Further updates: tbb_hardcoded_version. ^[351]

timesanitycheck ^[archive]:

• Updated `/usr/share/timesanitycheck/minimum_unixtime`. ^[352]
• Fixed a typo, renamed `/usr/share/timesanitycheck/date-minium-file-create` → `/usr/share/timesanitycheck/date-minimum-file-create`. ^[353]
• Updated `/usr/share/timesanitycheck/minimum_unixtime`. ^[354]

uwt ^[archive]:

• Added a uwt wrapper for `dnf-3` (for Qubes-Whonix ™ 16 dom0 UpdateVM support). ^{[355] [356] [357]}

whonix-firewall ^[archive]:

• Added an opt-in configuration for outgoing IP filtering through `outgoing_allow_ip_list`. ^[358]

whonix-legacy ^[archive]:

• Improved release-upgrade. ^{[359] [360] [361] [362]}
• release-upgrade: Ensure the meta package is downloaded and installed. ^[363]
• release-upgrade: Abort if no installed meta package has been detected. ^[364]
• release-upgrade: Added meta package detection. ^[365]

whonix-libvirt ^[archive]:

• RAM reduced to 1.5GB ^{[366] [367] [368] [369]}
• Decreased RAM to 256MB, updated descriptionp, and updated the description for activating desktop. ^{[370] [371]}

whonix-xfce-desktop-config ^[archive]:

• KVM desktop background. ^[372]

Whonix build script ^[archive]:

• Re-enabled downloading of Tor from `deb.torproject.org`. ^{[373] [374] [375]}
• CI changes. ^[376]
• Fixed `help-steps/repo_download_chroot_script`. ^[377]
• Whonix ™ KVM: Enable extended L2 entries, and reduced cluster size.
  • I/O perf should improve thanks to extended L2, see: Subcluster allocation for qcow2 images ^[archive].
  • Decreasing cluster size produces smaller images. ^{[378] [379]}

Documentation Updates[edit]

New wiki chapters:

Wiki improvements/enhancements:

Footnotes[edit]

---

---

Fosshost	About Advertisements

---

Search engines: YaCy | Qwant | ecosia | MetaGer | peekier | Whonix ™ Wiki

---

Follow:

Support:

Donate:

Priority Support | Investors | Professional Support

Whonix ™ | © ENCRYPTED SUPPORT LP | Freedom Software / Open Source (Why?)

The personal opinions of moderators or contributors to the Whonix ™ project do not represent the project as a whole.