There are two different options to enable the Whonix APT repository. Choose one. ^[1]

extrepo setup.

Install package extrepo.

sudo apt install extrepo

Open file /etc/extrepo/config.yaml in an editor with administrative ("root") rights.

Select your platform.

Notes.

Sudoedit guidance: See Open File with Root Rights for details on why using sudoedit improves security and how to use it.
Editor requirement: Close Featherpad (or the chosen text editor) before running the sudoedit command.

Open the file with root rights.

sudoedit /etc/extrepo/config.yaml

Notes.

Sudoedit guidance: See Open File with Root Rights for details on why using sudoedit improves security and how to use it.
Editor requirement: Close Featherpad (or the chosen text editor) before running the sudoedit command.
Template requirement: When using Qubes-Whonix, this must be done inside the Template.

Open the file with root rights.

sudoedit /etc/extrepo/config.yaml

Notes.

Shut down Template: After applying this change, shut down the Template.
Restart App Qubes: All App Qubes based on the Template need to be restarted if they were already running.
Qubes persistence: See also Qubes Persistence
General procedure: This is a general procedure required for Qubes and is unspecific to Qubes-Whonix.

Notes.

Example only: This is just an example. Other tools could achieve the same goal.
Troubleshooting and alternatives: If this example does not work for you, or if you are not using Whonix, please refer to Open File with Root Rights.

Open the file with root rights.

sudoedit /etc/extrepo/config.yaml

Paste at the end.

- contrib - non-free

^[2]

Enable the stable whonix APT repository. (See footnote for other options.) ^[3]

Whonix

sudo extrepo enable whonix

Qubes-Whonix Template (whonix-workstation-18)

sudo http_proxy=http://127.0.0.1:8082 https_proxy=http://127.0.0.1:8082 extrepo enable whonix

Advanced options.

For advanced options such as clearnet over Tor or onion. ^[4]

Please press expand on the right side.

Optional.

Install apt-transport-tor.

Install package(s) apt-transport-tor following these instructions:

Platform specific notice.

Non-Qubes-Whonix: No special notice.
Qubes-Whonix: In Template.

Update the package lists and upgrade the system.

sudo apt update && sudo apt full-upgrade

Install the apt-transport-tor package(s).

Using apt command line <code>--no-install-recommends</code> option is in most cases optional.

sudo apt install --no-install-recommends apt-transport-tor

Platform specific notice.

Non-Qubes-Whonix: No special notice.
Qubes-Whonix: Shut down Template and restart App Qubes based on it as per Qubes Template Modification.

Done.

The procedure of installing package(s) apt-transport-tor is complete.

Find out the filename.

ls -la /etc/apt/sources.list.d/extrepo_*

Note: The filename will be different if using a repository other than the stable repository such as the testers repository.

Open file /etc/apt/sources.list.d/extrepo_kicksecure.sources in an editor with administrative ("root") rights.

Select your platform.

Notes.

Sudoedit guidance: See Open File with Root Rights for details on why using sudoedit improves security and how to use it.
Editor requirement: Close Featherpad (or the chosen text editor) before running the sudoedit command.

Open the file with root rights.

sudoedit /etc/apt/sources.list.d/extrepo_kicksecure.sources

Notes.

Sudoedit guidance: See Open File with Root Rights for details on why using sudoedit improves security and how to use it.
Editor requirement: Close Featherpad (or the chosen text editor) before running the sudoedit command.
Template requirement: When using Qubes-Whonix, this must be done inside the Template.

Open the file with root rights.

sudoedit /etc/apt/sources.list.d/extrepo_kicksecure.sources

Notes.

Shut down Template: After applying this change, shut down the Template.
Restart App Qubes: All App Qubes based on the Template need to be restarted if they were already running.
Qubes persistence: See also Qubes Persistence
General procedure: This is a general procedure required for Qubes and is unspecific to Qubes-Whonix.

Notes.

Example only: This is just an example. Other tools could achieve the same goal.
Troubleshooting and alternatives: If this example does not work for you, or if you are not using Whonix, please refer to Open File with Root Rights.

Open the file with root rights.

sudoedit /etc/apt/sources.list.d/extrepo_kicksecure.sources

Choose either option A) or B).

A) Clearnet over Tor Repository: To enable clearnet over Tor, tor+ needs to be prepended in front of https. In other words, look for Uris: https and replace it with Uris: tor+https .
B) Onion Repository: To enable onion, look for the line starting with Uris:. Delete the whole line. Or comment it out by adding a hash ("#") in front of it. Then add a new line: Uris: tor+http://deb.dds6qkxpwdeubwucdiaord2xgbbeyds25rbsgr73tbfpqpt4a6vjwsyd.onion

Done.

The Whonix APT repository has been enabled.^[5]

Add Signing Key

Complete the following steps to add the Whonix Signing Key to the system's APT keyring.

Open a terminal.

Package curl needs to be installed.

Install package(s) curl following these instructions:

Platform specific notice.

Non-Qubes-Whonix: No special notice.
Qubes-Whonix: In Template.

Update the package lists and upgrade the system.

sudo apt update && sudo apt full-upgrade

Install the curl package(s).

Using apt command line <code>--no-install-recommends</code> option is in most cases optional.

sudo apt install --no-install-recommends curl

Platform specific notice.

Non-Qubes-Whonix: No special notice.
Qubes-Whonix: Shut down Template and restart App Qubes based on it as per Qubes Template Modification.

Done.

The procedure of installing package(s) curl is complete.

Download Whonix Signing Key. ^[6]

Choose your operating system.

If you are using Debian, run.

Choose TLS or onion.

TLS (Debian)

TLS.

sudo curl --tlsv1.3 --output /usr/share/keyrings/derivative.asc --url https://www.whonix.org/keys/derivative.asc

onion (Debian)

Note: Downloading over onion requires an already functional system Tor.

sudo curl --proxy socks5h://127.0.0.1:9050 --output /usr/share/keyrings/derivative.asc --url http://www.dds6qkxpwdeubwucdiaord2xgbbeyds25rbsgr73tbfpqpt4a6vjwsyd.onion/keys/derivative.asc

If you are using a Qubes Debian App Qube, run.

Choose TLS or onion.

TLS (Qubes-App-Qube)

TLS.

sudo curl --tlsv1.3 --output /usr/share/keyrings/derivative.asc --url https://www.whonix.org/keys/derivative.asc

onion (Qubes-App-Qube)

Note: Downloading over onion requires an already functional system Tor.

sudo curl --proxy socks5h://127.0.0.1:9050 --output /usr/share/keyrings/derivative.asc --url http://www.dds6qkxpwdeubwucdiaord2xgbbeyds25rbsgr73tbfpqpt4a6vjwsyd.onion/keys/derivative.asc

If you are using a Qubes Debian Template, run.

Choose TLS or onion.

TLS (Qubes-Template)

TLS.

sudo http_proxy=http://127.0.0.1:8082 https_proxy=http://127.0.0.1:8082 curl --tlsv1.3 --output /usr/share/keyrings/derivative.asc --url https://www.whonix.org/keys/derivative.asc

onion (Qubes-Template)

Note: Downloading over onion requires an already functional system Tor.

sudo http_proxy=http://127.0.0.1:8082 https_proxy=http://127.0.0.1:8082 curl --output /usr/share/keyrings/derivative.asc --url http://www.dds6qkxpwdeubwucdiaord2xgbbeyds25rbsgr73tbfpqpt4a6vjwsyd.onion/keys/derivative.asc

Signing key verification.

Optional. Recommended for Advanced Users only. If you have a good understanding of Verifying Software Signatures you can check the Whonix Signing Key for additional security.

Done.

The procedure of adding the Whonix signing key is now complete.

Add Repository

Add the Whonix APT Repository.

Choose exactly one option: Option A, Option B OR Option C.

Option A: Add the Whonix Onion repository.

This option configures APT to access the Whonix repository via an onion service for maximum network anonymity.

To add the Whonix repository over Onion, first install apt-transport-tor and tor from the Debian repository.

sudo apt install apt-transport-tor tor

Add the Whonix APT repository for the default Whonix setup using Debian stable. At the time of writing, this was trixie.

echo "Types: deb URIs: tor+http://deb.dds6qkxpwdeubwucdiaord2xgbbeyds25rbsgr73tbfpqpt4a6vjwsyd.onion Suites: trixie Components: main contrib non-free Enabled: yes Signed-By: /usr/share/keyrings/derivative.asc" | sudo tee /etc/apt/sources.list.d/derivative.sources

Option B: Add the Whonix clearnet repository via Tor.

This option accesses the clearnet repository but routes all traffic through Tor.

To add the Whonix repository over torified clearnet, install apt-transport-tor from the Debian repository.

sudo apt install apt-transport-tor

Add the Whonix APT repository for the default Whonix setup using Debian stable. At the time of writing, this was trixie.

echo "Types: deb URIs: tor+https://deb.whonix.org Suites: trixie Components: main contrib non-free Enabled: yes Signed-By: /usr/share/keyrings/derivative.asc" | sudo tee /etc/apt/sources.list.d/derivative.sources

Option C: Add the Whonix clearnet repository over clearnet.

This option uses a direct clearnet connection without Tor.

Note: When later using the Whonix repository tool, this configuration will be upgraded to "Clearnet Rep. via Tor", unless noted otherwise. ^[7]

To add the Whonix repository over clearnet, add the Whonix APT repository for the default Whonix setup using Debian stable. At the time of writing, this was trixie.

echo "Types: deb URIs: https://deb.whonix.org Suites: trixie Components: main contrib non-free Enabled: yes Signed-By: /usr/share/keyrings/derivative.asc" | sudo tee /etc/apt/sources.list.d/derivative.sources

The procedure for adding the Whonix APT repository is now complete.

Footnotes

↑
extrepo vs manual:
- Usability:
  - There are some detail usability differences. Using onion connection might be easier with manual method until Whonix gets ported to Debian 13 / trixie because extrepo might get onion support then.
  - Apart from that, extrepo's usability seems generally better.
- Security:
  - A detailed comparative research of both methods is unavailable.
  - If usability is considered a security feature, then extrepo might be considered more secure. This is because users do not have to learn as much about Verifying Software Signatures, OpenPGP, its many Software Signature Verification Usability Issues. Debian which is already trusted by the user providing a trust path to the Whonix signing key. Manual key fingerprint verification not required.
  - The extrepo project is a huge amount of work adding all the signing keys for many different projects. The code for securely downloading a signing key in the Python is not among the most difficult programming tasks to get correct. Compared with curl (written in C), it might be more secure.
- Keeping support for manual method:
  - Removal of the manual method is not planned. Since already written, the maintenance effort for that very part of documentation is low. In case extrepo signing key is outdated, get deprecated, it's easy to switch back to manual method.
↑
The following comments in that file...
```
# - contrib
# - non-free
```
...could be deleted, but that is completely optional.
↑ stable-proposed-updates repository: sudo extrepo enable whonix_proposed testers repository: sudo extrepo enable whonix_testers developers repository: sudo extrepo enable whonix_developers
↑ extrepo feature request: extrepo apt-transport-tor and onion support
↑ forum discussion: extrepo - safely adding repos
↑ See Secure Downloads to understand why curl and the parameters --tlsv1.3 are used instead of wget.

Placing an additional signing key into folder /usr/share/keyrings by itself alone has no impact on security as this folder is not automatically used by Debian's APT by default. Only when an APT sources list configuration file points to folder /usr/share/keyrings using the signed-by keyword the signing key will be actually used. Therefore deleting keys in /usr/share/keyrings is optional if intending to disable an APT repository. See also APT Signing Key Folders.
↑ Unless using repository-dist --transport plain-tls. See also man repository-dist.

Whonix

The most watertight privacy operating system in the world.

Dark mode

Supported by Power Up Privacy

Whonix is proudly supported until 2026 by Power Up Privacy, a privacy advocacy group that seeks to supercharge privacy projects with resources so they can complete their mission of making our world a better place. (Strictly subject to our sponsorship policy.)

At Whonix we value freedom and trust, supporting Open Source and Freedom Software

By using this website, you acknowledge you have read, understood, and agree to be bound by these agreements: Terms of Service, Privacy Policy, Cookie Policy, E-Sign Consent, DMCA, Imprint

2012- 2026 ENCRYPTED SUPPORT LLC

Your support makes
all the difference!

We believe security software like Whonix needs to remain Open Source and independent. Would you help sustain and grow the project? Learn more about our 14 year success story and maybe DONATE!

[1] extrepo vs manual:
Usability:
There are some detail usability differences. Using onion connection might be easier with manual method until Whonix gets ported to Debian 13 / trixie because extrepo might get onion support then.

Apart from that, extrepo's usability seems generally better.

Security:
A detailed comparative research of both methods is unavailable.

If usability is considered a security feature, then extrepo might be considered more secure. This is because users do not have to learn as much about Verifying Software Signatures, OpenPGP, its many Software Signature Verification Usability Issues. Debian which is already trusted by the user providing a trust path to the Whonix signing key. Manual key fingerprint verification not required.

The extrepo project is a huge amount of work adding all the signing keys for many different projects. The code for securely downloading a signing key in the Python is not among the most difficult programming tasks to get correct. Compared with curl (written in C), it might be more secure.

Keeping support for manual method:
Removal of the manual method is not planned. Since already written, the maintenance effort for that very part of documentation is low. In case extrepo signing key is outdated, get deprecated, it's easy to switch back to manual method.

[2] Usability:
There are some detail usability differences. Using onion connection might be easier with manual method until Whonix gets ported to Debian 13 / trixie because extrepo might get onion support then.

Apart from that, extrepo's usability seems generally better.

[3] There are some detail usability differences. Using onion connection might be easier with manual method until Whonix gets ported to Debian 13 / trixie because extrepo might get onion support then.

[4] Apart from that, extrepo's usability seems generally better.

[5] Security:
A detailed comparative research of both methods is unavailable.

If usability is considered a security feature, then extrepo might be considered more secure. This is because users do not have to learn as much about Verifying Software Signatures, OpenPGP, its many Software Signature Verification Usability Issues. Debian which is already trusted by the user providing a trust path to the Whonix signing key. Manual key fingerprint verification not required.

The extrepo project is a huge amount of work adding all the signing keys for many different projects. The code for securely downloading a signing key in the Python is not among the most difficult programming tasks to get correct. Compared with curl (written in C), it might be more secure.

[6] A detailed comparative research of both methods is unavailable.

[7] If usability is considered a security feature, then extrepo might be considered more secure. This is because users do not have to learn as much about Verifying Software Signatures, OpenPGP, its many Software Signature Verification Usability Issues. Debian which is already trusted by the user providing a trust path to the Whonix signing key. Manual key fingerprint verification not required.

[8] The extrepo project is a huge amount of work adding all the signing keys for many different projects. The code for securely downloading a signing key in the Python is not among the most difficult programming tasks to get correct. Compared with curl (written in C), it might be more secure.

[9] Keeping support for manual method:
Removal of the manual method is not planned. Since already written, the maintenance effort for that very part of documentation is low. In case extrepo signing key is outdated, get deprecated, it's easy to switch back to manual method.

[10] Removal of the manual method is not planned. Since already written, the maintenance effort for that very part of documentation is low. In case extrepo signing key is outdated, get deprecated, it's easy to switch back to manual method.

[2] The following comments in that file...
# - contrib # - non-free

...could be deleted, but that is completely optional.

[3] stable-proposed-updates repository: sudo extrepo enable whonix_proposed testers repository: sudo extrepo enable whonix_testers developers repository: sudo extrepo enable whonix_developers

[4] xtrepo feature request: extrepo apt-transport-tor and onion support

[5] rum discussion: extrepo - safely adding repos

[6] See Secure Downloads to understand why curl and the parameters --tlsv1.3 are used instead of wget.

Placing an additional signing key into folder /usr/share/keyrings by itself alone has no impact on security as this folder is not automatically used by Debian's APT by default. Only when an APT sources list configuration file points to folder /usr/share/keyrings using the signed-by keyword the signing key will be actually used. Therefore deleting keys in /usr/share/keyrings is optional if intending to disable an APT repository. See also APT Signing Key Folders.

[7] Unless using repository-dist --transport plain-tls. See also man repository-dist.

[1]

[2]

[3]

[4]

[5]

[6]

[7]

Template:Project-APT-Repository-Add

Contents

Using extrepo

Non-Qubes-Whonix

Qubes-Whonix

Others and Alternatives

A : Non-Qubes-Whonix^™

B : Qubes-Whonix^™ Template

Non-Qubes-Whonix

Qubes-Whonix

Others and Alternatives

Manually

A : Debian

TLS (Debian)

onion (Debian)

B : Qubes App Qube

TLS (Qubes-App-Qube)

onion (Qubes-App-Qube)

B : Qubes Template

TLS (Qubes-Template)

onion (Qubes-Template)

A : Onion Rep.

B : Clearnet Rep. via Tor

C : Clearnet Rep.

Footnotes

Navigation menu

Template:Project-APT-Repository-Add

Using extrepo

Non-Qubes-Whonix

Qubes-Whonix

Others and Alternatives

A : Non-Qubes-Whonix™

B : Qubes-Whonix™ Template

Non-Qubes-Whonix

Qubes-Whonix

Others and Alternatives

Manually

A : Debian

TLS (Debian)

onion (Debian)

B : Qubes App Qube

TLS (Qubes-App-Qube)

onion (Qubes-App-Qube)

B : Qubes Template

TLS (Qubes-Template)

onion (Qubes-Template)

A : Onion Rep.

B : Clearnet Rep. via Tor

C : Clearnet Rep.

Footnotes

Navigation menu

Search

A : Non-Qubes-Whonix^™

B : Qubes-Whonix^™ Template