Opened 3 years ago

Last modified 12 days ago

#12687 new task

Update to Debian documentation

Reported by: qAHt4GGo Owned by: erinn
Priority: High Milestone:
Component: Applications/Tor bundles/installation Version:
Severity: Normal Keywords: needs-triage
Cc: weasel Actual Points:
Parent ID: Points:
Reviewer: Sponsor:

Description

On Debian (I tested on stable (wheezy), testing (jessie) and unstable (sid)), if a user follows the instructions on https://www.torproject.org/docs/debian.html.en, the user still ends up with the Debian version of the package, not the Tor Project repo version. The user must use APT preferences (apt pinning) to prefer the Tor Project repo to the Debian repo in order to ensure that the tor package is installed from Tor Project's repo and not Debian's.

The steps I took to remedy this are as follows:

If the file does not exist, create the file "preferences" in /etc/apt/ with the contents:

Package: *
Pin: origin deb.torproject.org
Pin-Priority: 1001

Package: *
Pin: origin <your default debian mirror address>
Pin-Priority: 500

This should prefer any package in the Tor Project Debian repo that is also in the main Debian repository, even if the package in the Tor Project repo constitutes a downgrade (in the event of a necessary reversion of a broken package).

The 500 for the default Debian repo is just a suggestion. 500 is the default pin priority for the main archive. The value jumps to 990 if the user specifies a target release using apt-get -t so overriding for an individual package functions like normal.

Hope this helps.

Child Tickets

Change History (7)

comment:1 Changed 3 years ago by arma

Cc: weasel added

Really? Is that because currently the deb.tp.o version is the same as the ones in your repository?

I think the current approach, of using the deb.tp.o one when it's newer and not using it when it's not newer, is a good one.

Unless it doesn't work that way?

comment:2 Changed 3 years ago by weasel

Using the higher version is always fine.

The fact that our update to stable put a higher version into debian proper than is available on deb.tpo is slightly unfortunate, but no big deal either.

I see no reason to add any pins.

comment:3 Changed 3 years ago by qAHt4GGo

Yes, since the Debian version and the TP version are the same a lot of the time, APT just installs the Debian version. My method would treat the Tor Project repo as the canonical resource for the tor package, irrespective of version. This way, if the TP repo updates first, you get the updates faster (the whole point of using the TP repo to begin with). You wouldn't need to wait for the Debian repo to be updated. However, even if the versions are the same in both repos when you install (say, right before a version update where it hits TP repo first then Debian repo), you'd be a little bit behind the updates. I know TP is awesome about making updates quickly so the lag is small in practice, but it's still there in theory.

You can check where your version was installed (and where it updates from) by using:
# apt-cache policy tor

The package with the three asterisks is your currently installed package. I did this and realized that Debian had completely circumvented the TP repo.

comment:4 Changed 3 years ago by arma

Fortunately, the Debian maintainer is also the deb.tp.o maintainer.

So I think we're fine here.

Ok to close?

comment:5 in reply to:  4 Changed 3 years ago by qAHt4GGo

Replying to arma:

Fortunately, the Debian maintainer is also the deb.tp.o maintainer.

So I think we're fine here.

Ok to close?

Ah -- OK. So the risk of being on an outdated version of Tor is minimal if not nonexistent if the repos are updated simultaneously. Sounds acceptable to me. Anyone who is looking to override the default APT instructions can do so manually, but that does make sense to keep the current Debian installation the same to minimize the compleixty, especially if the risk of having an outdated package is practically zero.

comment:6 Changed 3 years ago by erinn

Keywords: needs-triage added

comment:7 Changed 12 days ago by teor

Severity: Normal

Set all open tickets without a severity to "Normal"

Note: See TracTickets for help on using tickets.