Tor will automatically be updated on the 1st and 15th of every month at 04:00. (Also ask chatgpt.)
Step 1 – Create the update service
Open the service file:
sudo nano /etc/systemd/system/tor-auto-update.service
Enter the following content:
[Unit]
Description=Automatic Tor package update
After=network-online.target
Wants=network-online.target
[Service]
Type=oneshot
Environment=DEBIAN_FRONTEND=noninteractive
ExecStart=/usr/bin/apt-get update
ExecStart=/usr/bin/apt-get install -y --only-upgrade tor tor-geoipdb deb.torproject.org-keyring
ExecStart=/usr/bin/systemctl restart tor.service
Save with:
Ctrl+O
Enter
Ctrl+X
No password will be required later because systemd runs this service as root.
Step 2 – Create the timer
Open the timer file:
sudo nano /etc/systemd/system/tor-auto-update.timer
Enter the following content:
[Unit]
Description=Tor update on the 1st and 15th of every month
[Timer]
OnCalendar=*-*-01 04:00:00
OnCalendar=*-*-15 04:00:00
Persistent=true
[Install]
WantedBy=timers.target
Save with:
Ctrl+O
Enter
Ctrl+X
Step 3 – Reload systemd and enable the timer
sudo systemctl daemon-reload
sudo systemctl enable --now tor-auto-update.timer
Check the timer:
systemctl list-timers --all | grep tor-auto-update
Manual test:
sudo systemctl start tor-auto-update.service
Then check the service:
systemctl status tor-auto-update.service --no-pager
If the service shows:
inactive (dead)
after a successful run, this is normal for a Type=oneshot service.
The important point is that no error code is shown.
Part 2 – Configure the Official Tor Repository
Step 1 – Check existing package sources
echo “=== CONFIGURED PACKAGE SOURCES ===”
sudo grep -RhsE \
‘^[[:space:]]*(deb |Types:|URIs:|Suites:|Components:)’ \
/etc/apt/sources.list \
/etc/apt/sources.list.d 2>/dev/null
echo
echo “=== TOR VERSIONS SEEN BY APT ===”
apt-cache policy tor tor-geoipdb
Step 2 – Detect the system architecture
echo “=== DETECT SYSTEM ARCHITECTURE ===”
ARCHITECTURE=“$(dpkg --print-architecture)”
echo “Architecture: $ARCHITECTURE”
case “$ARCHITECTURE” in
amd64|arm64)
echo "Architecture supported: OK"
;;
\*)
echo "ERROR: Tor repository configuration does not support $ARCHITECTURE"
exit 1
;;
esac
Typical result on an Intel i3/i5/i7 system:
Architecture: amd64
Architecture supported: OK
Typical result on a 64-bit Raspberry Pi:
Architecture: arm64
Architecture supported: OK
Step 3 – Install required packages
echo “=== INSTALL REQUIRED PACKAGES ===”
sudo apt-get update
sudo apt-get install -y \
apt-transport-https \
ca-certificates \
wget \
gnupg
echo
echo “=== CHECK REQUIRED PROGRAMS ===”
command -v wget
command -v gpg
echo
echo “=== TOR SERVICE STATUS ===”
systemctl is-active tor.service
systemctl is-enabled tor.service
systemctl is-enabled tor@default.service
Step 4 – Download and verify the official Tor repository key
Create a temporary file:
KEYTMP=“$(mktemp /tmp/tor-repository-key.XXXXXX)”
Download the official Tor repository key:
echo “=== DOWNLOAD OFFICIAL TOR REPOSITORY KEY ===”
wget -O “$KEYTMP” \
https://deb.torproject.org/torproject.org/A3C4F0F979CAA22CDBA8F512EE8CBC9E886DDD89.asc
Check the fingerprint:
echo
echo “=== CHECK KEY FINGERPRINT ===”
FINGERPRINT="$(
gpg --show-keys --with-colons “$KEYTMP” 2>/dev/null |
awk -F: ‘$1 == “fpr” {print $10; exit}’
)"
echo “Found: $FINGERPRINT”
echo “Expected: A3C4F0F979CAA22CDBA8F512EE8CBC9E886DDD89”
Verify and install the key:
if [ “$FINGERPRINT” = \
"A3C4F0F979CAA22CDBA8F512EE8CBC9E886DDD89" \]
then
echo "Fingerprint correct: OK"
gpg --dearmor < "$KEYTMP" |
sudo tee \\
/usr/share/keyrings/deb.torproject.org-keyring.gpg \\
>/dev/null
sudo chown root:root \\
/usr/share/keyrings/deb.torproject.org-keyring.gpg
sudo chmod 644 \\
/usr/share/keyrings/deb.torproject.org-keyring.gpg
else
echo "ERROR: Fingerprint does not match – installation aborted"
rm -f "$KEYTMP"
exit 1
fi
rm -f “$KEYTMP”
Check the installed key:
echo
echo “=== CHECK INSTALLED KEY ===”
sudo gpg --show-keys --with-fingerprint \
/usr/share/keyrings/deb.torproject.org-keyring.gpg
Check ownership and permissions:
sudo stat -c \
‘File: %n | Owner: %U:%G | Permissions: %A | Size: %s bytes’ \
/usr/share/keyrings/deb.torproject.org-keyring.gpg
Check that Tor remains active:
echo
echo “=== TOR SERVICE STATUS ===”
systemctl is-active tor.service
systemctl is-enabled tor.service
systemctl is-enabled tor@default.service
Step 5 – Add the official Tor repository
The architecture detected earlier is automatically inserted into the repository configuration.
echo “=== ADD OFFICIAL TOR REPOSITORY ===”
ARCHITECTURE=“$(dpkg --print-architecture)”
sudo tee /etc/apt/sources.list.d/tor.sources >/dev/null <<EOF
Types: deb
URIs: Index of /torproject.org
Suites: trixie
Components: main
Architectures: $ARCHITECTURE
Signed-By: /usr/share/keyrings/deb.torproject.org-keyring.gpg
EOF
On a Raspberry Pi this automatically creates:
Architectures: arm64
On an Intel i3/i5/i7 computer this automatically creates:
Architectures: amd64
Display the resulting repository configuration:
echo
echo “=== TOR REPOSITORY CONFIGURATION ===”
cat /etc/apt/sources.list.d/tor.sources
Step 6 – Update package lists
echo
echo “=== UPDATE PACKAGE LISTS ===”
sudo apt-get update
Check which Tor version APT now sees:
echo
echo “=== AVAILABLE TOR VERSION ===”
apt-cache policy tor tor-geoipdb
Step 7 – Install the Tor repository keyring package
echo
echo “=== INSTALL TOR REPOSITORY KEYRING PACKAGE ===”
sudo apt-get install -y deb.torproject.org-keyring
This package keeps the Tor repository signing keys updated through APT.
Step 8 – Update Tor
echo
echo “=== UPDATE TOR ===”
sudo apt-get install -y --only-upgrade tor tor-geoipdb
Step 9 – Restart Tor
echo
echo “=== RESTART TOR ===”
sudo systemctl daemon-reload
sudo systemctl restart tor.service
Step 10 – Check the installation
Check the Tor version:
echo
echo “=== TOR VERSION ===”
tor --version | head -n 1
Check the installed packages:
echo
echo “=== INSTALLED PACKAGES ===”
dpkg-query -W \
-f=‘${db:Status-Abbrev} ${binary:Package} ${Version}\n’ \
tor tor-geoipdb deb.torproject.org-keyring
Check the Tor service:
echo
echo “=== TOR SERVICE ===”
systemctl is-active tor.service
systemctl is-enabled tor.service
systemctl is-enabled tor@default.service
Check which systemd service file is being used:
systemctl show tor.service \
-p FragmentPath \
-p MainPID \
-p LimitNOFILE
Detailed service status:
systemctl status tor.service --no-pager -l
Future Manual Tor Updates
After the repository has been configured successfully, future manual updates only require:
sudo apt-get update
sudo apt-get install -y --only-upgrade tor tor-geoipdb deb.torproject.org-keyring
sudo systemctl restart tor.service
Then check:
tor --version | head -n 1
systemctl status tor.service --no-pager -l