Automatic Tor Updates

Tor will automatically be updated on the 1st and 15th of every month at 04:00. (Also ask chatgpt.)

Step 1 – Create the update service

Open the service file:

sudo nano /etc/systemd/system/tor-auto-update.service

Enter the following content:

[Unit]

Description=Automatic Tor package update

After=network-online.target

Wants=network-online.target

[Service]

Type=oneshot

Environment=DEBIAN_FRONTEND=noninteractive

ExecStart=/usr/bin/apt-get update

ExecStart=/usr/bin/apt-get install -y --only-upgrade tor tor-geoipdb deb.torproject.org-keyring

ExecStart=/usr/bin/systemctl restart tor.service

Save with:

Ctrl+O

Enter

Ctrl+X

No password will be required later because systemd runs this service as root.

Step 2 – Create the timer

Open the timer file:

sudo nano /etc/systemd/system/tor-auto-update.timer

Enter the following content:

[Unit]

Description=Tor update on the 1st and 15th of every month

[Timer]

OnCalendar=*-*-01 04:00:00

OnCalendar=*-*-15 04:00:00

Persistent=true

[Install]

WantedBy=timers.target

Save with:

Ctrl+O

Enter

Ctrl+X

Step 3 – Reload systemd and enable the timer

sudo systemctl daemon-reload

sudo systemctl enable --now tor-auto-update.timer

Check the timer:

systemctl list-timers --all | grep tor-auto-update

Manual test:

sudo systemctl start tor-auto-update.service

Then check the service:

systemctl status tor-auto-update.service --no-pager

If the service shows:

inactive (dead)

after a successful run, this is normal for a Type=oneshot service.

The important point is that no error code is shown.

Part 2 – Configure the Official Tor Repository

Step 1 – Check existing package sources

echo “=== CONFIGURED PACKAGE SOURCES ===”

sudo grep -RhsE \

‘^[[:space:]]*(deb |Types:|URIs:|Suites:|Components:)’ \

/etc/apt/sources.list \

/etc/apt/sources.list.d 2>/dev/null

echo

echo “=== TOR VERSIONS SEEN BY APT ===”

apt-cache policy tor tor-geoipdb

Step 2 – Detect the system architecture

echo “=== DETECT SYSTEM ARCHITECTURE ===”

ARCHITECTURE=“$(dpkg --print-architecture)”

echo “Architecture: $ARCHITECTURE”

case “$ARCHITECTURE” in

amd64|arm64)

    echo "Architecture supported: OK"

    ;;

\*)

    echo "ERROR: Tor repository configuration does not support $ARCHITECTURE"

    exit 1

    ;;

esac

Typical result on an Intel i3/i5/i7 system:

Architecture: amd64

Architecture supported: OK

Typical result on a 64-bit Raspberry Pi:

Architecture: arm64

Architecture supported: OK

Step 3 – Install required packages

echo “=== INSTALL REQUIRED PACKAGES ===”

sudo apt-get update

sudo apt-get install -y \

apt-transport-https \

ca-certificates \

wget \

gnupg

echo

echo “=== CHECK REQUIRED PROGRAMS ===”

command -v wget

command -v gpg

echo

echo “=== TOR SERVICE STATUS ===”

systemctl is-active tor.service

systemctl is-enabled tor.service

systemctl is-enabled tor@default.service

Step 4 – Download and verify the official Tor repository key

Create a temporary file:

KEYTMP=“$(mktemp /tmp/tor-repository-key.XXXXXX)”

Download the official Tor repository key:

echo “=== DOWNLOAD OFFICIAL TOR REPOSITORY KEY ===”

wget -O “$KEYTMP” \

https://deb.torproject.org/torproject.org/A3C4F0F979CAA22CDBA8F512EE8CBC9E886DDD89.asc

Check the fingerprint:

echo

echo “=== CHECK KEY FINGERPRINT ===”

FINGERPRINT="$(

gpg --show-keys --with-colons “$KEYTMP” 2>/dev/null |

awk -F: ‘$1 == “fpr” {print $10; exit}’

)"

echo “Found: $FINGERPRINT”

echo “Expected: A3C4F0F979CAA22CDBA8F512EE8CBC9E886DDD89”

Verify and install the key:

if [ “$FINGERPRINT” = \

 "A3C4F0F979CAA22CDBA8F512EE8CBC9E886DDD89" \]

then

echo "Fingerprint correct: OK"

gpg --dearmor < "$KEYTMP" |

sudo tee \\

  /usr/share/keyrings/deb.torproject.org-keyring.gpg \\

  >/dev/null

sudo chown root:root \\

  /usr/share/keyrings/deb.torproject.org-keyring.gpg

sudo chmod 644 \\

  /usr/share/keyrings/deb.torproject.org-keyring.gpg

else

echo "ERROR: Fingerprint does not match – installation aborted"

rm -f "$KEYTMP"

exit 1

fi

rm -f “$KEYTMP”

Check the installed key:

echo

echo “=== CHECK INSTALLED KEY ===”

sudo gpg --show-keys --with-fingerprint \

/usr/share/keyrings/deb.torproject.org-keyring.gpg

Check ownership and permissions:

sudo stat -c \

‘File: %n | Owner: %U:%G | Permissions: %A | Size: %s bytes’ \

/usr/share/keyrings/deb.torproject.org-keyring.gpg

Check that Tor remains active:

echo

echo “=== TOR SERVICE STATUS ===”

systemctl is-active tor.service

systemctl is-enabled tor.service

systemctl is-enabled tor@default.service

Step 5 – Add the official Tor repository

The architecture detected earlier is automatically inserted into the repository configuration.

echo “=== ADD OFFICIAL TOR REPOSITORY ===”

ARCHITECTURE=“$(dpkg --print-architecture)”

sudo tee /etc/apt/sources.list.d/tor.sources >/dev/null <<EOF

Types: deb

URIs: Index of /torproject.org

Suites: trixie

Components: main

Architectures: $ARCHITECTURE

Signed-By: /usr/share/keyrings/deb.torproject.org-keyring.gpg

EOF

On a Raspberry Pi this automatically creates:

Architectures: arm64

On an Intel i3/i5/i7 computer this automatically creates:

Architectures: amd64

Display the resulting repository configuration:

echo

echo “=== TOR REPOSITORY CONFIGURATION ===”

cat /etc/apt/sources.list.d/tor.sources

Step 6 – Update package lists

echo

echo “=== UPDATE PACKAGE LISTS ===”

sudo apt-get update

Check which Tor version APT now sees:

echo

echo “=== AVAILABLE TOR VERSION ===”

apt-cache policy tor tor-geoipdb

Step 7 – Install the Tor repository keyring package

echo

echo “=== INSTALL TOR REPOSITORY KEYRING PACKAGE ===”

sudo apt-get install -y deb.torproject.org-keyring

This package keeps the Tor repository signing keys updated through APT.

Step 8 – Update Tor

echo

echo “=== UPDATE TOR ===”

sudo apt-get install -y --only-upgrade tor tor-geoipdb

Step 9 – Restart Tor

echo

echo “=== RESTART TOR ===”

sudo systemctl daemon-reload

sudo systemctl restart tor.service

Step 10 – Check the installation

Check the Tor version:

echo

echo “=== TOR VERSION ===”

tor --version | head -n 1

Check the installed packages:

echo

echo “=== INSTALLED PACKAGES ===”

dpkg-query -W \

-f=‘${db:Status-Abbrev} ${binary:Package} ${Version}\n’ \

tor tor-geoipdb deb.torproject.org-keyring

Check the Tor service:

echo

echo “=== TOR SERVICE ===”

systemctl is-active tor.service

systemctl is-enabled tor.service

systemctl is-enabled tor@default.service

Check which systemd service file is being used:

systemctl show tor.service \

-p FragmentPath \

-p MainPID \

-p LimitNOFILE

Detailed service status:

systemctl status tor.service --no-pager -l

Future Manual Tor Updates

After the repository has been configured successfully, future manual updates only require:

sudo apt-get update

sudo apt-get install -y --only-upgrade tor tor-geoipdb deb.torproject.org-keyring

sudo systemctl restart tor.service

Then check:

tor --version | head -n 1

systemctl status tor.service --no-pager -l