Debian's packages through Tor (extras/apt-tor.sh)

SYNOPSIS

wrenctl install apt-tor                     set it up, or choose another bridge
wrenctl remove apt-tor                      apt downloads directly again
wrenctl manual apt-tor                      print the manual steps below

sudo apt update                             goes through Tor from now on

apt downloads Debian's packages through Tor, over https. That changes who can see the download: your network sees that you talk to Tor, not which packages you get or when, and Debian's mirrors see a Tor exit, not your address. It asks first whether you need a bridge to reach Tor (obfs4 or webtunnel with lines you paste, or Snowflake), installs tor, apt-transport-tor and the bridge's program, checks that Tor connects, and only then points apt's Debian sources at tor+https://deb.debian.org and tor+https://security.debian.org. If Tor doesn't connect in 3 minutes, or apt update fails through it, apt is left as it was. install-base.sh offers it as "Network privacy", before anything is downloaded; the answer there is no unless you say yes.

LIMITS

• apt checks every package's signature with or without Tor: this adds no trust in the packages, it hides who downloads what.
• Your network still sees that this computer uses Tor, unless a bridge hides it.
• Downloads are slower, and an update can fail while Tor or a bridge is down. The bar says when updates aren't arriving.
• Other apt repositories you added (Mullvad, Claude Code) are still fetched directly.
• A VPN is a different tool for a different worry: see mullvad-vpn.md, and A VPN before Tor.

MANUAL INSTALL

# Debian starts tor the moment it is installed, and it would connect without
# your bridge: hold it until it is set up
sudo systemctl mask tor.service tor@default.service
# tor, and the program apt uses to go through it (add obfs4proxy or
# snowflake-client for a bridge; for webtunnel, lyrebird: see
# docs/install-base.md, "webtunnel for the system Tor")
sudo apt install --no-install-recommends tor apt-transport-tor

# A bridge, if you need one, at the end of /etc/tor/torrc (obfs4 lines from
# bridges.torproject.org; for Snowflake see data/snowflake-bridges.txt):
#   UseBridges 1
#   ClientTransportPlugin obfs4 exec /usr/bin/obfs4proxy
#   Bridge obfs4 1.2.3.4:443 FINGERPRINT cert=... iat-mode=0
# Bridge lines are private: only root and tor may read the file
sudo chown root:debian-tor /etc/tor/torrc && sudo chmod 640 /etc/tor/torrc

# A mark that tells Wren Linux's other scripts this uses the system tor (so
# OnionShare doesn't block it)
echo 'Written by Wren Linux extras/apt-tor.sh: the system tor service is used for apt.' | sudo tee /etc/tor/.wren-apt-tor

# Start tor now and at every boot, then wait until it has connected: this must
# show "Bootstrapped 100%" (if it doesn't in 3 minutes, stop: check the bridge)
sudo systemctl unmask tor.service tor@default.service
sudo systemctl enable tor.service tor@default.service
sudo systemctl restart tor@default.service
sudo journalctl _COMM=tor -n 200 --no-pager | grep 'Bootstrapped 100%'

# Only now point apt at Tor, keeping a copy of each file you change
# (deb.torproject.org too, if you added it for webtunnel)
for f in /etc/apt/sources.list /etc/apt/sources.list.d/*.sources /etc/apt/sources.list.d/*.list; do
    [ -f "$f" ] || continue
    grep -qE '(^|[^+])https?://((deb|security)\.debian|deb\.torproject)\.org' "$f" || continue
    sudo cp -a "$f" "$f.wren-tor.bak"
    sudo sed -i -E 's#(^|[^+])https?://((deb|security)\.debian|deb\.torproject)\.org#\1tor+https://\2.org#g' "$f"
done
# If this fails, put the copies back (the undo steps below) and try again
sudo apt update

To undo:

# The sources as they were
for f in /etc/apt/sources.list /etc/apt/sources.list.d/*.sources /etc/apt/sources.list.d/*.list; do
    [ -e "$f.wren-tor.bak" ] && sudo mv "$f.wren-tor.bak" "$f"
done
sudo apt update
# The bridge lines in torrc, and the mark
sudo sed -i '/^# >>> Wren Linux apt-tor >>>$/,/^# <<< Wren Linux apt-tor <<<$/d' /etc/tor/torrc
sudo rm /etc/tor/.wren-apt-tor
# Stop tor (unless remote access or the onion site uses it)
sudo systemctl disable --now tor@default.service tor.service
sudo apt purge apt-transport-tor
sudo apt-mark auto tor obfs4proxy lyrebird snowflake-client
sudo apt autoremove --purge