After installing the ws template (with apparmor and user passwords), I installed the Tor browser there as implied by the binary install doc. It gave me a choice of 3 versions and I selected 5.0.3. But when I (re-)made an appvm based on the template and ran* the browser, it said it was version 4.5.3?? :-[ I used the internal browser update function to upgrade to 5.0.3.
The browser would not run from the launcher menu: Apparmor Denial. I had to start it from the shell using ./start-tor-browser.desktop
Version number… That understandable confusion will hopefully be gone with next version, which contains a Qubes specific notice explaining this.
Technically speaking, Tor Browser (must) is stored in home. But an AppVM only inherits the home of its TemplateVM it is based on at VM creation time. Afterwards, AppVM’s home is independent. That’s why tb-updater in a TemplateVM cannot update Tor Browser in AppVMs. The new message preview is here, please have a look: