OnionShare Whonix integration development discussion

Made a feature request:

Instructions on getting onionshare to work in Whonix progressed far although they are still unfinished: https://www.whonix.org/wiki/Next#onionshare

Help would be welcome with the following two required control port filter python features that are missing to add onionshare support.

…since I am busy with various stuff, and since @troubadour is busy with various stuff and our new…

source forge help wanted post: https://sourceforge.net/p/forge/helpwanted/programmers/thread/34928768/

Lots of progress has been made. There is a very good chance it will work in Whonix 14.

For reference:

maybe future work:

1 Like

ongoing discussion:
decide if we should install onionshare by default in Whonix 14

2 posts were split to a new topic: hide torbrowser-launcher inside Whonix start menu

Won’t make it into Whonix 14. Unfortunately, it is not available from Debian stretch.


Does anyone know why?

Weird. Its on every Debian version except current stable…

Attempts to build it on Stretch are failing:


Tails is using the onionshare from sid:
It seems Tails is enabling all the repository enabled and then use pin-priority to control where should a package be download and installed from.

cat config/chroot_apt/preferences:

Package: onionshare
Pin: release o=Debian,n=sid
Pin-Priority: 999

Is this a feature that is nice to have in Whonix? Or do we have any concern causing us not to adopt this approach ?


As far I know, Tails doesn’t support full upgrades. Only point release
upgrades. So not comparable wrt upgrades and pinning.

Apt pinning is too complicated and must be avoided. Reasoning:


For those who would like to use or try onionshare…

After cloning Micah’s repository and building the package, there was an issue running it.

I don’t know which version of onionshare the .d onion-grater white list 40_onionshare.yml was written for, but with version 1.2 (as stated in the GUI), I had to add a line to the ADD_ONION command.

Mimicking NEW:BEST Port=

      - pattern: 'NEW:RSA1024 Port=80,(176[0-5][0-9])'
        replacement: 'NEW:RSA1024 Port=80,{client-address}:{} Flags=DiscardPK'

Btw for those who don’t know (information not connected here), instructions can be found here:



0.9.2 most likely.

1 Like
1 Like

It seems onionshare will land on stretch-backports but not stretch:


1 Like

A regression about showing the Whonix advice if onion-grater profile is not active yet in Whonix 15 / debian buster based.

Added support for OnionShare in “bundled Tor” configuration which is the default in Debian buster version of OnionShare.


This will come through Whonix 15 package upgrades at some point in future.

1 Like

Over on tor-dev, this thread makes it very clear that v2 onions are plain dangerous for various reasons.


I note this because the current version of OnionShare from Debian buster (v1.3.2) installed in Whonix defaults to legacy v2 as you can see in my screenshots recently added.

(Which is funny, since if you have a much later Tor version >3.5.X like that provided by Whonix, it is apparently meant to default to v3? Maybe that is only for later OnionShare software version?)

So I guess this might be something where we recommend users default to a later installed version from Sid? (v2.2-2) and take their chances. Bullseye has v2.2. Otherwise they are at real risk of having their ass hacked by capable adversaries.

Debian bullseye = Debian sid = onionshare 2.2-2 at time of writing.

Yes. v2 vs v3 is entirely up to OnionShare, I think. Debian bullseye version uses v3 if I am not mistaken.

Could go back to manual installation instructions.


Can also consider to no longer install by default in Whonix until Whonix is based on Debian bullseye.

1 Like

OnionShare wiki page issues

Why not just use Flatpak for latest version instead (in the appendix part)? Micah has removed build dependencies information for OnionShare - can’t find them anywhere for v2.3.1 They are just pushing snap and flatpak instead for Linux.

This would be easy in non-Qubes-Whonix (only a few steps - see below).

Of course in Qubes-Whonix the AppVM steps would need to be done everytime, but at least you have latest, fully-functional, secure, v3 onions version. The Debian version is ancient and even next testing version is still only v2.2.

With the next Debian release due soon, that means we’ll be stuck with v2.2 for a couple more years - not good enough, because anonymous chat is only available in v2.3 and it is arguably far better/secure than the messengers we recommend in the wiki.

This works ->

In whonix-ws-15-onionshare TemplateVM:

sudo apt-get install flatpak

In whonix-ws-15-onionshare AppVM (not allowed in TemplateVM, any way around that?):

Add the Flathub repository:

flatpak remote-add --if-not-exists flathub https://flathub.org/repo/flathub.flatpakrepo

Install in AppVM (can’t be done in TemplateVM again, any way around that?):

flatpak install flathub org.onionshare.OnionShare

Run in AppVM:

flatpak run org.onionshare.OnionShare

Tested and works nicely with v2.3.1

A pain, but v1.3.2 in Debian is hopelessly out-of-date i.e. doesn’t allow receiving files anonymously, anonymous websites or anonymous chat and only legacy v2 onions i.e. useless by comparison and a security risk.

Also, flatpak instructions are far easier than that build stuff we have on the relevant wikipage right now. If you don’t like the steps above, would this work in both Qubes-Whonix and non-Qubes-Whonix? ->


You can also download and install PGP-signed .flatpak or .snap packages from https://onionshare.org/dist/ if you prefer.

I guess for Qubes -> download in AppVM, get Micah’s key, verify, copy to TemplateVM, install (for persistence). Dunno, I never use Flatpak.

Random error

Do you see this when trying to run standard onionshare in Whonix 15? (I guess I installed Firejail at some stage…). Doesn’t happen with later OnionShare versions > v1.3.2.

Type: “whonix” for help.
uwt INFO: Stream isolation for some applications enabled. uwt / torsocks will be automatically prepended to some commands. What is that? See:
uwt INFO: https://www.whonix.org/wiki/Stream_Isolation/Easy
user@host:~$ onionshare-gui
Reading profile /etc/firejail/onionshare-gui.profile
Reading profile /etc/firejail/disable-common.inc
Reading profile /etc/firejail/disable-devel.inc
Reading profile /etc/firejail/disable-interpreters.inc
Reading profile /etc/firejail/disable-passwdmgr.inc
Reading profile /etc/firejail/disable-programs.inc
Reading profile /etc/firejail/whitelist-var-common.inc
Warning: networking feature is disabled in Firejail configuration file
Parent pid 2023, child pid 2024
Child process initialized in 78.28 ms
/usr/lib/uwtwrapper: line 327: /sbin/ifconfig: Permission denied

Parent is shutting down, bye…

1 Like
[Imprint] [Privacy Policy] [Cookie Policy] [Terms of Use] [E-Sign Consent] [DMCA] [Contributors] [Investors] [Priority Support] [Professional Support]