Whonix on Mac M1 (ARM) - User Support (still unsupported at time of writing)

So did more research, Looks like qemu does not support direct gpu like what parallels do. They have more direct connection with apples hypervisors then what qemu does. As UTM is just a GUI application to qemu then this is what we get. virtio-ramfb-gl seems to be the best graphics mode with gpu acceleration. But it is a bit unstable (notice some as well). If you do not need it you can choose something else. Just wanted to let you know. It will most likely not be supported anything else for a long while (and maybe never) so this is the best for now that is FOSS.

Thanks for a great guide. But I canā€™t get my build to work.

I get the following error,

W: listening on child socket failed:
D: 5028 5784 finish to listen for hooks
E: /home/xxxxxx/derivative-maker/help-steps/pbuilder-debootstrap-command-filter failed
E: debootstrap.log not present
W: Aborting with an error
E: pbuilder create failed
I: forking: rm -rf /var/cache/pbuilder/base.cow_arm64

and

last_failed_bash_command: return ā€œ$cowbuilder_exit_codeā€
############################################################
ā€™
++ unset error_reason
++ ā€˜[ā€™ ERR = INT ā€˜]ā€™
++ ā€˜[ā€™ ERR = TERM ā€˜]ā€™
++ ā€˜[ā€™ ERR = ERR ā€˜]ā€™
++ ā€˜[ā€™ ā€˜!ā€™ 0 = 0 ā€˜]ā€™
++ true ā€˜INFO: dist_build_auto_retry set to 0 (ā€“retry-max). No auto retry.ā€™
++ unset dist_build_auto_retry_counter
++ true
++ ignore_error=false
++ answer=
++ ā€˜[ā€™ ERR = ERR ā€˜]ā€™
++ ā€˜[ā€™ ā€˜ā€™ = true ā€˜]ā€™
++ ā€˜[ā€™ -t 0 ā€˜]ā€™
++ true ā€˜INFO: stdin connected to terminal, using interactive error handler.ā€™
++ true 'ERROR: in ././build-steps.d/1130_cowbuilder-setup detected!

It seems that a lot of packages canā€™t be downloaded because I get ā€œ502 Connection reset by peer [IP: 127.0.0.1 3142]ā€ error on the ā€œaptā€ downloading.

I have also tried with the latest developers tag, but same issue.

Thanks.

Not sure what is wrong then. Can you use https://notes.anonpaste.org/ (make sure to hook off Burn after reading or else it will delete itself right away) and post the entire build log? Kinda hard to see what is wrong with just this.

And just to be sure, can you ping? (you got stable net?), what do you get when you type the command lsb_release -a on the terminal? have you done any changes on image itself? Had any problem downloading or installing anything else before?

Ok. Seems that my apt-cacher-ng is the problem, because I get download problems with ā€œapt installā€ when Iā€™m using the apt-cacher-ng.
I tried the version in backports, but still same error. Is it possible to build without that function?

I can ping deb . debian . org without any problems or loss. I have not done any changes on the image.

lbs_release -a gives this information,

No LSB modules are available.
Distributor ID:	Debian
Description:	Debian GNU/Linux 11 (bullseye)
Release:	11
Codename:	bullseye

Thanks.

Well if you could give out the entire build log it would help out a lot. Also if you get problems with apt install then you should fix that. Maybe try a round of:

$ sudo apt upgrade && sudo apt update

If you cannot upgrade or update. It most likely mean your config at /etc/apt/sources.list is not good.

$ sudo apt install git time curl apt-cacher-ng lsb-release fakeroot fasttrack-archive-keyring

Also remember to download all the dependencies as well.

No.

Not without source code modifications. apt-cacher-ng is used by default on developer machines. https repositories for apt-cacher-ng being able to cache these need to be in a special format. There are already too many. Maintaining a set for apt-cacher-ng vs non-apt-cacher-ng would be too much effort. Thatā€™s why this feature wonā€™t be added.

No special configuration of build machine /etc/apt/sources.list /etc/apt/sources.list.d is required.

Since this is the first time this doesnā€™t work, I also suspect a local configuration issue and not apt-cacher-ng issue.

If Iā€™m running ā€œaptā€ commands without ā€œapt-cacher-ngā€ activated I have no problem at all, as soon as I activate ā€œapt-cacher-ngā€ I have to run ā€œapt upgrade && sudo apt updateā€ like 3-4 times, then it work.

I have tried different debian mirrors in my /etc/apt/sources.list and as stated above, it works without any problem without apt-cacher-ng activated, but as soon as I activate apt-cacher-ng, I got problems with "502 Connection reset by peer [IP: 127.0.0.1 3142]"

And my /etc/apt/sources.list should not have anything with the building to do? Because I think my source.list gets replaced with other repos in the source code? Because when I run a build it does not use any other mirror, just the orginial deb.debian.org.

I have all dependencies installed. For example I have ā€œgcc-10-baseā€ installed already, but the ā€œderivate-makerā€ build is downloading that again. I donā€™t really know how this ā€œderivate-makerā€ build works, but it makes a new environment and downloads packages into that environment? And using ā€œapt-cacher-ngā€ which causes my problems.

here is a paste of the build log,
https://notes.anonpaste.org/?badef3a769d95e85#3JdEBfa3cZf1BswBGADWhezxknmJNdK9Q2GirW78q8af

The problem starts at row 1406.

I have tried to download some of the packages with ā€œwgetā€ and that works just fine.

Cheers! :slight_smile:

I have now successfully built Whonix with 16.0.8.2-stable & imported it into UTM. I use mullvad-vpn on my Mac & in order to make other VMs bypass the VPN & connect via clearnet - I change the networking to Bridged & this works for them without disabling Mullvad (split-tunnelling is not available on the Mac for wireguard/Mullvad) for other work on the same Mac.

The option to change the networking mode is available on other VMs manually created in UTM but is NOT available with the prebuilt Whonix Gateway. I presume that it has to be added/edited in QEMU arguments. Can anyone let me know how that is done? UTM documentation asks to change it in the options but as mentioned this isnā€™t available on the imported Whonix.

Hey!
Iā€™ve faced the same issue with ERROR in /var/lib/dpkg/info/tb-updater.postinst detected!
Trying to build 16.0.8.2-stable using both commands:
~/derivative-maker/derivative-maker --target utm --flavor whonix-workstation-xfce --build --arch
and
~/derivative-maker/derivative-maker --target utm --flavor whonix-workstation-xfce --build --arch arm64 --tb open
The result is same:

INFO: Running connectivity check...  Downloading...: https://sourceforge.net
INFO: CURL_OUT_FILE: /var/cache/tb-binary/.cache/tb/temp/tbb_remote_folder

ERROR: https://sourceforge.net could not be reached.

Possible reasons:
- https://sourceforge.net/projects/tor-browser-ports/files is down
- download location changed

Please check: Start menu -> System -> systemcheck
              or in Terminal: systemcheck
              or in Terminal with debugging: systemcheck -v

If systemcheck reports no problems with internet activity and downloading Tor Browser keeps failing, please report a bug!

(Debugging information: curl_status_message: [6] - [Couldn'\''t resolve host. The given remote host was not resolved.])
INFO: Failing closed. More info:
https://www.whonix.org/wiki/Tor_Browser/Advanced_Users#Tor_Browser_Update:_Technical_Details

####################################################################
## BEGIN ERROR in /var/lib/dpkg/info/tb-updater.postinst detected!
##
## ERROR LOG:
## See above.
##
## BASH_COMMAND: $tool $chroot_maybe --postinst
## EXIT_CODE: 7
##
## END ERROR in /var/lib/dpkg/info/tb-updater.postinst detected!
## Please report this bug!
####################################################################

dpkg: error processing package tb-updater (--configure):
 installed tb-updater package post-installation script subprocess returned error exit status 1
dpkg: dependency problems prevent configuration of whonix-workstation-packages-recommended-gui:
 whonix-workstation-packages-recommended-gui depends on tb-updater | dummy-dependency; however:
  Package tb-updater is not configured yet.
  Package dummy-dependency is not installed.

dpkg: error processing package whonix-workstation-packages-recommended-gui (--configure):
 dependency problems - leaving unconfigured
dpkg: dependency problems prevent configuration of non-qubes-whonix-workstation-xfce:
 non-qubes-whonix-workstation-xfce depends on whonix-workstation-packages-recommended-gui; however:
  Package whonix-workstation-packages-recommended-gui is not configured yet.

dpkg: error processing package non-qubes-whonix-workstation-xfce (--configure):
 dependency problems - leaving unconfigured
Errors were encountered while processing:
 tb-updater
 whonix-workstation-packages-recommended-gui
 non-qubes-whonix-workstation-xfce
E: Sub-process /usr/bin/dpkg returned an error code (1)       '
+ apt_get_exit_code=100
+ true
+ sudo --non-interactive chroot /home/anyone/derivative-binary/Whonix-Workstation-XFCE_image sync
+ sync
+ '[' 100 = 0 ']'
+ true 'ERROR: As expected, failed again to install '\''initramfs-tools' linux-image-arm64 linux-headers-arm64 grub2-common grub-efi-arm64 spice-vdagent serial-console-enable 'non-qubes-whonix-workstation-xfce'\''. (apt_get_exit_code: 100) Trying to diagnose the problem using function apt_get_parse_unmet_dependency...'

Outdated.

Hey all, I followed the guide to a T and am having issues with the latest stable 16.0.9.0 when I try to import my gateway/workstation into UTM. I get the following pop-up message:

Cannot import this VM. Either the configuration is invalid, created in a newer version of UTM, or on a platform that is incompatible with this version of UTM.

Has anyone run into this recently with any of their imports and is there another build that someone can recommend? I plan on trying 16.0.9.1-developers-only tomorrow and will follow up if any luck with that instead. Thanks!

The instructions were clear and everything works like a charm EXCEPT the Monero GUI.
When I click on it from the menu, nothing happens.
When I try to run it from the shell, I get:

bash: /usr/bin/monero-wallet-gui: cannot execute binary file: Exec format error

I tried:

  • updating the package from the default repo
  • purging, then installing the package from the kicksecure tor repo
  • building the package from the kicksecure source code

Nothing works.
FYI the command file returns:

/usr/bin/monero-wallet-gui: ELF 64-bit LSB pie executable, x86-64, version 1 (GNU/Linux), dynamically linked, interpreter /lib64/ld-linux-x86-64.so.2, for GNU/Linux 2.6.32, BuildID[sha1]=e0b2320c6a54c6780ee7c5121a7d12c6be6a6dbd, with debug_info, not stripped

While it should be ARMā€¦ and thatā€™s for every test.
Did you achieve to make it work on your M1 machine? What can I try to do?

I believe the issue was with copying the tar.gz over. It didnā€™t copy the image over as well so I just copied the uncompressed folder and it worked just fine. Thank you.

I built mine from the stable version about a year ago. It worked great, except for crashes when using the GPU-accelerated drivers with gl in the name. I stopped using those and have been updating with upgrade-nonroot. UTM just released a version that is supposed to fix most of those crashes 4.1.5. Now when I try to use the GPU-accelerated drivers it will show the background, but will not load the desktop or taskbar.

Is anyone successfully using the new UTM and the GPU-accelerated drivers?
As a note, the new UTM and GPU-accelerated drivers work fine with a Debian buster guest machine.

2 Likes

You need to build Monero GUI from source.

First uninstall Monero from Whonix: Monero (XMR): A Reasonably Private Digital Currency

Then build from source: GitHub - monero-project/monero-gui: Monero: the secure, private, untraceable cryptocurrency

I just did those. Monero GUI works fine on Whonix UTM M2 Air

Yup, having the exact same issues. (UTM M2 Air)

Package Kicksecure / monero-gui Ā· GitLab contains binaries for Intel / amd64 only.
(Whonix is based on Kicksecure.)

For other platforms, this is only possible as per free support principle, i.e. from Monero upstream.

Found the solution at bugzilla

run xfwm4-tweaks-settings in the VM, select the ā€œCompositorā€ tab, and uncheck ā€œEnable display compositingā€. Then shut down the VM and re-enable

Apparently the compositor does not play nice with virgl drivers. There is a bug report filed, but it doesnā€™t seem to be going anywhere. Performing the above steps allows you to use the GPU-accelerated drivers (at least tested with the ramfb gl driver).

Seem to have an issue cloning any repo because ā€œpackages/kicksecure/monero-guiā€ requires gitlab access approval. I donā€™t remember this ever being an issue.

fatal: Authentication failed for 'https://gitlab.com/kicksecure/monero-gui.git/'
fatal: clone of 'https://gitlab.com/kicksecure/monero-gui.git' into submodule path '/home/snip/derivative-maker/packages/kicksecure/monero-gui' failed
Failed to clone 'packages/kicksecure/monero-gui' a second time, aborting

This is regardless of what branch/tag is used.