Whonix on Mac M1 (ARM) - User Support (still unsupported at time of writing)

More to try.

sudo apt purge dummy-dependency
sudo apt-get install tb-updater tb-starter tb-default-browser
sudo apt purge dummy-dependency
sudo apt-get install tb-updater tb-starter tb-default-browser electrum
sudo apt-get install tb-updater tb-starter tb-default-browser electrum monero-gui
sudo apt-get install non-qubes-whonix-workstation-xfce
sudo apt-get install non-qubes-whonix-workstation-cli
sudo apt-get install uwt
sudo apt-get install bindp
sudo apt-get install kloak
sudo apt-get install tirdad

More background information:

Now I think I am onto something, what might be happening. Some architecture specific package (list in above link) isn’t available for arm64. This results in the dummy-dependency package being pulled as dependency instead. That however then prevents other “optional dependencies” from getting pulled as dependency.

I looked at the settings in utm for the workstation, and it does have the corrected QEMU setting in it from that edit. I built from 16.0.2.8-developers-only.

Also, the plist for workstation that you linked to seems to have been updated as well? This is why I was confused.

If I am missing something, let me know. I will get it eventually. :slightly_smiling_face:

Here is the output on a clean workstation: https://anonpaste.org/?51d67ff9474b12fd#CLWaPgj9ap2fr2wfkUUsdjs6WkVueVWPJRarj1r7F15T

So you updated the wiki? just wondering. How do i know that the debian bullseye UTM file is safe? wouldnt it be better to direct people to debian download page and how to set it up? again idk. I am just paranoid when someone gives me a file and idk where it is from.

Also on the build command are we still gonna use --tb open on workstation? so that the commands are like this:

sudo ./whonix_build --target utm --flavor whonix-gateway-xfce --build --arch arm64
sudo ./whonix_build --target utm --flavor whonix-workstation-xfce --build --arch arm64 --tb open

If i remember correctly from a earlier guide that was given here?

MacOS: Difference between revisions - Whonix

If not needed then forget this part.

But as i have understood from this so far. There is most likely a dependency crash bug on the arm builds that makes tb-browser not get installed correctly. And there is for the moment no way to download the Tor Browser because the file does not exist on the repo at the moment.

So for the moment, we have to find the bug, fix it and rebuild the project to make it work correctly?

Ya, the vm was me being lazy. It took me less time to make the image and upload it then to explain how to do it (I mean literally 5 minutes). I will have to get around to that I suppose.

I have never used --tb open. I am not sure what it does. The builder of the arm64 packages of TBB needs to update his packages to use the new GPG method. Earlier in the thread Patrick posted a link to instructions for manually installing TBB (not packages from the repo I guess, didn’t read it yet).

I think the whole point with manually getting it to work is meaningless. The point should be to make it work when building and possibility to update it with just the upgrade-nonroot command. This should not be just a project for developers and IT experts like us. But for anyone who wants to use Tor safe.

Would be amazing if we one day could publish finished utm files of the workstation and gateway for Apple silicon.

I documented --tb open in a past version Whonix for macOS: Download and Installation but then it was edited and removed.

  • set build parameter --tb open will result in tb-updater (Tor Browser Downloader by Whonix ™ developers) attempting to download Tor Browser during the build process but fail open (continue the build without error) should the download fail. At time of writing, Tor Browser download will fail but that is OK as far as the build process is concerned.

Yes.

Seems outdated.

It wasn’t updated.

https://github.com/Whonix/whonix-libvirt/blob/master/usr/share/whonix-utm/Whonix-Gateway.plist is still using

-device virtio-net-pci,netdev=external
user,id=external,ipv6=off,net=10.0.2.0/24
-netdev socket,id=internal,listen=:8010 \

No further commits were made since initial version:

This forum post is valid until 15 January 2022. Do not apply these instructions after that date.

Nothing special happening on this date but this isn’t something useful to to try to fix arbitrary different issues in 1 year from now.

These instructions are for an already built image.

The updated meta packages (see my preview forum post) should make it much less likely of falsely getting the dummy-dependency package installed or even fix this issue alredy.

  1. enable Whonix developers repository as per Whonix APT Repository

The goal must be to not have the now “catch-all” dummy-dependency package as well as having as few dummy-dependency-... packages as possible. Not all packages by Whonix are available (yet) for the arm64 platform.

sudo apt purge dummy-dependency
sudo apt-get install tb-updater tb-starter tb-default-browser

sudo apt purge dummy-dependency
sudo apt-get install tb-updater tb-starter tb-default-browser electrum

sudo apt-get install tb-updater tb-starter tb-default-browser electrum monero-gui
sudo apt purge dummy-dependency

sudo apt-get install non-qubes-whonix-workstation-cli
sudo apt purge dummy-dependency

sudo apt-get install non-qubes-whonix-workstation-xfce
sudo apt purge dummy-dependency

sudo apt-get install uwt
sudo apt purge dummy-dependency

sudo apt-get install bindp
sudo apt purge dummy-dependency

sudo apt-get install kloak
sudo apt purge dummy-dependency

sudo apt-get install tirdad
sudo apt purge dummy-dependency

sudo apt-get install hardened-malloc
sudo apt purge dummy-dependency

sudo apt-get install non-qubes-whonix-workstation-cli
sudo apt purge dummy-dependency

sudo apt-get install non-qubes-whonix-workstation-xfce
sudo apt purge dummy-dependency

  1. downgrade Whonix repository to something other than developers repository

background information:
kicksecure-meta-packages/debian/control at master · Kicksecure/kicksecure-meta-packages · GitHub

This is included in git tag:

16.0.3.8-developers-only

Another idea if dummy-dependency still get installed during the build process would be to simply remove that package from the source code.

file:

~/Whonix/packages/kicksecure-meta-packages/debian/control

Look for:

Package: dummy-dependency
Architecture: all
Depends: ${misc:Depends}
Provides: tb-updater, tb-starter, tb-default-browser,
 qubes-core-agent-passwordless-root,
 firefox-esr
Description: dummy package to satisfy architecture specific dependencies
 A metapackage, which satisfies the dependency on:
 .
  - tb-updater
  - tb-starter
  - tb-default-browser
  - qubes-core-agent-passwordless-root
  - firefox-esr
 .
 This package cannot provide a real implementation of that package. It is only
 a dummy to satisfy the dependency.
 .
 Safe to remove if its removal does not remove another metapackage, which is
 not safe to remove.

And delete that text or out comment.

In that case, it would probably be easiest to add to build command line:

–allow-untagged true --allow-uncommitted true

That might actually break the build but it could be progress in finding out which package isn’t available for arm64, if still any.

Aha! Gateway. The edit seemed to apply to just the workstation, and that does have what the edit suggests.
As for the gateway, I am unsure what to change. I see that it has networking disabled, so I assumed the netdev=external bit was for the gateway to access the internet. I guess I will discuss it with the utm developer to see if enabling networking on the Gateway and removing external would be better?

You can try that but I don’t see much chance there. utm is just a wrapper around qemu as far as I understand and neither qemu nor utm developers might have all the context of what Whonix is doing in mind.

So tried building whonix on the new “16.0.3.8-developers-only” git tag. And workstation crashed when i build it.

Also still kinda unsure what need to be changed on the .plist for workstation and gateway for UTM builds.

Is something gonna happen 15 of January 2022?

Highly unlikely related to the newer git tag. Does not do anything fancy. More likely too less RAM in VM. To debug, please create a separate forum thread.

I don’t understand. What’s the contextual significance of that date?

Is what i was talking about.
But i might have read that to fast. Is it that the commands postet on that post does no longer apply because of some new update? did not understand fully.

I had 6G of Ram on the debain VM while compiling. But i will follow your advice and post a new forum thread about my problems if i still get problems after some more tries.

Also wondering what is wrong with the config files for UTM.
Is there any?

If so, what need fixing? maybe i can do a push request?

Please refer to my earlier posts on this not too long ago.

No update. Nothing special.
Everything can go wrong will go wrong.
I just don’t want anyone to follow this in 1 year from now similar to a forum post referencing “buster”.
Was thinking “how can I say something without someone else trying this as an issue solution in 1 year from now?”

I have had problems building the newest build of whonix on arm. It seems like when i try to build the workstation the build will fail.

I am currently using a macbook pro with m1pro.
And running a wm of debian 11.2 bullseye on wm with 4 cores and 6G ram enabled for the wm.
I have builded this before on earlier version of Whonix as referenced on the whonix m1 thread.
To make sure its nothing wrong with what i have typed i have used 3 different type of commands as referenced here:

Try 1

git clone --depth=1 --branch 16.0.3.8-developers-only --jobs=4 --recurse-submodules --shallow-submodules https://gitlab.com/whonix/Whonix.git

sudo ./whonix_build --target raw --flavor whonix-gateway-xfce --build --arch arm64
sudo ./whonix_build --target raw --flavor whonix-workstation-xfce --build --arch arm64

Build log result:

https://anonpaste.org/?64bb0dbd880b5189#E5YGLf1epPrprhrwQbamvapyHAJfp7bZ8RTrSHVtLywT

Try 2

git clone --depth=1 --jobs=4 --recurse-submodules --shallow-submodules https://gitlab.com/whonix/Whonix.git

sudo ./whonix_build --target raw --flavor whonix-gateway-xfce --build --arch arm64
sudo ./whonix_build --target raw --flavor whonix-workstation-xfce --build --arch arm64

Build log result:

https://anonpaste.org/?d0a15ad14cd5c201#GH8YnzcPqNh8A8apEhnNJuj48XFL4TvRCmSJqvo8grFb

Try 3

git clone --depth=1 --jobs=4 --recurse-submodules --shallow-submodules https://gitlab.com/whonix/Whonix.git

sudo ./whonix_build --target raw --flavor whonix-gateway-xfce --build --arch arm64 --allow-untagged true --allow-uncommitted true
sudo ./whonix_build --target raw --flavor whonix-workstation-xfce --build --arch arm64 --allow-untagged true --allow-uncommitted true

Build log result:

https://anonpaste.org/?c8d543cd6caa8929#jjBtJGBBd1oHAoEuZRuY8y5LFr7XaxK2eSJdGz4V2D3

Unfortunately i could not make this work on neither the 16.0.3.8-dev-only or the master repo. Maybe i am using some commands wrong? or there might be something else. I have pulled the repository today so this should be the newest version as of this post date.

It’s not a crash. The build is failing.

A crash is something else. A crash is for example if the whole VM terminates. Or if the whole VM freezes. A freeze is perhaps a subset of a crash but shouldn’t be called a crash.

Terminology is important. I requested a different forum thread because a crash would be a very different issue than a simply failing build.

The build is failing because any mention of --tb open build parameter which at time of writing is required due to earlier mentioned Tor Browse signature downloading issues was removed:
MacOS: Difference between revisions - Whonix

Re-added just now in wiki.