There are two different options to enable the Kicksecure APT repository. Choose one. ^[1]

1. Install package extrepo.

Click = Copy Copied to clipboard! sudo apt install extrepo

2. Enable the stable kicksecure APT repository. (See footnote for other options.) ^[2]

A : Kicksecure Copy or share this direct link! Click = Copy Copied to clipboard! https://www.kicksecure.com/wiki/Template:Project-APT-Repository-Add#a-kicksecure Click below ↴ = Copy to Clipboard Click = Copy Copied to clipboard! [[Template:Project-APT-Repository-Add#a-kicksecure|A : Kicksecure]]
Copy as Wikitext Click = Copy Copied to clipboard! [A : Kicksecure](https://www.kicksecure.com/wiki/Template:Project-APT-Repository-Add#a-kicksecure)
for Discourse, reddit, GitHub Click = Copy Copied to clipboard! [A : Kicksecure](https://www.kicksecure.com/wiki/Template:Project-APT-Repository-Add#a-kicksecure)
Copy as Markdown Click = Copy Copied to clipboard! [url=https://www.kicksecure.com/wiki/Template:Project-APT-Repository-Add#a-kicksecure]A : Kicksecure[/url]
Copy as phpBB Click below ↴ = Open social URL with share data We don't use embedded scripts This share button is completely self-hosted by this webserver. No scripts from any of the social networks are embedded on this webserver. See also Social Share Button.

===

Kicksecure

Click = Copy Copied to clipboard! sudo extrepo enable kicksecure

B : Kicksecure for Qubes Template Copy or share this direct link! Click = Copy Copied to clipboard! https://www.kicksecure.com/wiki/Template:Project-APT-Repository-Add#b-kicksecure-for-qubes-template Click below ↴ = Copy to Clipboard Click = Copy Copied to clipboard! [[Template:Project-APT-Repository-Add#b-kicksecure-for-qubes-template|B : Kicksecure for Qubes Template]]
Copy as Wikitext Click = Copy Copied to clipboard! [B : Kicksecure for Qubes Template](https://www.kicksecure.com/wiki/Template:Project-APT-Repository-Add#b-kicksecure-for-qubes-template)
for Discourse, reddit, GitHub Click = Copy Copied to clipboard! [B : Kicksecure for Qubes Template](https://www.kicksecure.com/wiki/Template:Project-APT-Repository-Add#b-kicksecure-for-qubes-template)
Copy as Markdown Click = Copy Copied to clipboard! [url=https://www.kicksecure.com/wiki/Template:Project-APT-Repository-Add#b-kicksecure-for-qubes-template]B : Kicksecure for Qubes Template[/url]
Copy as phpBB Click below ↴ = Open social URL with share data We don't use embedded scripts This share button is completely self-hosted by this webserver. No scripts from any of the social networks are embedded on this webserver. See also Social Share Button.

===

Kicksecure-Qubes Template (kicksecure-17)

Click = Copy Copied to clipboard! sudo http_proxy=http://127.0.0.1:8082 https_proxy=http://127.0.0.1:8082 extrepo enable kicksecure

3. Advanced options.

For advanced options such as clearnet over Tor or onion. ^[3]

Please press on expand on the right side.

Optional.

Install apt-transport-tor.

Install package(s) apt-transport-tor following these instructions

Platform specific notice.

Kicksecure: No special notice.
Kicksecure-Qubes: In Template.

Update the package lists and upgrade the system .

sudo apt update && sudo apt full-upgrade

Install the apt-transport-tor package(s).

Using apt command line --no-install-recommends option is in most cases optional.

sudo apt install --no-install-recommends apt-transport-tor

Platform specific notice.

Kicksecure: No special notice.
Kicksecure-Qubes: Shut down Template and restart App Qubes based on it as per Qubes Template Modification .

Done.

The procedure of installing package(s) apt-transport-tor is complete.

Find out filename.

ls -la /etc/apt/sources.list.d/extrepo_*

NOTE: Filename will be different if using a repository other than the stable repository such as the testers repository.

Open file /etc/apt/sources.list.d/extrepo_kicksecure.sources in an editor with root rights.

See Open File with Root Rights for detailed instructions on why to use sudoedit for better security and how to use it.

Note: Mousepad (or the chosen text editor) must be closed before running the sudoedit command.

sudoedit /etc/apt/sources.list.d/extrepo_kicksecure.sources

NOTES:

When using Kicksecure-Qubes, this needs to be done inside the Template.

sudoedit /etc/apt/sources.list.d/extrepo_kicksecure.sources

After applying this change, shutdown the Template.
All App Qubes based on the Template need to be restarted if they were already running.
This is a general procedure required for Qubes and unspecific to Kicksecure for Qubes.

This is just an example. Other tools could achieve the same goal.
If this example does not work for you or if you are not using Kicksecure, please refer to this link.

sudoedit /etc/apt/sources.list.d/extrepo_kicksecure.sources

Choose either option A) or B).

A) Clearnet over Tor Repository: To enable clearnet over Tor, tor+ needs do be prepended in front of the https. The same in other words, look for Uris: https and replace it with Uris: tor+https .
B) Onion Repository: To enable onion, look for the line starting with Uris:. Delete the whole line. Or out-comment it by adding as hash ("#") in front of it. Then add a new line: Uris: tor+http://deb.w5j6stm77zs6652pgsij4awcjeel3eco7kvipheu6mtr623eyyehj4yd.onion

4. Done.

The Kicksecure APT repository has been enabled ^[4]

Add Signing Key

Complete the following steps to add the Kicksecure Signing Key to the system's APT keyring.

Open a terminal.

1. Package curl needs to be installed.

Install package(s) curl following these instructions

Platform specific notice.

Kicksecure: No special notice.
Kicksecure-Qubes: In Template.

Update the package lists and upgrade the system .

Click = Copy Copied to clipboard! sudo apt update && sudo apt full-upgrade

Install the curl package(s).

Using apt command line --no-install-recommends option is in most cases optional.

Click = Copy Copied to clipboard! sudo apt install --no-install-recommends curl

Platform specific notice.

Kicksecure: No special notice.
Kicksecure-Qubes: Shut down Template and restart App Qubes based on it as per Qubes Template Modification .

Done.

The procedure of installing package(s) curl is complete.

2. Download Kicksecure Signing Key. ^[5]

Choose your operating system.

If you are using Debian, run.

Choose TLS or onion.

TLS (Debian)

Click = Copy Copied to clipboard! sudo curl --tlsv1.3 --output /usr/share/keyrings/derivative.asc --url https://www.kicksecure.com/keys/derivative.asc

onion (Debian)

Downloading over onion requires an already functional system Tor.

Click = Copy Copied to clipboard! sudo torsocks curl --output /usr/share/keyrings/derivative.asc --url http://www.w5j6stm77zs6652pgsij4awcjeel3eco7kvipheu6mtr623eyyehj4yd.onion/keys/derivative.asc

If you are using a Qubes Debian Template, run.

Choose TLS or onion.

TLS (Qubes)

Click = Copy Copied to clipboard! sudo http_proxy=http://127.0.0.1:8082 https_proxy=http://127.0.0.1:8082 curl --tlsv1.3 --output /usr/share/keyrings/derivative.asc --url https://www.kicksecure.com/keys/derivative.asc

onion (Qubes)

Downloading over onion requires an already functional system Tor.

Click = Copy Copied to clipboard! sudo torsocks curl --output /usr/share/keyrings/derivative.asc --url http://www.w5j6stm77zs6652pgsij4awcjeel3eco7kvipheu6mtr623eyyehj4yd.onion/keys/derivative.asc

3. Users can check Kicksecure Signing Key for better security.

4. Done.

The procedure of adding the Kicksecure signing key is now complete.

Add Repository

Add the Kicksecure APT Repository.

Choose either: Option A, Option B OR Option C

Option A: Add Kicksecure Onion Repository.

To add Kicksecure Repository over Onion please install apt-transport-tor from the Debian repository.

Click = Copy Copied to clipboard! sudo apt install apt-transport-tor

Add Kicksecure APT repository for default Kicksecure using Debian stable. At the time of writing this was bookworm.

Click = Copy Copied to clipboard! echo "deb [signed-by=/usr/share/keyrings/derivative.asc] tor+http://deb.w5j6stm77zs6652pgsij4awcjeel3eco7kvipheu6mtr623eyyehj4yd.onion bookworm main contrib non-free" | sudo tee /etc/apt/sources.list.d/derivative.list

Option B: Add Kicksecure Clearnet Repository over Tor.

To add Kicksecure Repository over torified clearnet install apt-transport-tor from the Debian repository.

Click = Copy Copied to clipboard! sudo apt install apt-transport-tor

Add Kicksecure APT repository for default Kicksecure using Debian stable. At the time of writing this was bookworm.

Click = Copy Copied to clipboard! echo "deb [signed-by=/usr/share/keyrings/derivative.asc] tor+https://deb.kicksecure.com bookworm main contrib non-free" | sudo tee /etc/apt/sources.list.d/derivative.list

Option C: Add Kicksecure Clearnet Repository over clearnet.

NOTE: When later using Kicksecure repository tool, then this will be upgraded to "Clearnet Rep. via Tor", unless see footnote. ^[6]

To add Kicksecure Repository over clearnet please add Kicksecure APT repository for default Kicksecure using Debian stable. At the time of writing this was bookworm.

Click = Copy Copied to clipboard! echo "deb [signed-by=/usr/share/keyrings/derivative.asc] https://deb.kicksecure.com bookworm main contrib non-free" | sudo tee /etc/apt/sources.list.d/derivative.list

The procedure of adding the Kicksecure repository is now complete.

url]
Copy as phpBB Click below ↴ = Open social URL with share data We don't use embedded scripts This share button is completely self-hosted by this webserver. No scripts from any of the social networks are embedded on this webserver. See also Social Share Button.

↑
extrepo vs manual:
- Usability:
  - There are some detail usability differences. Using onion connection might be easier with manual method until Kicksecure gets ported to Debian 13 / trixie because extrepo might get onion support then.
  - Apart from that, extrepo's usability seems generally better.
- Security:
  - A detailed comparative research of both methods is unavailable.
  - If usability is considered a security feature, then extrepo might be considered more secure. This is because users do not have to learn as much about Verifying Software Signatures, OpenPGP, its many Software Signature Verification Usability Issues. Debian which is already trusted by the user providing a trust path to the Kicksecure signing key. Manual key fingerprint verification not required.
  - The extrepo project is a huge amount of work adding all the signing keys for many different projects. The code for securely downloading a signing key in the Python is not among the most difficult programming tasks to get correct. Compared with curl (written in C), it might be more secure.
- Keeping support for manual method:
  - Removal of the manual method is not planned. Since already written, the maintenance effort for that very part of documentation is low. In case extrepo signing key is outdated, get deprecated, it's easy to switch back to manual method.
↑ stable-proposed-updates repository: Click = Copy Copied to clipboard! sudo extrepo enable kicksecure_proposed testers repository: Click = Copy Copied to clipboard! sudo extrepo enable kicksecure_testers developers repository: Click = Copy Copied to clipboard! sudo extrepo enable kicksecure_developers
↑ extrepo feature request: extrepo apt-transport-tor and onion support
↑ forum discussion: extrepo - safely adding repos
↑ See Secure Downloads to understand why curl and the parameters --tlsv1.3 are used instead of wget.

Placing an additional signing key into folder /usr/share/keyrings by itself alone has no impact on security as this folder is not automatically used by Debian's APT by default. Only when an APT sources list configuration file points to folder /usr/share/keyrings using the signed-by keyword the signing key will be actually used. Therefore deleting keys in /usr/share/keyrings is optional if intending to disable an APT repository. See also APT Signing Key Folders.
↑ Unless using repository-dist --transport plain-tls. See also man repository-dist.

Kicksecure

A secure by default operating system with the latest security research in place.

Dark mode

Supported by Power Up Privacy

Kicksecure is proudly supported until 2025 by Power Up Privacy, a privacy advocacy group that seeks to supercharge privacy projects with resources so they can complete their mission of making our world a better place. (Strictly subject to our sponsorship policy.)

At Kicksecure we value freedom and trust, supporting Open Source and Freedom Software

By using this website, you acknowledge you have read, understood, and agree to be bound by these agreements: Terms of Service, Privacy Policy, Cookie Policy, E-Sign Consent, DMCA, Imprint

2012- 2025 ENCRYPTED SUPPORT LLC

Your support makes
all the difference!

We believe security software like Kicksecure needs to remain Open Source and independent. Would you help sustain and grow the project? Learn more about our 12 year success story and maybe DONATE!

[1] extrepo vs manual:
Usability:
There are some detail usability differences. Using onion connection might be easier with manual method until Kicksecure gets ported to Debian 13 / trixie because extrepo might get onion support then.

Apart from that, extrepo's usability seems generally better.

Security:
A detailed comparative research of both methods is unavailable.

If usability is considered a security feature, then extrepo might be considered more secure. This is because users do not have to learn as much about Verifying Software Signatures, OpenPGP, its many Software Signature Verification Usability Issues. Debian which is already trusted by the user providing a trust path to the Kicksecure signing key. Manual key fingerprint verification not required.

The extrepo project is a huge amount of work adding all the signing keys for many different projects. The code for securely downloading a signing key in the Python is not among the most difficult programming tasks to get correct. Compared with curl (written in C), it might be more secure.

Keeping support for manual method:
Removal of the manual method is not planned. Since already written, the maintenance effort for that very part of documentation is low. In case extrepo signing key is outdated, get deprecated, it's easy to switch back to manual method.

[2] Usability:
There are some detail usability differences. Using onion connection might be easier with manual method until Kicksecure gets ported to Debian 13 / trixie because extrepo might get onion support then.

Apart from that, extrepo's usability seems generally better.

[3] There are some detail usability differences. Using onion connection might be easier with manual method until Kicksecure gets ported to Debian 13 / trixie because extrepo might get onion support then.

[4] Apart from that, extrepo's usability seems generally better.

[5] Security:
A detailed comparative research of both methods is unavailable.

If usability is considered a security feature, then extrepo might be considered more secure. This is because users do not have to learn as much about Verifying Software Signatures, OpenPGP, its many Software Signature Verification Usability Issues. Debian which is already trusted by the user providing a trust path to the Kicksecure signing key. Manual key fingerprint verification not required.

The extrepo project is a huge amount of work adding all the signing keys for many different projects. The code for securely downloading a signing key in the Python is not among the most difficult programming tasks to get correct. Compared with curl (written in C), it might be more secure.

[6] A detailed comparative research of both methods is unavailable.

[7] If usability is considered a security feature, then extrepo might be considered more secure. This is because users do not have to learn as much about Verifying Software Signatures, OpenPGP, its many Software Signature Verification Usability Issues. Debian which is already trusted by the user providing a trust path to the Kicksecure signing key. Manual key fingerprint verification not required.

[8] The extrepo project is a huge amount of work adding all the signing keys for many different projects. The code for securely downloading a signing key in the Python is not among the most difficult programming tasks to get correct. Compared with curl (written in C), it might be more secure.

[9] Keeping support for manual method:
Removal of the manual method is not planned. Since already written, the maintenance effort for that very part of documentation is low. In case extrepo signing key is outdated, get deprecated, it's easy to switch back to manual method.

[10] Removal of the manual method is not planned. Since already written, the maintenance effort for that very part of documentation is low. In case extrepo signing key is outdated, get deprecated, it's easy to switch back to manual method.

[2] stable-proposed-updates repository: Click = Copy Copied to clipboard! sudo extrepo enable kicksecure_proposed testers repository: Click = Copy Copied to clipboard! sudo extrepo enable kicksecure_testers developers repository: Click = Copy Copied to clipboard! sudo extrepo enable kicksecure_developers

[3] xtrepo feature request: extrepo apt-transport-tor and onion support

[4] rum discussion: extrepo - safely adding repos

[5] See Secure Downloads to understand why curl and the parameters --tlsv1.3 are used instead of wget.

Placing an additional signing key into folder /usr/share/keyrings by itself alone has no impact on security as this folder is not automatically used by Debian's APT by default. Only when an APT sources list configuration file points to folder /usr/share/keyrings using the signed-by keyword the signing key will be actually used. Therefore deleting keys in /usr/share/keyrings is optional if intending to disable an APT repository. See also APT Signing Key Folders.

[6] Unless using repository-dist --transport plain-tls. See also man repository-dist.

[1]

[2]

[3]

[4]

[5]

[6]

Template:Project-APT-Repository-Add

Contents

Using extrepo

Kicksecure

Kicksecure for Qubes

Others and Alternatives

Manually

A : Debian

B : Qubes

A : Onion Rep.

B : Clearnet Rep. via Tor

C : Clearnet Rep.

Navigation menu

Template:Project-APT-Repository-Add

Using extrepo

Kicksecure

Kicksecure for Qubes

Others and Alternatives

Manually

A : Debian

B : Qubes

A : Onion Rep.

B : Clearnet Rep. via Tor

C : Clearnet Rep.

Navigation menu

Search

Disable server cache for this browser

Debug vis URL