Users should not run software that has reached end-of-life status, because developers will not fix existing defects, bugs or vulnerabilities, posing serious security risks.
Am old example was VLC in Debian jessie, which reached end-of-life status in May, 2018. In that case, Kicksecure ™ 13 users who did not utilize a different media player were at risk, because VLC in jessie has unpatched security vulnerabilities. This VLC vulnerability does not apply to the current stable Kicksecure ™ 16 release.
Installing Additional Software
This is the latest official release of the Debian distribution. This is stable and well tested software, which changes only if major security or usability fixes are incorporated.
As a distribution, Debian's compilation of software is mostly acquired from "upstream" third parties (the original software vendors). Debian has embraced the principle of software stability which means each major release "freezes" software versions. As a result the stable distribution software is not regularly updated except for critical security fixes. This is called "security support" and only leads to minimal changes across the entire distribution. The intent is to improve stability by reducing the overall number of system changes.
The frozen packages policy means the versions of software installed from Debian package sources will not usually change when a newer release is made available by upstream. 
Application Specific Update Indicators
In most cases, specific end user applications such as electrum show notifications about the availability of newer versions can be safely ignored since electrum is also a Frozen Packages. No manual user action required. To receive security advisories should there be a special case that requires manual user action, see Follow Kicksecure ™ Developments.
Application specific update indicators should not be shown to the user, should be disabled by Debian. This is a bug that shouldn't happen. It is happening due to the organisational background.
Standard Update vs Release Upgrade
There are two different types of updates.
- Standard Update
- Release Upgrade
This procedure on this wiki page is for standard ("everyday") updating of Kicksecure and will not perform a Release Upgrade.
It is recommended to first complete a standard update before applying a release upgrade.
Update vs Image Re-Installation
The standard ("everyday") update procedure for Kicksecure is more convenient than a complete re-installation of Kicksecure ™ images because all (VM) settings and user data are persistent. Backups are possible using (VM) clones and/or snapshots.
In contrast, a complete re-installation of Kicksecure ™ images requires Kicksecure ™ to be completely removed and then re-installed, similar to newcomers installing the platform for the first time. This is "cleaner" and elaborated on the Factory Reset page. Obviously all (VM) settings and data are lost during this procedure. If this is necessary, follow these steps:
- Kicksecure ™ for Qubes: uninstall Kicksecure ™ for Qubes and then install Kicksecure ™ for Qubes.
- Kicksecure ™: remove any Kicksecure ™ (VMs) and then re-install them.
Developers periodically announce a newer Kicksecure ™ Point Release or major release. To stay informed about releases, see: Follow Kicksecure ™ Developments. It is recommended to subscribe to relevant news channels for this purpose.
Standard updates are generally easier, but image re-installation can completely avoid technical issues that might emerge during upgrades.
Standard Update Steps
1. Save Progress and Backup
On rare occasions  the machine might freeze during the upgrade process. In this case any materials already in progress might be lost, for example documents or other drafts that were created. If this is applicable, save the progress before installing operating system updates. If required, backup all user data -- it is ideal to have a copy of the VM(s) so it is possible to try again (if necessary).
2. Flatpak Update
This step is only required if the user previously manually installed any software using flatpak. Can be skipped otherwise.
- Kicksecure ™ flatpak update
- Kicksecure ™ for Qubes Template: http_proxy=http://127.0.0.1:8082 flatpak update
3. Update the APT Package Lists
The output should be similar to this.
If an error message like this appears:
Then something went wrong. It could be a temporary Tor exit relay or server failure that should resolve itself. Check if the network connection is functional by changing the Tor circuit and trying again. Running systemcheck might also help to diagnose the problem.
Sometimes a message like this will appear.
It that case, it helps to run.
And then try again.
4. APT Upgrade
To install the newest versions of the current packages installed on the system, run.
Please note that if the Kicksecure ™ APT Repository was disabled (see Disable Kicksecure ™ APT Repository), then manual checks are required for new Kicksecure ™ releases and manual installation from source code.
5. Never Install Unsigned Packages!
If a message like this appears.
Then do not proceed! Press
apt update again should fix the problem. If not, something is broken or it might be a man-in-the-middle attack, which is not that unlikely because updates are retrieved via Tor exit relays and some are malicious. Changing the Tor circuit is recommended if this message appears.
6. Signature Verification Warnings
No signature verification warnings should appear. If it does occur, it will look similar to the following.
W: A error occurred during the signature verification. The repository is not updated and the previous index files will be used. GPG error: https://deb.torproject.org stable Release: The following signatures were invalid: KEYEXPIRED 1409325681 KEYEXPIRED 1409325681 KEYEXPIRED 1409325681 KEYEXPIRED 1409325681
E: Release file for tor+http://deb.w5j6stm77zs6652pgsij4awcjeel3eco7kvipheu6mtr623eyyehj4yd.onion/dists/bullseye/InRelease has expired (invalid since 1 d 20 h 41 min 7 s). Updates for this depot are not applied.
Caution is warranted even though APT will automatically ignore repositories with expired keys or signatures, and no upgrades will be received from that repository. Unless the issue is already known or documented, it should be reported for further investigation.
There are two possible reasons for this occurrence. Either there is a problem with the repository that is unfixed by contributors or a man-in-the-middle attack has taken place.  The latter is not a big issue, since no malicious packages are installed. It may also automatically resolve itself after a period of time when a different, non-malicious Tor exit relay is used, or following a manual change of the Tor circuit.
In the past, various apt repositories were signed with an expired key. To see how the documentation looked at that point, please click on Expand on the right.
For instance, the Tor Project's apt repository key had expired and the following warning appeared.
This issue was quickly reported. There was no immediate danger and the message could be safely ignored. As a reminder, never install unsigned packages as explained above.
Please report any other signature verification errors if/when they appear, even though this is fairly rare.
7. Changed Configuration Files [link ]
Be careful if a message like this appears.
Conflicts like these should be rare if modular flexible
.d style configuration folders are used.
8. If APT reports packages that can be autoremoved, safely run APT autoremove.
9. Restart Services After Updating
To restart services after updating, either reboot.
Or use the (harder) needrestart method to avoid rebooting. For readers interested in the needrestart method, please click on Expand on the right side.
Perform this step once. Install needrestart.
The program will provide advice. Run it again after applying the advice.
If nothing else needs to be restarted, it should show.
This feature might become more usable and automated in the future. (T324)
10. Restart After Kernel Updates
When linux-image-... is upgraded, a reboot is required for any security updates to be in effect.
Release File Expired Error
Same as below.
InRelease is not valid yet error
A release file expired error can look like this.
E: Release file for tor+https://fasttrack.debian.net/debian/dists/bullseye-fasttrack/InRelease is not valid yet (invalid for another 49s). Updates for this repository will not be applied.
If this message is transient, it can be safely ignored. Try again. There is a good chance that is has been resovled.
2. Platform specific.
- Non-Qubes: no platform specific step reuqired.
- Qubes: If using Qubes, try Standard Update Steps instead of Qubes update tool.
3. Attempt to debug the issue.
See the following box.
A) fasttrack in Debian
If it's an issue with the fasttrack repository, for debugging the issue further, the user could try to enable the Debian fasttrack repository in the Qubes Debian template and attempt to reproduce the issue there as per generic bug reproduction and report the result to the forums.
B) Check the release file.
When this issue is happening, could you please check this link/file?
Date: Sat, 20 Nov 2021 15:30:10 UTC Valid-Until: Sat, 27 Nov 2021 15:30:10 UTC
C) Note the VM time.
Inside the VM.
D) Note the host time.
On the host operating system (or dom0 when using Qubes).
E) Report to developers.
If none of the following gave any ideas how to fix the issue, please copy the error message and results from above debugging steps to developers. Forum discussion: https://forums.whonix.org/t/whonix-ws-16-fails-to-update-due-to-timing-issue/12739
APT Hash Sum Mismatch
A hash sum mismatch can look like this.
W: Failed to fetch https://deb.debian.org/debian/dists/stable/main/i18n/Translation-enIndex Hash Sum mismatch
This might occur due to Tor and/or network unreliability issues. If this warning message is transient, it can be safely ignored. Otherwise, try one of the fixes below.
- Change the Tor circuit and/or try again later.
- If the warning message still persists, deleting the package lists should solve it. 
To delete the package lists, run:
To check everything is functional, update the package lists and then upgrade the distribution. It is likely that previous update/upgrade attempts failed due to the mismatch.
Windows 10, VirtualBox users only: refer to the Hash Sum mismatch? forum thread.
Non-functional Onion Services
Sometimes the Debian, Kicksecure ™ onion servers are non-functional. This could be due to DDOS attacks on the Tor network.  In result, this means updates cannot be completed automatically and an error message similar to below will appear.
1. Open Debian sources.list in an editor.
/etc/apt/sources.list.d/debian.list in an editor with root rights.
(Kicksecure ™ inside Qubes: In Template)
This box uses
sudoedit for better security. This is an example and other tools could also achieve the same goal. If this example does not work for you or if you are not using Kicksecure ™, please refer to this link.
2. Comment (#) the .onion address lines and uncomment the clearnet address lines.
The code blocks should look like this; only these entries require editing. 
Save and exit.
3. Confirm the clearnet repositories are functional.
4. Optional: Revert and update the package lists.
Consider reverting these changes later on because onion repositories have various security advantages. Afterwards, apply Updates to refresh the package lists.
Updating with Extra Care
GUI Applications with Root Rights
- Configuration Files
- Changed Configuration Files
- Reset Configuration Files to Vendor Default
- Factory Reset
- Kicksecure ™ APT Repository
- In Kicksecure ™ and on the host.
- Rollback or indefinite freeze attacks as defined by The Update Framework (TUF) - Threat Model - Attacks and Weaknesses - https://github.com/theupdateframework/tuf/blob/develop/docs/SECURITY.md -.
- Or Kicksecure ™ changes can be delayed, inspected, and then backported if the effort is worth it.
Kicksecure ™ uses package
config-package-devwhich assumes ownership of configuration files coming from “other distributions” (mostly Debian, although third party repositories might be added by users). (Kicksecure ™ on
- If similar issues occur with Kicksecure ™ onion services then follow the same procedure and modify the