Kicksecure™ Packages for Debian Hosts and Kicksecure™ Host Enhancements
About this Packages for Debian Hosts Page Contributor maintained wiki page. | |
---|---|
Support Status | testing |
Difficulty | medium |
Contributor | HulaHoop![]() |
Support | Support |
How to install packages developed by Kicksecure in other Linux distributions such as your host operating system.

Introduction[edit]
Many of the packages developed under the Kicksecure umbrella can be thought of as independent projects in their own right. They are directly relevant to Debian hosts because they can increase security or usability.
This guide shows how to download these select packages from the Kicksecure repository; they can be downloaded stand-alone or combined.
How-to: Install Kicksecure Packages[edit]
Enable Kicksecure Repsitory[edit]
There are two different options to enable the Kicksecure APT repository.
Using extrepo
1. Install package extrepo
.
sudo apt install extrepo
2. Enable the stable kicksecure
APT repository. (See footnote for other options.) [1]
3. Advanced options.
For advanced options such as clearnet over Tor or onion. [2]
Please press on expand on the right side.
Optional.
Install apt-transport-tor
.
Install apt-transport-tor
. To accomplish that, the following steps A. to D. need to be done.
A. Update the package lists.
sudo apt update
B. Upgrade the system.
sudo apt full-upgrade
C. Install the apt-transport-tor
package.
Using apt
command line parameter --no-install-recommends
is in most cases optional.
sudo apt install --no-install-recommends apt-transport-tor
D. Done.
The procedure of installing apt-transport-tor
is complete.
Find out filename.
ls -la /etc/apt/sources.list.d/extrepo_*
NOTE: Filename will be different if using a repository other than the stable repository such as the testers repository.
Open file /etc/apt/sources.list.d/extrepo_kicksecure.sources
in an editor with root rights.
Others and Alternatives
- This is just an example. Other tools could achieve the same goal.
- If this example does not work for you or if you are not using Kicksecure, please refer to this link.
sudoedit /etc/apt/sources.list.d/extrepo_kicksecure.sources
Chose either option A) or B).
- A) Clearnet over Tor Repository: To enable clearnet over Tor,
tor+
needs do be prepended in front of thehttps
. The same in other words, look for Uris: https and replace it with Uris: tor+https . - B) Onion Repository: To enable onion, look for the line starting with
Uris:
. Delete the whole line. Or out-comment it by adding as hash ("#
") in front of it. Then add a new line: Uris: tor+http://deb.w5j6stm77zs6652pgsij4awcjeel3eco7kvipheu6mtr623eyyehj4yd.onion
4. Done.
The Kicksecure APT repository has been enabled [3]
Manually
Add Signing Key
Complete the following steps to add the Kicksecure Signing Key to the system's APT keyring.
Open a terminal.
1. Package curl
needs to be installed.
Install curl
. To accomplish that, the following steps A. to D. need to be done.
A. Update the package lists.
sudo apt update
B. Upgrade the system.
sudo apt full-upgrade
C. Install the curl
package.
Using apt
command line parameter --no-install-recommends
is in most cases optional.
sudo apt install --no-install-recommends curl
D. Done.
The procedure of installing curl
is complete.
2. Download Kicksecure Signing Key. [4]
A : Debian
If you are using Debian, run.
sudo curl --tlsv1.3 --output /usr/share/keyrings/derivative.asc --url https://www.kicksecure.com/keys/derivative.asc
B : Qubes
If you are using a Qubes Debian Template, run.
sudo http_proxy=http://127.0.0.1:8082 https_proxy=http://127.0.0.1:8082 curl --tlsv1.3 --output /usr/share/keyrings/derivative.asc --url https://www.kicksecure.com/keys/derivative.asc
3. Users can check Kicksecure Signing Key for better security.
4. Done.
The procedure of adding the Kicksecure signing key is now complete.
Add Repository
Add the Kicksecure APT Repository.
Choose either: Option A, Option B OR Option C
A : Onion Rep.
Option A: Add Kicksecure Onion Repository.
To add Kicksecure Repository over Onion please install apt-transport-tor
from the Debian repository.
sudo apt install apt-transport-tor
Add Kicksecure APT repository for default Kicksecure using Debian stable. At the time of writing this was bookworm
.
echo "deb [signed-by=/usr/share/keyrings/derivative.asc] tor+http://deb.w5j6stm77zs6652pgsij4awcjeel3eco7kvipheu6mtr623eyyehj4yd.onion bookworm main contrib non-free" | sudo tee /etc/apt/sources.list.d/derivative.list
B : Clearnet Rep. via Tor
Option B: Add Kicksecure Clearnet Repository over Tor.
To add Kicksecure Repository over torified clearnet install apt-transport-tor
from the Debian repository.
sudo apt install apt-transport-tor
Add Kicksecure APT repository for default Kicksecure using Debian stable. At the time of writing this was bookworm
.
echo "deb [signed-by=/usr/share/keyrings/derivative.asc] tor+https://deb.kicksecure.com bookworm main contrib non-free" | sudo tee /etc/apt/sources.list.d/derivative.list
C : Clearnet Rep.
Option C: Add Kicksecure Clearnet Repository over clearnet.
NOTE: When later using Kicksecure repository tool, then this will be upgraded to "Clearnet Rep. via Tor", unless see footnote. [5]
To add Kicksecure Repository over clearnet please add Kicksecure APT repository for default Kicksecure using Debian stable. At the time of writing this was bookworm
.
echo "deb [signed-by=/usr/share/keyrings/derivative.asc] https://deb.kicksecure.com bookworm main contrib non-free" | sudo tee /etc/apt/sources.list.d/derivative.list
The procedure of adding the Kicksecure repository is now complete.
Package Installation[edit]
Install a supported package.
Note: Replace package-name
with the actual name of a supported package.
Install package-name
.
Install package-name
. To accomplish that, the following steps A. to D. need to be done.
A. Update the package lists.
sudo apt update
B. Upgrade the system.
sudo apt full-upgrade
C. Install the package-name
package.
Using apt
command line parameter --no-install-recommends
is in most cases optional.
sudo apt install --no-install-recommends package-name
D. Done.
The procedure of installing package-name
is complete.
Supported Packages[edit]
usability-misc
(GitHub)
lkrg
(GitHub)
hardened-malloc
(GitHub)
security-misc
(GitHub)
tb-updater
(GitHub)
tb-starter
(GitHub)
grub-live
(GitHub)
ram-wipe
(GitHub)
virtualbox
- VirtualBox Installer for Linux (part of
usability-misc
)
Footnotes[edit]
- ↑
stable-proposed-updates
repository: sudo extrepo enable kicksecure_proposedtesters
repository: sudo extrepo enable kicksecure_testersdevelopers
repository: sudo extrepo enable kicksecure_developers - ↑
extrepo feature request: extrepo apt-transport-tor and onion support
- ↑
forum discussion: extrepo - safely adding repos
- ↑
See Secure Downloads to understand why
curl
and the parameters--tlsv1.3
are used instead ofwget
.
Placing an additional signing key into folder/usr/share/keyrings
by itself alone has no impact on security as this folder is not automatically used by Debian's APT by default. Only when an APT sources list configuration file points to folder/usr/share/keyrings
using thesigned-by
keyword the signing key will be actually used. Therefore deleting keys in/usr/share/keyrings
is optional if intending to disable an APT repository. See also APT Signing Key Folders. - ↑
Unless using
repository-dist --transport plain-tls
. See alsoman repository-dist
.
Unfinished: This wiki is a work in progress. Please do not report broken links until this notice is removed, use Search Engines First and contribute improving this wiki.

We believe security software like Kicksecure needs to remain Open Source and independent. Would you help sustain and grow the project? Learn more about our 11 year success story and maybe DONATE!