Not a good idea nowadays due to prolonged DDoS attack on the Tor network. References:

https://github.com/Whonix/genmkfile/commit/c0d35c24569dea4af1b873c3a89bbf492cd44470
https://github.com/Whonix/Whonix/commit/0c63f16671e2387f1ccf86f791a77657f305f4f7

Use SSL and apt-cacher-ng also during genmkfile inside cowbuilder.

Building initiates. I had these deps installed anyhow. Unpinning the CPU resolved some early build error, but now it craps out at RAW image creation. Not really related to your inquiry.

This is now in stretch-testers repository.

https://github.com/Whonix/Whonix/commit/64b5b6133d733b7bb400262199992d116ae8709b
https://github.com/Whonix/Whonix/commit/b83dddec7c191160332bc9233feb6069bb28d435
https://github.com/Whonix/Whonix/commit/d182a2720c8c6a56492fccf45a8bc8c2b2902e67
https://github.com/Whonix/Whonix/commit/abaf332e0d831dc61dbe3ef0f37e701be63a494e
https://github.com/Whonix/Whonix/commit/360cc8f283d3d7ad5f1ef1a2984fa78465187dd9
https://github.com/Whonix/Whonix/commit/ec204c7434efbf985e8526d1d81ff5c9e91e1c44
https://github.com/Whonix/Whonix/commit/5e06301a66e93cbd1253ea7a52af993848a0d099
https://github.com/Whonix/Whonix/commit/0a370cf1c98ed7ac46edfda1371e81b7df314154
https://github.com/Whonix/Whonix/commit/8add221ae13de742c3c615fb7c63ce518a9c99f3
https://github.com/Whonix/Whonix/commit/54483462c12e30ec52d05f7e75537d607d9b3422
https://github.com/Whonix/Whonix/commit/3f087b337903a7e37685b0de464eb0c1ab9fc622
https://github.com/Whonix/Whonix/commit/d035e40127ca922749f6273f6f193db27be19601
https://github.com/Whonix/Whonix/commit/ca3add2343abd5846987400c04fd043082f1a489
https://github.com/Whonix/Whonix/commit/5f88d1d7377ff275679f629539d0de24f57e031e
https://github.com/Whonix/anon-shared-build-apt-sources-tpo/commit/7948da7d5c6e964455375499704851b3ca2cc21d
https://github.com/Whonix/whonix-repository/commit/903f0893182ecdbebd6eacd483f373940573e4bc
https://github.com/Whonix/whonix-legacy/commit/25663b8c9bd91185586ce9e18d07500abb81ca18
https://github.com/Whonix/whonix-initializer/commit/6705fa45965c20612ed40276fc961deb0e40890e

onion V3 (repo,website,forum…) reported from different sources is down.
https://forums.whonix.org/t/onion-v3-for-whonix-website-repo-down/5693/8

onion service name must be 16 characters long - can't reach Whonix onion repository
https://forums.whonix.org/t/onion-service-name-must-be-16-characters-long-cant-reach-whonix-onion-repository/6484

Reverted. Main reason:
https://forums.whonix.org/t/https-ssl-tls-by-default-broke-apt-cacher-ng-apt-package-caching-during-build/6276

• https://github.com/Whonix/anon-apt-sources-list/commit/9f08431be63b4977931fe2db57b067e660828997
• https://github.com/Whonix/Whonix/commit/867a481710077f6bf4e14a5d8c87471e81db85df

https://github.com/Whonix/qubes-whonix/commit/afcdbbaa6bc46d06b4dca4a37c60079d1d6305c8

pkg-systemd-maintainers question - [Install] for static systemd unit file?:
http://lists.alioth.debian.org/pipermail/pkg-systemd-maintainers/2017-March/014376.html

In T610#11827, @Patrick wrote:

marmarek (Marek Marczykowski-Górecki):

marmarek added a comment.

Perhaps it's better to implement this rather minimally inside the
https://phabricator.whonix.org/tag/qubes-whonix/ package? A simple
one socat listener port 9050 only redirection from whonix-gw
TemplateVM to sys-whonix?

You're talking about whonix-gw template here, right? And still cover
whonix-ws with
https://phabricator.whonix.org/tag/anon-ws-disable-stacked-tor/?

Good question. Would work either way. I guess simpler for both whonix-gw
and whonix-ws to have this minimal redirection inside the qubes-whonix
package.

In T610#12427, @Patrick wrote:

We should probably also set a socks user name for better Tor stream isolation. (IsolateSOCKSAuth) I am considering to add this to the uwt package.

Acquire::tor::proxy "socks5h://apt-transport-tor@127.0.0.1:9050";

(From reading zless /usr/share/doc/apt-transport-tor/README.md.gz.)

I was considering to change the port from 9050 to another one, but I am vary of this. It might look better but would also make the implementation more complicated. (Another Tor SocksPort. Not redirect 9050 from TemplateVM to gateway but another port.) Without any actual benefit.

We should probably also set a socks user name for better Tor stream isolation. (IsolateSOCKSAuth) I am considering to add this to the uwt package.

marmarek (Marek Marczykowski-Górecki):

marmarek added a comment.

Perhaps it's better to implement this rather minimally inside the
https://phabricator.whonix.org/tag/qubes-whonix/ package? A simple
one socat listener port 9050 only redirection from whonix-gw
TemplateVM to sys-whonix?

You're talking about whonix-gw template here, right? And still cover
whonix-ws with
https://phabricator.whonix.org/tag/anon-ws-disable-stacked-tor/?

Perhaps it's better to implement this rather minimally inside the https://phabricator.whonix.org/tag/qubes-whonix/ package? A simple one socat listener port 9050 only redirection from whonix-gw TemplateVM to sys-whonix?

In T610#11819, @marmarek wrote:

In T610#11722, @Patrick wrote:

I haven't updated whonix_repository_uri= in https://github.com/Whonix/qubes-template-whonix/blob/master/whonix-gateway/04_install_qubes_post.sh to onion yet. I guess there we should use onion plus Acquire::BlockDotOnion "false";?

In Qubes Whonix case, I think this is the easiest thing to do, for both whonix-ws and whonix-gw. Both have other mechanism to prevent updating over clearnet, so IMHO no real reason for using tor+http.

In T610#11722, @Patrick wrote:

I haven't updated whonix_repository_uri= in https://github.com/Whonix/qubes-template-whonix/blob/master/whonix-gateway/04_install_qubes_post.sh to onion yet. I guess there we should use onion plus Acquire::BlockDotOnion "false";?

I am glad I tagged you for this ticket. This can use scrutiny indeed. Haven't thought of that yet.

What about tor-over-tor issue here? And starting tor in template by having apt-transport-tor installed? Are those issues mitigated somehow else?

https://github.com/Whonix/Whonix/commit/2fed0f35b060b12160b1cbb475b3c74cd2075c74

https://github.com/Whonix/anon-apt-sources-list/commit/9c85a9f2486f8c19ee96ba98e3dc3ce3b5a3ad77
https://github.com/Whonix/whonix-repository/commit/1584d14065cf4f14fcce77e9d387552e21c45711
https://github.com/Whonix/anon-apt-sources-list/commit/48fbc20a43b85dbe18aa07fabb0a93f1ee02fe69
https://github.com/Whonix/anon-meta-packages/commit/7cf8cf4e50b72a570de54fad10f912af73e3cf3d
https://github.com/Whonix/Whonix/commit/f2d5ac58d8c043e94ad10c7470b3a3c89875d35b
https://github.com/Whonix/Whonix/commit/77162abafc2a71ee51817b6c1f574eb6d97ed444
https://github.com/Whonix/Whonix/commit/921fc44efe75d96b18af27cf4f26479e68e259cf