How to install Librewolf

[solene]

Introduction

Although this is not Qubes OS specific, it seems a lot of people struggle installing Librewolf on their qubes, so here is a short community guide explaining how to proceed.

Debian

Tested on Debian 12 xfce

From Installation on Debian based systems – LibreWolf

sudo apt update && sudo apt install extrepo -y
sudo env https_proxy=http://localhost:8082 extrepo enable librewolf
sudo apt update && sudo apt install librewolf -y

Fedora

Tested on Fedora 42 gnome (the template called fedora-42)

From Fedora Installation – LibreWolf

curl -x http://localhost:8082 -fsSL https://repo.librewolf.net/librewolf.repo | sudo tee /etc/yum.repos.d/librewolf.repo
sudo dnf install librewolf

You will be prompted about this

Importing OpenPGP key 0x2B12EF16:
 UserID     : "LibreWolf Maintainers <gpg@librewolf.net>"
 Fingerprint: 662E3CDD6FE329002D0CA5BB40339DD82B12EF16
 From       : https://repo.librewolf.net/pubkey.gpg
Is this ok [y/N]:

Make sure the fingerprint matches the one found in librewolf website (linked just above), press “y” and “enter”. Then you will be prompted if you accept to install librewolf, press “y” and “enter”.

[parulin]

I’m a bit skeptical about this guide: I think that the problem is not really related to Librewolf but to the “how to install software in Qubes OS?” question. So maybe How to install software in the docs could be rewritten? Or it is inevitable as Installing Software in Qubes (all methods) already exists? Creating a guide for each popular software doesn’t look sustainable to me.

[solene]

@parulin

Creating a guide for each popular software doesn’t look sustainable to me.

I agree but this particular software pops really often, and the need for the proxy creates struggle for users who do not have the required knowledge.

I thought about it before writing the guide, but it’s Qubes OS specific as librewolf repo needs a specific command to be enabled.

This would be nice if we had a better way for users to not have to deal with the proxy, without enabling it system wide

[parulin]

Maybe displaying a warning when a user tries to run a command like curl or wgetin the templates and without the proxy could be an easy way to avoid this? I’m thinking about some aliases but there are maybe a lot of drawbacks I’m not aware of?

[linuxuser1]

@parulin

Maybe displaying a warning when a user tries to run a command like curl or wgetin the templates and without the proxy could be an easy way to avoid this?

I agree with you. That would be an excellent solution. It should be added in all templates by default. Devs should think about it. Or could create a solution similar:

Qubes Template Automatic Curl and Wget Proxy Config

I found this cool idea trying to remember the tinyproxy command format and figured it might save a lot of people time installing stuff in their templates. I’m sure there must be a reason this is not set by default in the templates(I imagine it’s so people don’t accidentally install stuff in a template?), but I feel stupid for not doing this. Anyway, you can configure curl and wget to use tinyproxy by default using the following commands. I’m hoping someone will tell me why this might not be a g…

[solene]

I’m not sure how it would play nice with sudo. I thought about a command “enable-proxy” that would export the variables so it works fine for the current interactive session, but sudo would not pick up the variables

@linuxuser1

Or could create a solution similar:

In my flatpak guide, I used a systemd mechanism to set the variable for the whole user, I received criticism (in a good way) that it was enabling the proxy for too many programs. In that case, this would only enable the proxy for both curl and wget, but it’s not enough for librewolf case.

[parulin]

Thanks for the link!

I totally forgot about @Insurgo idea in this topic:

Curl-proxy / wget-proxy scripts in Templates so users can add GPG distro keys linked to added external repositories

Updates Edit: Extended PoC of this idea is here. This is the blocking version (where non-networked TemplateVM will not translate curl/wget to curl-proxy/wget-proxy in the wrapper scripts. Edit2: PoC code download here Edit3: A non-blocking example for curl-wrapper automatically translates curl calls to curl-proxy calls under this post. Edit4: No go. MOTD is a better approach. Proxy with static port is now considered risky by thread participants. @deeplow @unman I created issue Deploy curl-…

A MOTD is a really good idea!

[solene]

@parulin

A MOTD is a really good idea!

I’m afraid people won’t read it, but it could be fine.

[quer]

Maybe just using sudo -E,It will fix most of the problem.

[solene]

Then you still need to tell a specific instruction to the end user.

I’m not sure having an alias sudo = sudo -E is a good idea as a default setting

[alfonsius]

for how to install Brave browser, do you have your own procedure ?

[ephile]

For Debian, the Brave browser is also available with extrepo, which one can find with the extrepo search function (https_proxy along with extrepo search brave).

sudo env https_proxy=http://localhost:8082 extrepo enable brave_release
sudo apt update && sudo apt install brave-browser -y

[alfonsius]

great for deb-12
on deb-13 is not working

[barto]

@alfonsius

is not working

Generally, you need to provide more info if you expect any help or suggestions from the forum.
A quick Google search on the topic is customary too.

[rzg]

Is it wrong use this appoach ?

    # Set up proxy for network access in custom template
    export http_proxy=http://127.0.0.1:8082
    export https_proxy=http://127.0.0.1:8082

    # Update  packages
    apt-get update
   
    # Install extrepo and enable LibreWolf repository
    apt-get install -y extrepo
    extrepo enable librewolf

    # Update and install LibreWolf
    apt-get update
    apt-get install -y librewolf

If we update the base template with Librewolf, how will extrepro handle the proxy in the template?

[user@dom0 ~]$ sudo qubesctl --show-output --skip-dom0 --targets=debian-12-minimal-librewolf state.sls update.qubes-vm

I think the export command will only last for that session and then the base template will revert to the default, which may prevent updates.

I’m thinking of a solution to this.

Edit:
It was updated:

Calculating upgrade…
0 upgraded, 0 newly installed, 0 to remove and 0 not upgraded.
Installed packages:
None
Updated packages:
librewolf 143.0-1 → 143.0.1-1
Removed packages:
None
Hit:1 Index of /debian bookworm InRelease
Hit:2 Index of /debian-security bookworm-security InRelease
Hit:3 https://repo.librewolf.net librewolf InRelease
Hit:4 Index of /r4.2/vm/ bookworm InRelease
Reading package lists…
Reading package lists…
Building dependency tree…
Reading state information…
Calculating upgrade…
0 upgraded, 0 newly installed, 0 to remove and 0 not upgraded.

[ephile]

@alfonsius

on deb-13 is not working

I am just now successfully installing on deb-13. Note that you have to enable “brave_release” while you install “brave-browser”. That distinction tripped me up on the first try…

[alfonsius]

Resolved for deb13-Gnome thanks

before I did need to install apt-transport-tor
after that Librewolf and Brave can be installed and are working