[dipunm]

The standalone image currently installs Tor from Debian's default repositories. Issue #219 requests an urgent update following the Tor security advisory.

Enable the Tor Project's stable Debian repository and install its latest available Tor package without a version pin or minimum-version check. Download the archive signing key from the official Tor Project URL and convert it with GnuPG to /usr/share/keyrings/deb.torproject.org-keyring.gpg, following the upstream instructions. Scope trust with Signed-By and install deb.torproject.org-keyring alongside Tor so the official package maintains the same keyring. HTTPS certificates and GnuPG are installed before configuring the repository; Debian Trixie APT already supports HTTPS. The README documents the package source and the need to recreate existing containers with a rebuilt image.

Validation:

• Tested the official key download and GnuPG conversion, and verified the repository signature with the downloaded key.
• Verified the archive key fingerprint against the Tor Project installation documentation: A3C4F0F979CAA22CDBA8F512EE8CBC9E886DDD89.
• Verified the repository InRelease signature and SHA-256/size of both amd64 and arm64 package indexes; both offered Tor 0.4.9.13 at verification time.
• Hadolint 2.15.1 passes at error threshold. Dependency-pinning warnings remain, including the intentional unpinned Tor installation.
• git diff --check passes.
• A full Docker build could not run locally because Docker socket access requires sudo authentication. The upstream PR workflow requires maintainer approval before it can run.

Refs #219. A maintainer must merge this change and publish a rebuilt release to deliver the update; this PR does not publish a release.

Sources:

• Security announcement
• Tor Project repository instructions

[theborakompanioni]

Thank you 🧡 🙏