https://mullvad.net/en/help/install-mullvad-app-linux
Trying to install VPN and these are the instructions Mullvad is giving me. This is ridiculous. There must be a more simple way. I know how to follow the instructions but I have no idea what I’m doing here. Can’t I just download a file and install it? I’m on Ubuntu.
Yes. I’m genuinely unsure how it could be any easier. It’s just add the repo and install.
But I suppose it’s a lot if you don’t know what anything means, so I’ll try to explain it at a super basic level. Sorry if this is patronising, I can’t ascertain your experience level so I have to make an assumption.
The first thing it asks you to do is:
Hm. Okay so I guess before even deciphering the command, you have to know how Linux works. So on Linux, the first word is the name of the application you want to use, and everything afterwards is stuff that you pass along to the application. It’s up to the application to program in the behaviour for interpreting the words that come after the first word. So “sudo” is the name of the application you’re using, and all that other stuff is stuff you’re telling Linux to tell that other application.
Okay, so what is sudo? sudo is short for Super User Do. It’s an application that does something (sudo) as the super user (sudo). Super User is like admin on Windows. So it’s for when you want to make system level changes or want to override permission limitations. In the past, or at a basic level, you would switch user, make the change, then switch back to your personal user. But with sudo you can borrow the permissions of the super user for the purposes of that one command and everything works smoother that way.
The way you use sudo is you run the application by typing sudo, then you type in a second application and what you want that application to do, then sudo starts that other application and gives it the instructions you asked to be passed on. The second application in this case is curl.
For example, on Windows you might do
sudo photoshop open C:\users\winuser\documents\restrictedfile.psdto open a file in Photoshop that the Windows admin decided you aren’t allowed to open.Let’s look at the command again.
Sudo is to get super permissions and doesn’t actually tell you what the command does. The application that is actually being run in this command is curl. curl goes to a url and sees it. So it basically just means download whatever is at this URL. Here the URL is
https://repository.mullvad.net/deb/mullvad-keyring.ascAll that other stuff in this command is technically curl specific, so you have to check how curl works to know what it does. But it does follow Linux conventions very closely, therefore a normal Linux user who has never used curl could still guess what it does with 100% accuracy and would probably use it correctly for the first time without checking how to use it. If you want to learn how to use it, you can use the included manual programman, by typingman curl, and as a convention, almost every Linux application will tell you how to use it if you use the -h or --help flags by typingcurl -horcurl --help.In this case, curl takes flags, these are -fsSLo, that’s 5 different flags. A flag is like a mode switch for an application, it’s specified with adding a hyphen and the trigger word. The hyphen is useful because an application like curl might want a file path
/usr/share/keyrings/mullvad-keyring.ascand a URLhttps://repository.mullvad.net/deb/mullvad-keyring.asc, so by adding the hyphen, the application knows that fsSLO is not part of the file path, but is instead specific instructions you’re giving the application. This is a normal convention on Linux, similar to how Windows applications normally program the X button in the corner to close the window.For curl specifically, by default curl doesn’t save the file, it just displays it in the terminal. So the most basic version of the command would be
curl https://repository.mullvad.net/deb/mullvad-keyring.ascand nothing else. Let’s look at what the flags do.-f is for fail.
-s is for silent. Both of these just change the behaviour of curl to give you less feedback and information. Mullvad probably chose to do this to make it more beginner friendly, ironically.
-S is for show error. There’s a difference between lower and upper case. Show error means that even though curl was asked to be quiet and not show what it’s doing, it should still let you know if there’s an error.
-L is for location, it’s to allow redirects. Mullvad chose to include this option so that the old instructions still work if the URL changes in the future or perhaps if you have a common typo in your command.
-o (output) writes the downloaded file to disk at the specific location.
/usr/share/keyrings/mullvad-keyring.asc. The -o flag is the only one in this list that actually matters and changes what the application does. The rest is just there to be beginner friendly, but I think Mullvad made a mistake in including them personally, as I think they add to the confusion instead.As a standard Linux convention, flags can either be a single hyphen and a letter or two hyphens and a word or a hyphenated sentence. These are conventions and up to the application, but for curl and most applications you’ll use, both work. Similarly, curl and most applications let you use a single hyphen and then all your flags in a row, or separate them with spaces and new starting-hyphens.
curl -f --silent -S -L --output file.txt https://lemmy.mlfor example.Okay, so hopefully now you can read it a bit better. Let’s look at it again.
Wtf is that file and why do you need it in that folder? It’s downloading their encryption key to the folder where apt (a different application we haven’t encountered yet) looks for encryption keys. You need this for cryptographic verification. It’s a safety measure, and more important for security software like Mullvad. It’s not mandatory for adding repositories.
So with this command, you borrow the super user’s permissions and you download a file and put it in a folder.
Okay, next part.
Okay, this one is actually pretty complicated! Similar to above, how they added all those superfluous flags that make curl quieter, this is another case of the mullvad help-article-writers choosing to make the experience of copy/pasting the commands more seamless by sacrificing legibility.
But let’s go through it anyway. It’ll be a super quick crash course in how to use Linux.
Echo is an application that repeats whatever you type at it. If you run
echo hiit’ll outputhiinto the terminal. Deb is an application that installs .deb packages. These are like .msi files on Windows. It’s specific to Ubuntu and certain other Linux distros. The stuff that follows echo is a command.deb [signed-by=/usr/share/keyrings/mullvad-keyring.asc arch=$( dpkg --print-architecture )] https://repository.mullvad.net/deb/stable $(lsb_release -cs) main, if you run it on its own, it does something. But because you wrote echo first, it’s only words that are being printed in the terminal. We’ll look at what it’s supposed to do in a minute. After that part, comes a pipe|, this is very important, then a second command.sudo tee /etc/apt/sources.list.d/mullvad.list.Okay, we’ll break this down backwards.
sudoyou already know. It’s just an application that starts another application. In this casetee. tee is an application that takes whatever you give it and writes it to a file. It’s called tee because it’s like a t-split, it both writes to a file and to the terminal at the same time, so you can monitor what’s being written. It’s specifically designed to be used with a pipe.Wtf is a pipe? A pipe
|is a built in Linux function that let’s you take the output from one application and feed it to another. In this case, the stuff you had before the pipe was a echo command. So the output is what you asked echo to echo back to you.deb [signed-by=/usr/share/keyrings/mullvad-keyring.asc arch=$( dpkg --print-architecture )] https://repository.mullvad.net/deb/stable $(lsb_release -cs) main". That means that tee is writing this command (without the echo part in front of it, because that’s your command, not the output from an application) into the file located at/etc/apt/sources.list.d/mullvad.list. Tee by default overwrites whatever was already in the file, and in this case, a mode-switch flag wasn’t used to ask it to not do that. So if that file already existed (which it doesn’t), it would now be deleted and replaced with what you echo’d into it.deb [signed-by=/usr/share/keyrings/mullvad-keyring.asc arch=$( dpkg --print-architecture )] https://repository.mullvad.net/deb/stable $(lsb_release -cs) main".What is
/etc/apt/sources.list.d/mullvad.list? That’s a file that belongs toapt.aptis your package manager, we’ll loop back to that. The/etcfolder is somewhere applications put their files, rather than where the user is supposed to put their files. Having the user’s files separately like that helps with knowing which files you care about when it comes to backups and system migrations and things like that. So inside /etc, apt gets it’s own folder, and inside that folder it created sources.list.d, and inside that folder, you’re now creating a file for mullvad. In this file is the definition of the new repository you’re adding.[Cutting this up to two parts because API limit]
[Part two]
Two questions:
What is a repository?
What’s the stuff that goes in the file? Why is it a command and why is it so long?
I started answering the second question, so we’ll continue with that and loop back to what apt and repositories are for the next and final command.
So echo just means “repeat what you’re given”. Then deb is the Ubuntu equivalent to
msi. Then you’re telling thedebapplication where to find the encryption key you installed earlier, and you’re telling it which arch (short for architecture, it’s the hardware configuration of your computer) you’re interested in. When it says $ and then stuff in parenthesis like that, that stuff gets computed and substituted. So you’re not literally asking for the architecture$( dpkg --print-architecture ), but instead something likearch=amd64.dpkgis an application that keeps track of what .deb packages you have installed. With the flag --print-architecture, it’s switched to a different mode where instead of it’s primary purpose, it’s telling you what system architecture you’re using. Then it’s the URL for the repository. The URL is also variable, part of the URL will get replaced later.$(lsb_release -cs). lsb stands for linux standard base, and lsb_release is just an application that says which Linux distro you’re using. The reason this ‘standard base’ is used rather than the specific distro and version, is because it’s meant to simplify the very large diversity of Linux distributions and versions down to the minimal number of possible versions that actually have some level of incompatibility with each other. So it would say your specific major version of Ubuntu, but it wouldn’t say exactly which patch you’re on. Someone who’s not using Ubuntu, but using something that from a compatibility standpoint is fully Ubuntu compatible, might also report as a Ubuntu version when using this application. The output from this program is added to the URL. The computed result is something likehttps://repository.mullvad.net/deb/stable mantic minotaur main. Main just means the main branch of the application, as opposed to a special branch, like a beta-branch.If you notice, you’re not computing these things first and then putting the result into the file, but instead you’re inserting it with variables. This will allow your system configuration to change without the need to update the repository definition.
All in all, this is a very complicated way to add a repository. On most systems, and indeed on Ubuntu, you can do this with a single application or a flag for the package manager and then a single URL. For Ubuntu it would be
apt-add-repository https://repository.mullvad.net/deb/stable mantic minotaur main. But they chose to do it like this to make it easier to do once and forget.And then finally, what is a repository? What is apt? A repository is a place that hosts software. It’s like the Play store on Android. You can use the Ubuntu repository that is standard for your Linux distribution and guaranteed to work, guaranteed to be safe, guaranteed to be respectful towards you as the user, but you can also add third party repositories. Third party developers can add their applications to the official repository, but doing so means they have to go through a quality assurance step, and that they are limited in the ways they are allowed to abuse you. For security software, this might add too much delay between when it’s critical that they provide an update, and when that update is approved for distribution to Ubuntu users. Instead they have opted to host their application on their own repository.
Apt is your package manager. It keeps track of everything you have installed, every library and component used and required by every application, and for some package managers, every file created by every application. It checks all repositories you’ve specified for updates and automatically updates all your applications. It also deals with requirements and conflicts, ensuring that you don’t have superfluous old libraries taking space, and that when you want to install something with requirements, you don’t need to manually hunt down all the prerequisites. Some package managers available on other systems will even compile applications and deal with build files for you.
A library is a set of application features that doesn’t necessarily belong to a specific application. They do common things and are used my many applications. For a Windows equivalent, you can think of the
Microsoft Visual C++ RedistributableorDirect X.And that’s everything.
Sudo is to get super user permissions, and then run the application
apt,aptis your package manager, and the command you’re giving to the apt application is to update it’s internal knowledge of available packages and versions. It needs to do this because it didn’t previously have the Mullvad repository.Sudo is to borrow the super user’s permissions, apt is your package manager, and you’re telling it to install, and then the name of the application you want to install is
mullvad-vpn. This final stepsudo apt install mullvad-vpn,sudo apt install firefoxis how you install applications on Ubuntu typically. Everything before this was because you needed to add a third party source.Phew, that’s a lot of text! So in hind-sight, it could be easier after all lol. Feel free to ask if you have any questions. It’s a lot of text, but I assure you that if I was going to explain anything about how to use Windows at this level of detail, it would be pages upon pages longer! I hope the explanation wasn’t too condescending. Good luck with learning how to use Linux.
_
Pedantic clarifications:
Great stuff This is going to be useful even to someone who easily understood the commands.
These aren’t instructions. The instructions are 3 lines and provided by the vendor.
It can be much easier to install a PPA than using the command line to do so. I think it’s high time it was as easy as clicking on a (verified) “install this repo” type button on a page, and confirming, entering your sudo password from the launchpad website. I’d even be OK with building it into Discover.
If you’re going to verify repos then you might as well just verify the packages.
I was gonna laugh, but then you included a lot of information, and thinking back to the days when I would write super long instructions for people with lotsa explaining. This is a good effort to impart knowledge and I commend you for it.