It’s less complicated than it looks like. The text is just a poorly written mess, full of options (Fedora vs. Ubuntu, repo vs. no repo, stable vs. beta), and they’re explaining how to do this through the terminal alone because the interface that you have might be different from what they expect. And because copy-pasting commands is faster.

Can’t I just download a file and install it? I’m on Ubuntu.

Yes, you can! In fact, the instructions include this option; it’s under “Installing the app without the Mullvad repository”. It’s a bad idea though; then you don’t get automatic updates.

A better way to do this is to tell your system “I want software from this repository”, so each time that they make a new version of the program, yours get updated.

but I have no idea what I’m doing here.

I’ll copy-paste their commands to do so, and explain what each does.

sudo curl -fsSLo /usr/share/keyrings/mullvad-keyring.asc https://repository.mullvad.net/deb/mullvad-keyring.asc
echo "deb [signed-by=/usr/share/keyrings/mullvad-keyring.asc arch=$( dpkg --print-architecture )] https://repository.mullvad.net/deb/stable $(lsb_release -cs) main" | sudo tee /etc/apt/sources.list.d/mullvad.list
sudo apt update
sudo apt install mullvad-vpn

The first command boils down to “download this keyring from the internet”. The keyring is a necessary file to know if you’re actually getting your software from Mullvad instead of PoopySoxHaxxor69. If you wanted, you could do it manually, and then move to the /usr/share/keyrings directory, but… it’s more work, come on.

The second command tells your system that you want software from repository.mullvad.net. I don’t use Ubuntu but there’s probably some GUI to do it for you.

The third command boils down to “hey, Ubuntu, update the list of packages for me”.

The fourth one installs the software.

So usually people do install Linux software from trusted software repositories. Linux practically invented the idea of the app store a full ten years before the first iPhone came out and popularized the term “app.”

The problem with the Mullvad VPN is that their app is not in the trusted software repositories of most Linux distributions. So you are required to go through a few extra steps to first trust the Mullvad software repositories, and then install their VPN app the usual way using apt install or from the software center.

You could just download the “.deb” file and double click on it, but you will have to download and install all software security updates by hand. By going through the extra steps to add Mullvad to your trusted software repository list, you will get software security updates automatically whenever you install all other software updates on your computer.

Most Linux distros don’t bother to make it easy for you to add other trusted software repositories because it can be a major security risk if you trust the wrong people. So I suppose it is for the best that the easiest way to install third-party software is to follow the steps you saw on the website.

Download the .deb and double click it. https://mullvad.net/en/download/app/deb/latest

People seem to be making this a more difficult job than it needs to be. Yeah I get we’re powerusers but can’t we drop that for 2 minutes while giving advice so a new user can actually get a job done quickly? Windows EXEs don’t automatically update either. Sure it might not be the best way to do it but it’s fast and not confusing. (EDIT: Apparently this specific program actually has it’s own auto updater)

Things take time to learn. Throwing all of the existing knowledge of repo management at a new user at once does not work.

My favorite part of this thread is everyone just saying copy and paste the commands so it will work. Like we should totally get users into the habit of running random commands off the net as root.

“I have no idea what I’m doing here” <- Happens in the beginning. How about you start by trying to know what exactly you are doing? Let me give you a fasttrack…

1. The first command you get in the instructions is curl. It is generally used to download stuff from a networked server.

   1.1. To understand the -fsSLo in the command, I strongly advise you to check out the manual of curl using man curl in a terminal.

2. The second command in the instructions is echo "something" | sudo tee some/file

   2.1 Here you see 3 commands echo , sudo and tee. 2.1.1 Again, you can use man command-name to check the manual pages for these commands 2.2 There is a | symbol over here. It is called the “pipe symbol”, which is what you can use to search for it. It is usually difficult to search for the symbol itself and I haven’t found a man page for it, but open man bash and look for “Pipelines” and you’ll know what it is about. Use Link, Link and Link to help yourself understand this.

3. The commands in “Install the package” use the apt program. This is a Package Manager. Its job is to read package information that package developers have made and try to not let the system become unusable.

   • e.g. If you have a program called Xorg from 5 years ago, and a program called mesa from 5 years ago and Xorg depends upon mesa to work. Here, if you replace your mesa with a new, recent mesa yourself, there is a good chance Xorg will not work. The Package Manager prevents that from happening.

4. The gist of what the instructions are making you do is, telling the Package Manager that there is another place from where you want it to look for packages.

To understand man pages better, check out this link.

Don’t think too badly of people dissing you in the comments. They are tired and fed up of help vampires. Hopefully, you can try not to become one.

• Try and build your own process of understanding the commands you see on the internet before entering them into the terminal.
• The comments telling you to just follow the instructions, are coming from the perspective that you don’t have the patience and determination to understand them yourself, which, a lot of people don’t. I will leave it upto you to determine which one you decide to be. It is, however, a bad idea to follow instructions on any website, just because it “seems legit”. You can’t really say you “trust” the site until you have the ability to find out for yourself whether you want to trust it.

Check this out

Yes. I’m genuinely unsure how it could be any easier. It’s just add the repo and install.

But I suppose it’s a lot if you don’t know what anything means, so I’ll try to explain it at a super basic level. Sorry if this is patronising, I can’t ascertain your experience level so I have to make an assumption.

The first thing it asks you to do is:

sudo curl -fsSLo /usr/share/keyrings/mullvad-keyring.asc https://repository.mullvad.net/deb/mullvad-keyring.asc

Hm. Okay so I guess before even deciphering the command, you have to know how Linux works. So on Linux, the first word is the name of the application you want to use, and everything afterwards is stuff that you pass along to the application. It’s up to the application to program in the behaviour for interpreting the words that come after the first word. So “sudo” is the name of the application you’re using, and all that other stuff is stuff you’re telling Linux to tell that other application.

Okay, so what is sudo? sudo is short for Super User Do. It’s an application that does something (sudo) as the super user (sudo). Super User is like admin on Windows. So it’s for when you want to make system level changes or want to override permission limitations. In the past, or at a basic level, you would switch user, make the change, then switch back to your personal user. But with sudo you can borrow the permissions of the super user for the purposes of that one command and everything works smoother that way.

The way you use sudo is you run the application by typing sudo, then you type in a second application and what you want that application to do, then sudo starts that other application and gives it the instructions you asked to be passed on. The second application in this case is curl.

For example, on Windows you might do sudo photoshop open C:\users\winuser\documents\restrictedfile.psd to open a file in Photoshop that the Windows admin decided you aren’t allowed to open.

Let’s look at the command again.

sudo curl -fsSLo /usr/share/keyrings/mullvad-keyring.asc https://repository.mullvad.net/deb/mullvad-keyring.asc

Sudo is to get super permissions and doesn’t actually tell you what the command does. The application that is actually being run in this command is curl. curl goes to a url and sees it. So it basically just means download whatever is at this URL. Here the URL is https://repository.mullvad.net/deb/mullvad-keyring.asc All that other stuff in this command is technically curl specific, so you have to check how curl works to know what it does. But it does follow Linux conventions very closely, therefore a normal Linux user who has never used curl could still guess what it does with 100% accuracy and would probably use it correctly for the first time without checking how to use it. If you want to learn how to use it, you can use the included manual program man, by typing man curl, and as a convention, almost every Linux application will tell you how to use it if you use the -h or --help flags by typing curl -h or curl --help.

In this case, curl takes flags, these are -fsSLo, that’s 5 different flags. A flag is like a mode switch for an application, it’s specified with adding a hyphen and the trigger word. The hyphen is useful because an application like curl might want a file path /usr/share/keyrings/mullvad-keyring.asc and a URL https://repository.mullvad.net/deb/mullvad-keyring.asc, so by adding the hyphen, the application knows that fsSLO is not part of the file path, but is instead specific instructions you’re giving the application. This is a normal convention on Linux, similar to how Windows applications normally program the X button in the corner to close the window.

For curl specifically, by default curl doesn’t save the file, it just displays it in the terminal. So the most basic version of the command would be curl https://repository.mullvad.net/deb/mullvad-keyring.asc and nothing else. Let’s look at what the flags do.
-f is for fail.
-s is for silent. Both of these just change the behaviour of curl to give you less feedback and information. Mullvad probably chose to do this to make it more beginner friendly, ironically.
-S is for show error. There’s a difference between lower and upper case. Show error means that even though curl was asked to be quiet and not show what it’s doing, it should still let you know if there’s an error.
-L is for location, it’s to allow redirects. Mullvad chose to include this option so that the old instructions still work if the URL changes in the future or perhaps if you have a common typo in your command.
-o (output) writes the downloaded file to disk at the specific location. /usr/share/keyrings/mullvad-keyring.asc. The -o flag is the only one in this list that actually matters and changes what the application does. The rest is just there to be beginner friendly, but I think Mullvad made a mistake in including them personally, as I think they add to the confusion instead.

As a standard Linux convention, flags can either be a single hyphen and a letter or two hyphens and a word or a hyphenated sentence. These are conventions and up to the application, but for curl and most applications you’ll use, both work. Similarly, curl and most applications let you use a single hyphen and then all your flags in a row, or separate them with spaces and new starting-hyphens. curl -f --silent -S -L --output file.txt https://lemmy.ml for example.

Okay, so hopefully now you can read it a bit better. Let’s look at it again.

sudo curl -fsSLo /usr/share/keyrings/mullvad-keyring.asc https://repository.mullvad.net/deb/mullvad-keyring.asc

Wtf is that file and why do you need it in that folder? It’s downloading their encryption key to the folder where apt (a different application we haven’t encountered yet) looks for encryption keys. You need this for cryptographic verification. It’s a safety measure, and more important for security software like Mullvad. It’s not mandatory for adding repositories.

So with this command, you borrow the super user’s permissions and you download a file and put it in a folder.

Okay, next part.

echo "deb [signed-by=/usr/share/keyrings/mullvad-keyring.asc arch=$( dpkg --print-architecture )] https://repository.mullvad.net/deb/stable $(lsb_release -cs) main" | sudo tee /etc/apt/sources.list.d/mullvad.list

Okay, this one is actually pretty complicated! Similar to above, how they added all those superfluous flags that make curl quieter, this is another case of the mullvad help-article-writers choosing to make the experience of copy/pasting the commands more seamless by sacrificing legibility.

But let’s go through it anyway. It’ll be a super quick crash course in how to use Linux.

echo "deb [signed-by=/usr/share/keyrings/mullvad-keyring.asc arch=$( dpkg --print-architecture )] https://repository.mullvad.net/deb/stable $(lsb_release -cs) main" | sudo tee /etc/apt/sources.list.d/mullvad.list

Echo is an application that repeats whatever you type at it. If you run echo hi it’ll output hi into the terminal. Deb is an application that installs .deb packages. These are like .msi files on Windows. It’s specific to Ubuntu and certain other Linux distros. The stuff that follows echo is a command. deb [signed-by=/usr/share/keyrings/mullvad-keyring.asc arch=$( dpkg --print-architecture )] https://repository.mullvad.net/deb/stable $(lsb_release -cs) main, if you run it on its own, it does something. But because you wrote echo first, it’s only words that are being printed in the terminal. We’ll look at what it’s supposed to do in a minute. After that part, comes a pipe |, this is very important, then a second command. sudo tee /etc/apt/sources.list.d/mullvad.list.

Okay, we’ll break this down backwards. sudo you already know. It’s just an application that starts another application. In this case tee. tee is an application that takes whatever you give it and writes it to a file. It’s called tee because it’s like a t-split, it both writes to a file and to the terminal at the same time, so you can monitor what’s being written. It’s specifically designed to be used with a pipe.

Wtf is a pipe? A pipe | is a built in Linux function that let’s you take the output from one application and feed it to another. In this case, the stuff you had before the pipe was a echo command. So the output is what you asked echo to echo back to you. deb [signed-by=/usr/share/keyrings/mullvad-keyring.asc arch=$( dpkg --print-architecture )] https://repository.mullvad.net/deb/stable $(lsb_release -cs) main". That means that tee is writing this command (without the echo part in front of it, because that’s your command, not the output from an application) into the file located at /etc/apt/sources.list.d/mullvad.list. Tee by default overwrites whatever was already in the file, and in this case, a mode-switch flag wasn’t used to ask it to not do that. So if that file already existed (which it doesn’t), it would now be deleted and replaced with what you echo’d into it. deb [signed-by=/usr/share/keyrings/mullvad-keyring.asc arch=$( dpkg --print-architecture )] https://repository.mullvad.net/deb/stable $(lsb_release -cs) main".

What is /etc/apt/sources.list.d/mullvad.list? That’s a file that belongs to apt. apt is your package manager, we’ll loop back to that. The /etc folder is somewhere applications put their files, rather than where the user is supposed to put their files. Having the user’s files separately like that helps with knowing which files you care about when it comes to backups and system migrations and things like that. So inside /etc, apt gets it’s own folder, and inside that folder it created sources.list.d, and inside that folder, you’re now creating a file for mullvad. In this file is the definition of the new repository you’re adding.

[Cutting this up to two parts because API limit]

As others have already pointed out, a lot of Linux software is installed from repositories in a standard way, and once you do that, it updates automatically.

However, as you’ve already discovered, there’s more than one way to install Linux software. Repositories are still the most common way, but installing single .deb’s (Debian based distributions) or .rpms (RedHat packaging format) is still there and there are more like Snap, Flatpak and Appimage. You can also often just download the source and compile it yourself. It’s a very diverse ecosystem, not like the controlled worlds of WIndows and Mac.

In this case you can download the .deb file, and pretty sure you can even install it through the file manager, just like in Windows (I don’t use Ubuntu, but I think it will just start GUI installation if you double-click on a .deb file).

But lot of things in Linux are still done through the terminal, like changing configurations and, yes, installing things.

Getting used to it takes a while, especially if you’re not used to modern Windows administration through PowerShell.

The important part is trying to figure out what each of the commands do and that the output actually means. Software that supports Linux normally has very clear instructions (like in this case), but it does require willingness to change habits, technical curiosity and some trial and error (patience). It’s not quite as polished experience as the commercial OS’s. There’s still a lot of rough edges for the user.

Good luck on your Linux journey!

Asking why something is the way it is makes you more of a “Linux user” than many.

You make a valid criticism; there’s definitely a learning curve to installing software if you choose to do it that way (since it’s not similar to other OSs), and it’s not automatically explained to new users by using the OS.

Here’s the understanding of it I’ve come to, if you’re interested:

Like others have said, the .deb file would be the equivalent of an .exe file on Windows. Like many .exe files, unless they include an auto-updater, they won’t automatically update.

A key difference I would like to point out is that Linux package managers often update and manage parts of the OS in addition to extra software. Windows and macOS both update their OS separately.

“Ubuntu Software Center” is similar to the “Microsoft Store” on Windows and the “App Store” on macOS. Like those, it’s user friendly and provides automatic updates, but it also doesn’t have every app. You can ensure those apps are safe because the company behind the OS verifies them.

“apt-get” is the default package manager for Ubuntu. That is the tool doing the heavy lifting underneath, and what those commands Mullvad gave are for.

Mullvad could have provided a script to download and run that executes those commands for you, but then you wouldn’t know what it’s doing, especially with it needing admin permission. With how security-oriented Mullvad’s brand is, I think that’s one potential reason they explain the steps and have the user do it instead.

Chance that your Ubuntu version already supports OpenVPN and wireguard (check your settings -> network). If so, just download wireguard/OpenVPN config files from mullvad: https://mullvad.net/account/openvpn-config?platform=linux

That page lists multiple installation methods, for multiple distros. There simplest one for you is just two steps.

1. Download .deb installer

2. Run apt install ~/Downloads/MullvadVPN-*_amd64.deb

It’s not that complicated. That’s just confusingly written. And caters to a wide range of users.

While lvxferre’s instructions are the ideal, there’s a simpler option

Download the mullvad.deb file.

Doubleclick on it from your file manager and it should automatically instsll

Every time you start mullvad it will check if the version is current and prompt you (with a link to click on) to upgrade if it’s not.

Note that works on mint, should work on ubuntu unless they’ve disabled dpkg

The comment section here is a perfect example of why people don’t use Linux

I think if you read through this you have pretty much everything you asked about. As for understanding what these sorts of commands do in the future I think ChatGPT is actually really useful for stuff like this with good documentation. Just ask what the commands do and it is usually quite helpful. Someone already said it but you have to want to learn this. If you want something easy to use and you don’t have to learn buy a Mac, you want great software compatibility buy a windows pc. If you want something that is more private and a community effort use Linux but unless you are using steam os on a steam deck it is not even close to being as user friendly as the others. I hope this changes but the current goals and mindsets of people in this community will prevent Linux from becoming easy to use and in the case of steam os you just need lots of money to make it an easy experience. There are a million other reasons that Linux’s current state is this way but this is the gist.

You can achieve this through graphical utilities.

Self-updating apps aren’t a big thing on Linux, so the Windows way isn’t an option…

The signing key is important for security reasons, so you definitely need to add that. After adding the repo you can just use Synaptic or whatever app store thingy Ubuntu uses.

Most of the time you shouldn’t need to fiddle with the command line and the apps you will need are available through the Software Centre and the entire process will work like on Windows.

For me, Linux was the first operating system I used that had an app store or software centre and I was pretty glad to not need to…

• open a browser,
• navigate to a site,
• (hope it is the right site…)
• download a binary executable,
• open a file explorer,
• launch the binary,
• click through a list of options and agreements,
• and finally delete the binary.

Also note that Mullvad has a pretty technical user base and target audience, and thus their documentation is likely geared towards them. You could also consider using Mozilla VPN, which offers pretty much the same advantages (they use Mullvad’s servers), at the same price if you pay annually, and is easier to use.