Download themes.tar, which contains 155 themes for IceWM including BlueSteel. This theme set is larger than the default extra-themes archive that one finds in Arch Linux or older version of other distributions. Download ubuntu-font-family-0.83 for the complete set of Ubuntu fonts.  One font that I enjoy is AG57, Akzidenze Grotesk, some details of which can be found online.  That font is the precursor of Helvetica, which is also a wonderful font to use .

Extract the individual themes to ~/.icewm/themes.

Then, to modify that size of the text in the title bars regardless of theme, create a prefoverride file.  This is needed in the case of high resolution displays where the standard scaling settings do not modify the size of the window title bar text in IceWM.

Filename: ~/.icewm/prefoverride

# TitleFontNameXft="Impact, Condensed:size=10"
TitleFontNameXft="ubuntu:size=12"

In this example, the font that I enjoyed called Impact is commented out, and Ubuntu is set to active. I used Impact, but choose to change it to Ubuntu. I left the comment there so that I could remember that one in the future.

By default, with this version, there is a sample config file in /usr/share/doc/picom/examples/picom.sample.conf.  Copy this file to ~/.config/picom/picom.conf and modify to to suit your preferences.

In my case, I changed the shadow widths on the windows and their starting locations.  I also disabled transparency because I dislike the effect of partially transparent windows.

Here is my config file (~/.config/picom/picom.conf):

#################################
#             Shadows           #
#################################

# Enabled client-side shadows on windows. Note desktop windows
# (windows with '_NET_WM_WINDOW_TYPE_DESKTOP') never get shadow,
# unless explicitly requested using the wintypes option.
#
# shadow = false
shadow = true;

# The blur radius for shadows, in pixels. (defaults to 12)
# shadow-radius = 12
shadow-radius = 12;

# The opacity of shadows. (0.0 - 1.0, defaults to 0.75)
shadow-opacity = .60

# The left offset for shadows, in pixels. (defaults to -15)
# shadow-offset-x = -15
shadow-offset-x = -10;

# The top offset for shadows, in pixels. (defaults to -15)
# shadow-offset-y = -15
shadow-offset-y = -10;

# Red color value of shadow (0.0 - 1.0, defaults to 0).
# shadow-red = 0

# Green color value of shadow (0.0 - 1.0, defaults to 0).
# shadow-green = 0

# Blue color value of shadow (0.0 - 1.0, defaults to 0).
# shadow-blue = 0

# Hex string color value of shadow (#000000 - #FFFFFF, defaults to #000000). This option will override options set shadow-(red/green/blue)
# shadow-color = "#000000"

# Specify a list of conditions of windows that should have no shadow.
#
# examples:
#   shadow-exclude = "n:e:Notification";
#
# shadow-exclude = []
shadow-exclude = [
  "name = 'Notification'",
  "class_g = 'Conky'",
  "class_g ?= 'Notify-osd'",
  "class_g = 'Cairo-clock'",
  "_GTK_FRAME_EXTENTS@:c"
];

# Specify a list of conditions of windows that should have no shadow painted over, such as a dock window.
# clip-shadow-above = []

# Specify a X geometry that describes the region in which shadow should not
# be painted in, such as a dock window region. Use
#    shadow-exclude-reg = "x10+0+0"
# for example, if the 10 pixels on the bottom of the screen should not have shadows painted on.
#
# shadow-exclude-reg = ""

# Crop shadow of a window fully on a particular Xinerama screen to the screen.
# xinerama-shadow-crop = false

#################################
#           Fading              #
#################################

# Fade windows in/out when opening/closing and when opacity changes,
#  unless no-fading-openclose is used.
# fading = false
fading = true;

# Opacity change between steps while fading in. (0.01 - 1.0, defaults to 0.028)
# fade-in-step = 0.028
fade-in-step = 0.03;

# Opacity change between steps while fading out. (0.01 - 1.0, defaults to 0.03)
# fade-out-step = 0.03
fade-out-step = 0.03;

# The time between steps in fade step, in milliseconds. (> 0, defaults to 10)
# fade-delta = 10

# Specify a list of conditions of windows that should not be faded.
# fade-exclude = []

# Do not fade on window open/close.
# no-fading-openclose = false

# Do not fade destroyed ARGB windows with WM frame. Workaround of bugs in Openbox, Fluxbox, etc.
# no-fading-destroyed-argb = false

#################################
#   Transparency / Opacity      #
#################################

# Opacity of inactive windows. (0.1 - 1.0, defaults to 1.0)
# inactive-opacity = 1
#inactive-opacity = 0.8;

# Opacity of window titlebars and borders. (0.1 - 1.0, disabled by default)
# frame-opacity = 1.0
#frame-opacity = 0.7;

# Let inactive opacity set by -i override the '_NET_WM_WINDOW_OPACITY' values of windows.
# inactive-opacity-override = true
#inactive-opacity-override = false;

# Default opacity for active windows. (0.0 - 1.0, defaults to 1.0)
active-opacity = 1.0

# Dim inactive windows. (0.0 - 1.0, defaults to 0.0)
# inactive-dim = 0.0

# Specify a list of conditions of windows that should never be considered focused.
# focus-exclude = []
#focus-exclude = [ "class_g = 'Cairo-clock'" ];

# Use fixed inactive dim value, instead of adjusting according to window opacity.
# inactive-dim-fixed = 1.0

# Specify a list of opacity rules, in the format `PERCENT:PATTERN`,
# like `50:name *= "Firefox"`. picom-trans is recommended over this.
# Note we don't make any guarantee about possible conflicts with other
# programs that set '_NET_WM_WINDOW_OPACITY' on frame or client windows.
# example:
#    opacity-rule = [ "80:class_g = 'URxvt'" ];
#
#opacity-rule = []

#################################
#           Corners             #
#################################

# Sets the radius of rounded window corners. When > 0, the compositor will
# round the corners of windows. Does not interact well with
# `transparent-clipping`.
corner-radius = 0

# Exclude conditions for rounded corners.
rounded-corners-exclude = [
  "window_type = 'dock'",
  "window_type = 'desktop'"
];

#################################
#     Background-Blurring       #
#################################

# Parameters for background blurring, see the *BLUR* section for more information.
# blur-method =
# blur-size = 12
#
# blur-deviation = false
#
# blur-strength = 5

# Blur background of semi-transparent / ARGB windows.
# Bad in performance, with driver-dependent behavior.
# The name of the switch may change without prior notifications.
#
# blur-background = false

# Blur background of windows when the window frame is not opaque.
# Implies:
#    blur-background
# Bad in performance, with driver-dependent behavior. The name may change.
#
# blur-background-frame = false

# Use fixed blur strength rather than adjusting according to window opacity.
# blur-background-fixed = false

# Specify the blur convolution kernel, with the following format:
# example:
#   blur-kern = "5,5,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1";
#
# blur-kern = ""
blur-kern = "3x3box";

# Exclude conditions for background blur.
# blur-background-exclude = []
blur-background-exclude = [
  "window_type = 'dock'",
  "window_type = 'desktop'",
  "_GTK_FRAME_EXTENTS@:c"
];

#################################
#       General Settings        #
#################################

# Daemonize process. Fork to background after initialization. Causes issues with certain (badly-written) drivers.
# daemon = false

# Specify the backend to use: `xrender`, `glx`, or `xr_glx_hybrid`.
# `xrender` is the default one.
#
# backend = "glx"
backend = "xrender";

# Enable/disable VSync.
# vsync = false
vsync = true;

# Enable remote control via D-Bus. See the *D-BUS API* section below for more details.
# dbus = false

# Try to detect WM windows (a non-override-redirect window with no
# child that has 'WM_STATE') and mark them as active.
#
# mark-wmwin-focused = false
mark-wmwin-focused = true;

# Mark override-redirect windows that doesn't have a child window with 'WM_STATE' focused.
# mark-ovredir-focused = false
mark-ovredir-focused = true;

# Try to detect windows with rounded corners and don't consider them
# shaped windows. The accuracy is not very high, unfortunately.
#
# detect-rounded-corners = false
detect-rounded-corners = true;

# Detect '_NET_WM_WINDOW_OPACITY' on client windows, useful for window managers
# not passing '_NET_WM_WINDOW_OPACITY' of client windows to frame windows.
#
# detect-client-opacity = false
# detect-client-opacity = true;

# Use EWMH '_NET_ACTIVE_WINDOW' to determine currently focused window,
# rather than listening to 'FocusIn'/'FocusOut' event. Might have more accuracy,
# provided that the WM supports it.
#
# use-ewmh-active-win = false

# Unredirect all windows if a full-screen opaque window is detected,
# to maximize performance for full-screen windows. Known to cause flickering
# when redirecting/unredirecting windows.
#
# unredir-if-possible = false

# Delay before unredirecting the window, in milliseconds. Defaults to 0.
# unredir-if-possible-delay = 0

# Conditions of windows that shouldn't be considered full-screen for unredirecting screen.
# unredir-if-possible-exclude = []

# Use 'WM_TRANSIENT_FOR' to group windows, and consider windows
# in the same group focused at the same time.
#
# detect-transient = false
detect-transient = true;

# Use 'WM_CLIENT_LEADER' to group windows, and consider windows in the same
# group focused at the same time. This usually means windows from the same application
# will be considered focused or unfocused at the same time.
# 'WM_TRANSIENT_FOR' has higher priority if detect-transient is enabled, too.
#
# detect-client-leader = false

# Resize damaged region by a specific number of pixels.
# A positive value enlarges it while a negative one shrinks it.
# If the value is positive, those additional pixels will not be actually painted
# to screen, only used in blur calculation, and such. (Due to technical limitations,
# with use-damage, those pixels will still be incorrectly painted to screen.)
# Primarily used to fix the line corruption issues of blur,
# in which case you should use the blur radius value here
# (e.g. with a 3x3 kernel, you should use `--resize-damage 1`,
# with a 5x5 one you use `--resize-damage 2`, and so on).
# May or may not work with *--glx-no-stencil*. Shrinking doesn't function correctly.
#
# resize-damage = 1

# Specify a list of conditions of windows that should be painted with inverted color.
# Resource-hogging, and is not well tested.
#
# invert-color-include = []

# GLX backend: Avoid using stencil buffer, useful if you don't have a stencil buffer.
# Might cause incorrect opacity when rendering transparent content (but never
# practically happened) and may not work with blur-background.
# My tests show a 15% performance boost. Recommended.
#
# glx-no-stencil = false

# GLX backend: Avoid rebinding pixmap on window damage.
# Probably could improve performance on rapid window content changes,
# but is known to break things on some drivers (LLVMpipe, xf86-video-intel, etc.).
# Recommended if it works.
#
# glx-no-rebind-pixmap = false

# Disable the use of damage information.
# This cause the whole screen to be redrawn everytime, instead of the part of the screen
# has actually changed. Potentially degrades the performance, but might fix some artifacts.
# The opposing option is use-damage
#
# no-use-damage = false
use-damage = true;

# Use X Sync fence to sync clients' draw calls, to make sure all draw
# calls are finished before picom starts drawing. Needed on nvidia-drivers
# with GLX backend for some users.
#
# xrender-sync-fence = false

# GLX backend: Use specified GLSL fragment shader for rendering window contents.
# See `compton-default-fshader-win.glsl` and `compton-fake-transparency-fshader-win.glsl`
# in the source tree for examples.
#
# glx-fshader-win = ""

# Force all windows to be painted with blending. Useful if you
# have a glx-fshader-win that could turn opaque pixels transparent.
#
# force-win-blend = false

# Do not use EWMH to detect fullscreen windows.
# Reverts to checking if a window is fullscreen based only on its size and coordinates.
#
# no-ewmh-fullscreen = false

# Dimming bright windows so their brightness doesn't exceed this set value.
# Brightness of a window is estimated by averaging all pixels in the window,
# so this could comes with a performance hit.
# Setting this to 1.0 disables this behaviour. Requires --use-damage to be disabled. (default: 1.0)
#
# max-brightness = 1.0

# Make transparent windows clip other windows like non-transparent windows do,
# instead of blending on top of them.
#
# transparent-clipping = false

# Set the log level. Possible values are:
#  "trace", "debug", "info", "warn", "error"
# in increasing level of importance. Case doesn't matter.
# If using the "TRACE" log level, it's better to log into a file
# using *--log-file*, since it can generate a huge stream of logs.
#
# log-level = "debug"
log-level = "warn";

# Set the log file.
# If *--log-file* is never specified, logs will be written to stderr.
# Otherwise, logs will to written to the given file, though some of the early
# logs might still be written to the stderr.
# When setting this option from the config file, it is recommended to use an absolute path.
#
# log-file = "/path/to/your/log/file"

# Show all X errors (for debugging)
# show-all-xerrors = false

# Write process ID to a file.
# write-pid-path = "/path/to/your/log/file"

# Window type settings
#
# 'WINDOW_TYPE' is one of the 15 window types defined in EWMH standard:
#     "unknown", "desktop", "dock", "toolbar", "menu", "utility",
#     "splash", "dialog", "normal", "dropdown_menu", "popup_menu",
#     "tooltip", "notification", "combo", and "dnd".
#
# Following per window-type options are available: ::
#
#   fade, shadow:::
#     Controls window-type-specific shadow and fade settings.
#
#   opacity:::
#     Controls default opacity of the window type.
#
#   focus:::
#     Controls whether the window of this type is to be always considered focused.
#     (By default, all window types except "normal" and "dialog" has this on.)
#
#   full-shadow:::
#     Controls whether shadow is drawn under the parts of the window that you
#     normally won't be able to see. Useful when the window has parts of it
#     transparent, and you want shadows in those areas.
#
#   clip-shadow-above:::
#     Controls wether shadows that would have been drawn above the window should
#     be clipped. Useful for dock windows that should have no shadow painted on top.
#
#   redir-ignore:::
#     Controls whether this type of windows should cause screen to become
#     redirected again after been unredirected. If you have unredir-if-possible
#     set, and doesn't want certain window to cause unnecessary screen redirection,
#     you can set this to `true`.
#
wintypes:
{
  tooltip = { fade = true; shadow = true; opacity = 0.75; focus = true; full-shadow = false; };
  dock = { shadow = false; clip-shadow-above = true; }
  dnd = { shadow = false; }
  popup_menu = { opacity = 0.95; }
  dropdown_menu = { opacity = 0.95; }
};

To use picom effectively, add “picom -b” to the session manager for startup options.  Steam does not like picom, so use “pkill picom” before launching games that rely on Steam.  In my particular case I have a session that uses the KDE destkop and I switch into that for steam gaming and then back to my LXQT session with IceWM and Picom for everything else.

sudo apt update && sudo apt install extrepo -y
sudo extrepo enable librewolf
sudo apt update && sudo apt install librewolf -y

Extrarepo exists only in Sid, which makes it unsuitable for Bookworm, or other stable Debian editions.  Adding Sid repos can turn Debian into something akin to a rolling distribution but it can cause problems if one wants older software.

To integrate the linked appimage into the operating system, take the following actions.²

./LibreWolf.x86_64.AppImage --appimage-extract
mv squashfs-root librewolf-145.0.1-2
mv librewolf-145.0.1-2 $HOME/Apps
cp $HOME/Apps/librewolf-145.0.1-2/io.gitlab.LibreWolf.desktop $HOME/.local/share/applications

Then, modify the four lines in $HOME/.local/share/applications/io.gitlab.LibreWolf.desktop that say exec. Those lines need to reflect the path where the executable resides.

I was working on this with Obsidian and preparing to archive the appimage on this website when I ran into a snag. The Obsidian .desktop referenced the AppRun from the AppImage whereas Librewolf referenced the executable named librewolf. After resolving this, I checked the licenses. Obsidian distributes software that is under the Apache License. That license allows one to add other requirements to their additions to the software. Their additional term is that you may not redistribute their software. They are even more onerous that IBM was with Lotus Symphony 3. Lotus Symphony 3 was an office suite built on Open Office that had an excellent tabbed document interface. It was a beautiful interface that Open Office should have incorporated, but for some reason they did not. The Symphony 3 license allows you to redistribute on physical disc to your friends and family, but not via internet website. Obsidian says no to redistribution at all. I was using Obsidian extensively on all my mobile devices, but will have to discontinue using it now. I have no interest in building open source machines with open source operating systems and having software that does not allow you to mirror it.

./Obsidian-1.10.3.AppImage --appimage-extract
mv squashfs-root Obsidian-1.10.3
mv Obsidian-1.10.3 $HOME/Apps
cp $HOME/Apps/Obsidian-1.10.3/obsidian.desktop $HOME/.local/share/applications

Modify the exec line in $HOME/.local/share/applications/obsidian.desktop to reflect the path where the AppImage contents appear. The exec should point to the application binary and not the AppRun file. e.g. $HOME/Apps/Obsidian-1.10.3/obsidian

I will leave this here for memory and education, but will discontinue the use of Obsidian since its future as an ongoing concern is limited to their availability of their website as a distribution channel. That does not bode well. Symphony 3 (1.3 on Linux) is nearly extinct, but one can still run it on old virtual machines.

1. Mozilla’s strategic direction seems to be toward operating as an advertising company that uses the software clients themselves as the vehicle for advertisements and user data rather than websites and advertising platforms showing advertisements on those sites.
2. I use $HOME/Apps and $HOME/Applications to install programs like this rather than opt so that I can easily modify files or use them in backup scripts. Typically Apps contains smaller programs, and Applications contains larger ones such as GPT4ALL which consumes tens of gigabytes.

/etc/apt/sources.list.d/vivaldi.list

### THIS FILE IS AUTOMATICALLY CONFIGURED ###
# You may comment out this entry, but any other modifications may be lost.
deb [arch=amd64] https://repo.vivaldi.com/stable/deb/ stable main

End of File

/etc/apt/sources.list

                                                
#deb cdrom:[Debian GNU/Linux 12.4.0 _Bookworm_ - Official amd64 NETINST with firmware 20231210-17:56]/ bookworm main>

deb http://deb.debian.org/debian/ bookworm main non-free-firmware
deb-src http://deb.debian.org/debian/ bookworm main non-free-firmware

deb http://security.debian.org/debian-security bookworm-security main non-free-firmware
deb-src http://security.debian.org/debian-security bookworm-security main non-free-firmware

# bookworm-updates, to get updates before a point release is made;
# see https://www.debian.org/doc/manuals/debian-reference/ch02.en.html#_updates_and_backports
deb http://deb.debian.org/debian/ bookworm-updates main non-free-firmware
deb-src http://deb.debian.org/debian/ bookworm-updates main non-free-firmware

# Debian 12 "bookworm" dropped by Python2.  Adding Debian 11 "bullseye"
# removed bullseye non-free-firmware from each of the below bullseye lines
# due to errors on 7/24/25

deb http://deb.debian.org/debian/ bullseye main
deb-src http://deb.debian.org/debian/ bullseye main
deb http://security.debian.org/debian-security bullseye-security main
deb-src http://security.debian.org/debian-security bullseye-security main
deb http://deb.debian.org/debian/ bullseye-updates main
deb-src http://deb.debian.org/debian/ bullseye-updates main


# added 7/24/25
# https://fasttrack.debian.net/


deb http://fasttrack.debian.net/debian-fasttrack/ bookworm-fasttrack main contrib
deb http://fasttrack.debian.net/debian-fasttrack/ bookworm-backports-staging main contrib



# This system was installed using small removable media
# (e.g. netinst, live or single CD). The matching "deb cdrom"
# entries were disabled at the end of the installation process.
# For information about how to configure apt package sources,
# see the sources.list(5) manual.

End of File

To prevent this and reduce the amount of time spent in sorting out the bit rot introduced to my investments by Microsoft’s proclivities, I have standardized on two operating systems for major time investments in computing that occupy my life.  Windows still has a place since I sometimes use Windows only games to play with my child.  Other than that necessity, I have built the things I rely on for use with Linux.  The two versions that I have standardized on are Debian and Fedora. Specifically Debian 12 and Fedora 38.  These are not what is used for the website, but they are the major components of my anti-bitrot infrastructure.  I am aware this may not be good security practice, but this isn’t to get me a job, this is to serve an aging man and his family reliably over time.

There are a few reasons that I selected Fedora 38 and Debian 12. Fedora 38 still has Python 2.7 in the repositories.  It was within 2 versions for upgrading from Fedora 36. Fedora 36 was what I was running in my Windows Subsystem for Linux instance, and I upgraded it to Fedora 38.   When deciding to move back to bare metal for my Linux software development and automation needs, I decided to standardize on that one.  Debian has a 32 bit version. I have both the 32-bit and 64-bit deployed in my network.  Debian 32 bit allows on to easily 32-bit builds of Java on a Linux server.  One can add the testing repository and have the latest Java in 32 bit form.  32-bit Java is necessary to run older Minecraft versions.  My family has a large set of mod-collections and old Java Minecraft instances and maps going back about 8 years. I can then run the latest JVM and the latest Minecraft on the same server because the 32bit JVM is available.  It is very annoying to try and  manage 32bit and 64bit Java virtual machines on the same host, so having it all 32-bit solves a huge problem.  One can add the Debian 11 repository and install Python2.7 if one wants to use old Python versions.  I need this old Python version for a project that I worked on over the course of the last 8 years.

The general anti-bit rot measure for Debian is to always use apt-get to install packages as this will leave the .deb file in the cache.  Then copy those .deb files on a regular basis to another location for use as a repository for other Debian installations.  This can be configured to work via a cron job.  Debian is really the only long-term viable game in town if one wants a 32-bit anti-bitrot bunker that will last into the future, over say, a ten year time horizon. Save the .deb files on a private web-server inside the network and periodically update that repository with the files copied via the sweeps from the cache directory.

For Fedora, this should work with any version.  Fedora 38 is the one I use.  Edit the /etc/dnf/dnf.conf file to say keep_cache=True, and this will save the dowloaded RPMS.  One can then build their repository using only what they need if so desired.  The other genuine long term standardization option is to mirror the entire repositories to the private webserver within one’s network.  To do this, install yumdownloader.   Then, move all of the .repo files from /etc/yum.repos.d except for one to a temporary location.  Then, go into a directory with a lot of space.  For Fedora 38, the complete mirror was 229GB.  Then use yumdownloader * and it will download all files from that repository.  Then, use yumdownloader –source * and it will download all source packages for the packages that it just downloaded.  Then, go back to /etc/yum.repos.d and switch that .repo file out with one that was moved previously, and repeat the process until all repositories have been completely downloaded.  Then, copy all downloaded RPMS to one large directory on the webserver and use createrepo to create the meta data.  Then on the client machines, create a .repo pointing to your own webserver, and move the existing .repo files in /etc/yum.repos.d to an archival location.   Then all of your installations will occur from your own webserver and all machines will have the same versions of packages.

In my case, I then install the data science specifics that I need for the automated software that I created.  The process varies slightly depending on whether the system is Fedora or Debian.

For Debian:

Add bullseye to sources.list
Install python2 via bullseye repositories
Install pip via the downloaded file from https://linuxhint.com/install-pip-on-debian-11/ that is to say,
1. wget https://bootstrap.pypa.io/pip/2.7/get-pip.py
2. python2 ./get-pip.py
Apt-get install libcurl4-openssl-dev

R:
Install.packages(‘curl’)
Install.packages(‘fpp2’)
Install.packages(‘magrittr’)
Install.packages(‘urca’)
Install.packages(‘vars’)
Install.packages(‘psych’)
Apt-get install r-cran-rjava
Install.packages(‘rJava’)
Install.packages(‘xlsx’)
Install.packages(‘Hmisc’)
Install.packages(‘prophet’)
Install.packages(‘dplyr’)
pip2 install parsedatetime==2.5
apt-get install awscli
pip2 install boto3
apt-get install r-cran-car

Troubleshooting steps if .xlsx and others are not built:
Are all R packages installed successfully with a 0 exit status?

On Fedora, the repositories do not contain R components in the same way the Debian repositories do.  Here is the process for Fedora 38.

Used the script https://bootstrap.pypa.io/pip/2.7/get-pip.py
pip2 install parsedatetime==2.5 –user
dnf install libcurl
dnf install libcurl-devel
dnf install R
dnf install awscli
pip2 install boto3 –user
dnf install cmake

Within R:
install.packages(‘car’)
install.packages(‘curl’)
install.packages(‘fpp2′)
install.packages(‘magrittr’)
install.packages(‘urca’)
install.packages(‘vars’)
install.packages(‘psych’)
install.packages(‘rJava’)
install.packages(‘xlsx’)
install.packages(‘Hmisc’)
install.packages(‘prophet’)
install.packages(‘dplyr’)

export PATH=$PATH:/usr/sbin

In Gnome, applications will open on the server instead of the client when using X11 forwarding.  This will occur even though xcalc opens on the client normally.  The way to avoid this is to add the following to .bashrc

unset XDG_RUNTIME_DIR 
unset GDK_BACKEND

The general rule is compress, then encrypt.^{1, 2}

1. https://stackoverflow.com/questions/4676095/when-compressing-and-encrypting-should-i-compress-first-or-encrypt-first

2. https://crypto.stackexchange.com/questions/33737/is-it-better-to-encrypt-before-compression-or-vice-versa

Edit /etc/apt/sources.list to contain the following lines:

deb http://deb.debian.org/debian testing main
deb-src http://deb.debian.org/debian testing main

Then, run the following commands.

apt-get update
apt-get install openjdk-21-jre

java –version

https://wiki.debian.org/DebianTesting contains a good reference guide for using Debian Testing, including details on upgrading to the next distribution.  The approximate Java lifecycle can be found at https://www.oracle.com/java/technologies/java-se-support-roadmap.html.