Tor Stack Exchange is a question and answer site for researchers, developers, and users of Tor. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top


  • sha256sums.txt
  • downloading one or more signatures
  • the archive itself

Then verifying each signature one by one. Then creating the sha256 of the archive. Then looking into the sha256sums.txt file if the sha256 sum matches. These are a lot steps. Kinda more cumbersome than verifying TBB 2.x (where you just verify the archive with a signature).

Can the required steps be reduced a bit without sacrificing security? Is shasums --check helpful?

If you want, feel free to edit this question and make it Linux/CLI specific if its too broad.

share|improve this question
Could you please include the links to these files? They are not in /dist of the Tor site. – user66 Oct 24 '13 at 12:46

This could be scripted.



wget --no-check-certificate $d/$z
wget --no-check-certificate $d/sha256sums.txt
for u in dcf erinn gk ln5 mp
    wget --no-check-certificate $d/sha256sums.txt.$u-asc

for asc in *-asc
    gpg --verify $asc sha256sums.txt
    [[ $v -eq 0 ]] && verified=0

if [[ $verified -eq 0 ]]
    t=$(mktemp -t sha)
    grep $z sha256sums.txt > $t
    shasum -c $t
    rm $t
    echo no signature could be verified

This works on Mac OS X with all the tools installed from MacPorts.

share|improve this answer
Note that using gpg's exit code is not a reliable indication of whether things are all great or not. Might be better to use --status-fd and look for VALID_SIG. Maybe even with the fingerprints we expect. If you write a /bin/sh script you should probably not use bashisms such as [[. Also, please quote your variables, thanks :) – weasel - Peter Palfrader Nov 2 '13 at 22:49

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.