These are the instructions from the official Tor Browser User Manual in case the Ubuntu torbrowser-launcher package hasn't updated the gpg key that is required to install Tor Browser. When I updated the Tor Browser Developers signing key I noticed that the key that I updated will expire in less than one year.
Install Tor Browser
Navigate to the Tor Browser download page.
Download the GNU/Linux .tar.xz file
(Recommended) Verify the file's signature. The steps for verifying the file's signature are shown below.
When the download is complete, extract the archive with the command tar -xf [TB archive] or with the Archive Manager.
Navigate to the newly extracted Tor Browser directory. Right-click on start-tor-browser, open Properties and change the permission to Allow executing file as program by clicking the checkbox.
Start Tor Browser from the command line by running:
./start-tor-browser
Set a keyboard shortcut to start Tor Browser
Remember the location where you downloaded the tor-browser-linux64-xx.x.xx_xx-xx.tar.xz archive. In this example I will call this location /home/your-username/Downloads/ which is the default location of the Downloads directory in Ubuntu if you replace your-username by your own user name.
Remember the directory where you extracted the Tor Browser files. In this example I will call this directory /home/your-username/Downloads/tor-browser_en-US/ where en is the abbreviation for the language and US is the abbreviation for the nation which could be different depending on your language and nation.
Go to Settings -> Keyboard -> View and Customize Shortcuts -> Set Custom Shortcut.
In the field after Name type Tor Browser.
In the field after Command type: sh -c '"/home/your-username/Downloads/tor-browser_en-US/Browser/start-tor-browser" --detach || ([ ! -x "/home/your-username/Downloads/tor-browser_en-US/Browser/start-tor-browser" ] && "$(dirname "$*")"/Browser/start-tor-browser --detach)' dummy %k
In order to fill in an entry in the field after Shortcut press any easy to remember keyboard shortcut combination (e.g. Ctrl + Alt +B).
Now you can start Tor Browser by pressing Ctrl + Alt +B.
How to verify Tor Browser's signature
Fetching the Tor Developers key
The Tor Browser team signs Tor Browser releases. Import the Tor Browser Developers signing key (0xEF6E286DDA85EA2A4BA7DE684E2C6E8793298290):
gpg --auto-key-locate nodefault,wkd --locate-keys [email protected]
This should show you something like:
gpg: key 4E2C6E8793298290: public key "Tor Browser Developers (signing key) <[email protected]>" imported
gpg: Total number processed: 1
gpg: imported: 1
pub rsa4096 2014-12-15 [C] [expires: 2020-08-24]
EF6E286DDA85EA2A4BA7DE684E2C6E8793298290
uid [ unknown] Tor Browser Developers (signing key) <[email protected]>
sub rsa4096 2018-05-26 [S] [expires: 2020-09-12]
After importing the key, you can save it to a file (identifying it by fingerprint here):
gpg --output ./tor.keyring --export 0xEF6E286DDA85EA2A4BA7DE684E2C6E8793298290
Verifying the signature
To verify the signature of the package you downloaded, you will need to download the corresponding ".asc" signature file as well as the installer file itself, and verify it with a command that asks GnuPG to verify the file that you downloaded.
The example below assumes that you downloaded these two files to your Downloads folder.
gpgv --keyring ./tor.keyring ~/Downloads/tor-browser-linux64-9.0_en-US.tar.xz{.asc,}
The result of the command should produce something like this:
gpgv: Signature made 07/08/19 04:03:49 Pacific Daylight Time
gpgv: using RSA key EB774491D9FF06E2
gpgv: Good signature from "Tor Browser Developers (signing key) <[email protected]>"
