I mostly run Ubuntu versions and never have problems verifying signatures and sha256sum on the Tor releases for Ubuntu.

However, when I attempted to put tor on a windows7 machine, torbrowser-install-6.0.3_en-US.exe always gives me a sha256sum of: c444319129d3de300eb4d7421861cc75f03eb9b0ee00738e2cdde4d63395c0d4.

The correct sum is e8ca44a4d73bc0183973e3e7abbbaf546c2a1d2cae3df58b76e929332e02a277.

I downloaded the Windows 7 release several times on different machines and platforms and always got the same invalid hash no matter which platform I chose.

1 Answer 1


#19494 (Invalid SHA256 on version 6.0.1 et 6.0.2)

The sha256sums-unsigned-build.txt file contains the hashes of the bundles before they are signed.

For the Windows bundles, you can use osslsigncode to remove the signature. It is available in this git repository: http://git.code.sf.net/p/osslsigncode/osslsigncode/

Then you can do:

$ sha256sum torbrowser-install-6.0.2_en-US.exe 
3a2e05304345936fd713b638612088fa0914102389c15c7bf7aa1d74803e5db8  torbrowser-install-6.0.2_en-US.exe
$ ./osslsigncode remove-signature torbrowser-install-6.0.2_en-US.exe torbrowser-install-6.0.2_en-US.exe-unsigned
$ sha256sum torbrowser-install-6.0.2_en-US.exe-unsigned
697a1d592c46138f894f9c03db54393bf61dd53df1b1043844f59f7e85439d1b  torbrowser-install-6.0.2_en-US.exe-unsigned

We are still working on the instructions to remove the code signing on the .dmg files. This is ticket #18925.

If you want to verify the download, use the corresponding .asc file. It both validates the cryptographic hash of the file and allows you to ensure that the hash is provided by the the correct key (I.E. the providence of the claimed cryptographic hash of the file).

You do want to ensure that the cryptographic hash is actually provided to you by the correct party and not just rely on a checksum published on a website, for an example as to why this is important see what happened to Linux Mint recently (hackers replaced their download links and the checksums for the isos listed on the website, signature verification would have prevented this.).

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .