Good time of the day! I downloaded Tor source code and the signature on a new board, started to check it - and it does not verify! OS is Armbian, no GPG-stuff was ever performed on the installation, i.e. no reconfiguration and so forth. Here is the output:
root@orangepipc:/usr/work# wget https://www.torproject.org/dist/tor-0.3.0.7.tar.gz.asc
--2017-05-20 12:53:10-- https://www.torproject.org/dist/tor-0.3.0.7.tar.gz.asc
Resolving www.torproject.org (www.torproject.org)... 138.201.14.197, 89.45.235.21, 82.195.75.101, ...
Connecting to www.torproject.org (www.torproject.org)|138.201.14.197|:443... connected.
HTTP request sent, awaiting response... 302 Found
Location: https://dist.torproject.org/tor-0.3.0.7.tar.gz.asc [following]
--2017-05-20 12:53:10-- https://dist.torproject.org/tor-0.3.0.7.tar.gz.asc
Resolving dist.torproject.org (dist.torproject.org)... 82.195.75.101, 78.47.38.226, 38.229.72.16, ...
Connecting to dist.torproject.org (dist.torproject.org)|82.195.75.101|:443... connected.
HTTP request sent, awaiting response... 200 OK
Length: 801 [text/plain]
Saving to: ‘tor-0.3.0.7.tar.gz.asc’
tor-0.3.0.7.tar.gz.asc 100%[==========================================>] 801 --.-KB/s in 0s
2017-05-20 12:53:11 (1.56 MB/s) - ‘tor-0.3.0.7.tar.gz.asc’ saved [801/801]
root@orangepipc:/usr/work# gpg --keyserver pool.sks-keyservers.net --recv-keys 0x4E2C6E8793298290
gpg: requesting key 93298290 from hkp server pool.sks-keyservers.net
gpg: /root/.gnupg/trustdb.gpg: trustdb created
gpg: key 93298290: public key "Tor Browser Developers (signing key) <[email protected]>" imported
gpg: no ultimately trusted keys found
gpg: Total number processed: 1
gpg: imported: 1 (RSA: 1)
root@orangepipc:/usr/work# gpg --verify tor-0.3.0.7.tar.gz.asc tor-0.3.0.7.tar.gz
gpg: Signature made Tue 16 May 2017 01:51:46 AM MSK using RSA key ID 9E92B601
gpg: Can't check signature: public key not found
root@orangepipc:/usr/work# gpg --fingerprint 0x4E2C6E8793298290
pub 4096R/93298290 2014-12-15 [expires: 2020-08-24]
Key fingerprint = EF6E 286D DA85 EA2A 4BA7 DE68 4E2C 6E87 9329 8290
uid Tor Browser Developers (signing key) <[email protected]>
sub 4096R/F65C2036 2014-12-15 [expires: 2017-08-25]
sub 4096R/D40814E0 2014-12-15 [expires: 2017-08-25]
sub 4096R/C3C07136 2016-08-24 [expires: 2018-08-24]
root@orangepipc:/usr/work# gpg --verify tor-0.3.0.7.tar.gz.asc tor-0.3.0.7.tar.gz
gpg: Signature made Tue 16 May 2017 01:51:46 AM MSK using RSA key ID 9E92B601
gpg: Can't check signature: public key not found
root@orangepipc:/usr/work#