1

Good time of the day! I downloaded Tor source code and the signature on a new board, started to check it - and it does not verify! OS is Armbian, no GPG-stuff was ever performed on the installation, i.e. no reconfiguration and so forth. Here is the output:

root@orangepipc:/usr/work# wget https://www.torproject.org/dist/tor-0.3.0.7.tar.gz.asc
--2017-05-20 12:53:10--  https://www.torproject.org/dist/tor-0.3.0.7.tar.gz.asc
Resolving www.torproject.org (www.torproject.org)... 138.201.14.197, 89.45.235.21, 82.195.75.101, ...
Connecting to www.torproject.org (www.torproject.org)|138.201.14.197|:443... connected.
HTTP request sent, awaiting response... 302 Found
Location: https://dist.torproject.org/tor-0.3.0.7.tar.gz.asc [following]
--2017-05-20 12:53:10--  https://dist.torproject.org/tor-0.3.0.7.tar.gz.asc
Resolving dist.torproject.org (dist.torproject.org)... 82.195.75.101, 78.47.38.226, 38.229.72.16, ...
Connecting to dist.torproject.org (dist.torproject.org)|82.195.75.101|:443... connected.
HTTP request sent, awaiting response... 200 OK
Length: 801 [text/plain]
Saving to: ‘tor-0.3.0.7.tar.gz.asc’

tor-0.3.0.7.tar.gz.asc      100%[==========================================>]     801  --.-KB/s   in 0s

2017-05-20 12:53:11 (1.56 MB/s) - ‘tor-0.3.0.7.tar.gz.asc’ saved [801/801]


root@orangepipc:/usr/work# gpg --keyserver pool.sks-keyservers.net --recv-keys 0x4E2C6E8793298290
gpg: requesting key 93298290 from hkp server pool.sks-keyservers.net
gpg: /root/.gnupg/trustdb.gpg: trustdb created
gpg: key 93298290: public key "Tor Browser Developers (signing key) <[email protected]>" imported
gpg: no ultimately trusted keys found
gpg: Total number processed: 1
gpg:               imported: 1  (RSA: 1)
root@orangepipc:/usr/work# gpg --verify tor-0.3.0.7.tar.gz.asc tor-0.3.0.7.tar.gz
gpg: Signature made Tue 16 May 2017 01:51:46 AM MSK using RSA key ID 9E92B601
gpg: Can't check signature: public key not found
root@orangepipc:/usr/work# gpg --fingerprint 0x4E2C6E8793298290
pub   4096R/93298290 2014-12-15 [expires: 2020-08-24]
      Key fingerprint = EF6E 286D DA85 EA2A 4BA7  DE68 4E2C 6E87 9329 8290
uid                  Tor Browser Developers (signing key) <[email protected]>
sub   4096R/F65C2036 2014-12-15 [expires: 2017-08-25]
sub   4096R/D40814E0 2014-12-15 [expires: 2017-08-25]
sub   4096R/C3C07136 2016-08-24 [expires: 2018-08-24]

root@orangepipc:/usr/work# gpg --verify tor-0.3.0.7.tar.gz.asc tor-0.3.0.7.tar.gz
gpg: Signature made Tue 16 May 2017 01:51:46 AM MSK using RSA key ID 9E92B601
gpg: Can't check signature: public key not found
root@orangepipc:/usr/work#
Improve this question

2 Answers 2

Reset to default
1

Well, it seems that it is signed by a different key from Tor developers keys - they should defenately update the scripts and manuals! It seems to be fixed:

root@orangepipc:/usr/work# gpg --verify tor-0.3.0.7.tar.gz.asc tor-0.3.0.7.tar.gz
gpg: Signature made Tue 16 May 2017 01:51:46 AM MSK using RSA key ID 9E92B601
gpg: Can't check signature: public key not found
root@orangepipc:/usr/work# gpg  --keyserver pool.sks-keyservers.net --recv-keys 0x6AFEE6D49E92B601
gpg: requesting key 9E92B601 from hkp server pool.sks-keyservers.net
gpg: key 4607B1FB: public key "Nick Mathewson <[email protected]>" imported
gpg: no ultimately trusted keys found
gpg: Total number processed: 1
gpg:               imported: 1  (RSA: 1)
root@orangepipc:/usr/work# gpg --verify tor-0.3.0.7.tar.gz.asc tor-0.3.0.7.tar.gz
gpg: Signature made Tue 16 May 2017 01:51:46 AM MSK using RSA key ID 9E92B601
gpg: Good signature from "Nick Mathewson <[email protected]>"
gpg:                 aka "Nick Mathewson <[email protected]>"
gpg:                 aka "Nick Mathewson <[email protected]>"
gpg:                 aka "Nick Mathewson <[email protected]>"
gpg: WARNING: This key is not certified with a trusted signature!
gpg:          There is no indication that the signature belongs to the owner.
Primary key fingerprint: 2133 BC60 0AB1 33E1 D826  D173 FE43 009C 4607 B1FB
     Subkey fingerprint: 7A02 B352 1DC7 5C54 2BA0  1545 6AFE E6D4 9E92 B601
root@orangepipc:/usr/work#
Improve this answer
1

You should read the Tor Project website on it's sigining keys, where it clearly states:

Roger Dingledine (0x28988BF5 and 0x19F78451) or Nick Mathewson (0xFE43009C4607B1FB with signing key 0x6AFEE6D49E92B601) sign the Tor source code tarballs. (Nick's old key was 0x165733EA with signing key 0x8D29319A; it signed older tarballs.)

If you read the page that you suggested I read, it says:

Where do I get the signatures and the keys that made them?

Each file on our download page is accompanied by a file with the same name as the package and the extension ".asc". These .asc files are GPG signatures. They allow you to verify the file you've downloaded is exactly the one that we intended you to get. For example, torbrowser-install-6.5.2_en-US.exe is accompanied by torbrowser-install-6.5.2_en-US.exe.asc. For a list of which developer signs which package, see our signing keys page.

Which then provides you information above, and the correct key.

I'm not sure how much clearer you'd like the documentation to be.

Improve this answer
2
  • I have actually did - check this link - I'm making some docs of my own now and will post them to the web soon. This behaviour was not like the previous time
    – Alexey Vesnin ♦
    May 20, 2017 at 14:32
  • It states that that key signs the source tarballs and your case shows the source tarball being signed by that key, entirely as expected.
    – cacahuatl
    May 20, 2017 at 14:55

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .