When I had finish the verifying step, I saw that line on the site "gpg: Signature made Tue 24 Jan 2015 09:29:09 AM CET using RSA key ID D40814E0" does not match with my line.

my line has wrong date and rsa key id. it's strange that id is match with the last 8 numbers of the last subkey fingerprints that on the site. it is "c3c07136"

does something wrong with signature or i can use this package? enter image description here


The Tor Browser developers use the key 0x4E2C6E8793298290 for signing the releases:

pub   rsa4096/0x4E2C6E8793298290 2014-12-15 [C] [expires: 2020-08-24]
      Key fingerprint = EF6E 286D DA85 EA2A 4BA7  DE68 4E2C 6E87 9329 8290
uid                   Tor Browser Developers (signing key) <torbrowser@torproject.org>
sub   rsa4096/0x7017ADCEF65C2036 2014-12-15 [S] [expires: 2017-08-25]
      Key fingerprint = 5242 013F 02AF C851 B1C7  36B8 7017 ADCE F65C 2036
sub   rsa4096/0x2E1AC68ED40814E0 2014-12-15 [S] [expires: 2017-08-25]
      Key fingerprint = BA1E E421 BBB4 5263 180E  1FC7 2E1A C68E D408 14E0
sub   rsa4096/0xD1483FA6C3C07136 2016-08-24 [S] [expires: 2018-08-24]
      Key fingerprint = A430 0A6B C93C 0877 A445  1486 D148 3FA6 C3C0 7136

This key has lots of subkeys and several are near the expiry date (expires:). So the devs have chosen to create a new subkey with the id 0xD1483FA6C3C07136 or short 0xC3C07136. So the website lists the main key and you saw the subkey. So everything looks fine from this site.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.