0

Just installed the latest torbrowser and noticed the timestamps are kinda off. Is this unusual or something to be concerned about?

> ls -laFthr ./Browser/TorBrowser/Tor/tor
-rwx------ 1 user user 2.8M Dec 31  1999 ./Browser/TorBrowser/Tor/tor*


> sha1sum ./Browser/TorBrowser/Tor/tor
6217d3681df845402e83179f0b0c5c2cc6ee073b  ./Browser/TorBrowser/Tor/tor

Dec 31 1999? The tar package shows a Good Signature:

> gpg2 --verify tor-browser-linux64-7.0.10_en-US.tar.xz.asc 
gpg: assuming signed data in 'tor-browser-linux64-7.0.10_en-US.tar.xz'
gpg: Signature made Thu 09 Nov 2017 11:57:11 AM EST using RSA key ID C3C07136
gpg: Good signature from "Tor Browser Developers (signing key) <torbrowser@torproject.org>" [unknown]
gpg: WARNING: This key is not certified with a trusted signature!
gpg:          There is no indication that the signature belongs to the owner.
Primary key fingerprint: EF6E 286D DA85 EA2A 4BA7  DE68 4E2C 6E87 9329 8290
     Subkey fingerprint: A430 0A6B C93C 0877 A445  1486 D148 3FA6 C3C0 7136

The "Last Updated" dates of Extensions are off too:

httpseverywhere What should I do?

0

Yes, this is part of the reproducible build process. Since binary creation time and other date-related build artifacts would differ between people attempting to build Tor Browser, date information is standardised (or stripped) to be uniform, so that no matter when it is built the files will look the same.

You might be interested in reading the blog posts from the Tor Project:

Deterministic Builds Part One: Cyberwar and Global Compromise and Deterministic Builds Part Two: Technical Details.

The long and short of it is that reproducible builds ensure that given source code and a pre-determined build environment, anyone who builds the software following the build proceedure will get exactly the same output as everyone else. This allows third parties to check that the file that the Tor Project (or whoever else wants to use reproducible builds) is distributing is exactly what is in the source code, and nothing more, e.g. that they haven't tampered with the binaries or added extra code into the version that they are distributing.

Others following similar proceedures include Bitcoin, Debian, Tails and many others.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.