I can't import the Tor gpg debian repository keys

Question

I am on raspbian on a raspberry Pi model 2. I can't import the keys for the Tor repository. I tried the two following commands:

$ gpg2 --recv A3C4F0F979CAA22CDBA8F512EE8CBC9E886DDD89
gpg: keyserver receive failed: No data

And:

$ gpg --keyserver hkp://pool.sks-keyservers.net --recv A3C4F0F979CAA22CDBA8F512EE8CBC9E886DDD89
gpg: packet(13) too large
gpg: read_block: read error: Invalid packet
gpg: no valid OpenPGP data found.
gpg: Total number processed: 0

I followed these instructions: https://www.torproject.org/docs/debian.html.en

I have no idea what is going on here. Any clue ?

Answer 1

Grab the latest build of Tor project from their download page for linux. I just did it and was 8.5.1.

Make sure you are in the same directory you downloaded the Tor project in to. In my case I downloaded it to ~/Downloads

cd ~/Downloads

Add the keyserver

gpg --keyserver pool.sks-keyservers.net --recv-keys 0x4E2C6E8793298290

Add the fingerprint

gpg --fingerprint 0x4E2C6E8793298290

Download the .asc key from the small link directly under the Tor bundle download button labeled as [sig] for signature. When you click on the [sig] button it opens up the key signature URL, For future reference one can just swap out that link for the one we will wget below. The file name should be the exact same name as the Tor version you downloaded but with an added .asc extension.

wget https://dist.torproject.org/torbrowser/8.5.1/tor-browser-linux64-8.5.1_en-US.tar.xz.asc

Then you can check the file against the .asc file

gpg --verify tor-browser-linux64-8.5.1_en-US.tar.xz{.asc,}

These steps were taken directly from the How can I verify Tor Browser signature. Follow the link below if you would like to see sample output from the commands and further description. I added the above wget command to easily grab the signature and name it accordingly.

https://support.torproject.org/tbb/how-to-verify-signature/

Also as a side note, I have noticed that adding a key from the keyserver might fail if you are using a vpn. I had to disable mine.

Answer 2

I haven't had much luck with getting this key using gpg2. Try:

# wget https://deb.torproject.org/torproject.org/A3C4F0F979CAA22CDBA8F512EE8CBC9E886DDD89.asc
# apt-key add <A3C4F0F979CAA22CDBA8F512EE8CBC9E886DDD89.asc