3

I'm attempting to install Tor, but I can't get the signing key to verify the download.

$ gpg --auto-key-locate nodefault,wkd --locate-keys torbrowser@torproject.org
gpg: invalid auto-key-locate list
gpg: Invalid option "--locate-keys"

Ubuntu 16.04 LTS Any help would be greatly appreciated.

Thanks

Improve this question

1 Answer 1

Reset to default
3

There are two versions of the gpg command available in Ubuntu 16.04, in separate packages:

  • gnupg, which is GnuPG version 1.4.20; and
  • gnupg2, which is GnuPG version 2.1.11.

The --locate-keys option was added in 2.0.10, as was the nodefault value for --auto-key-locate. Given that you're unable to use the --locate-keys option, I strongly suspect that the version of GnuPG you're running is version 1.4.20.

To run the newer version of GnuPG on an Ubuntu 16.04 system, you need to install the gnupg2 package, and use the gpg2 command rather than gpg.

However, WKD support was added in GnuPG 2.1.12, which means that even using gpg2 you won't be able to run the command given on the Tor project webpage. However...

The WKD protocol is a public one, and via the magic of tutorials like this one I've figured out that the key you need can be downloaded via HTTPS. Thus, the complete command you can use (which should, I think, work even in GnuPG 1.4.20) looks like this:

wget -O - https://openpgpkey.torproject.org/.well-known/openpgpkey/hu/kounek7zrdx745qydx6p59t9mqjpuhdf | gpg --import
Improve this answer
13
  • Both gnupg & gnupg2 were installed, showing the versions you listed. I removed gnupg and the original command now gives a message saying I need to install gnupg. The dpkg command shows un gnupg <none> <none> (no description available) ii gnupg-agent 2.1.11-6ubun amd64 GNU privacy guard - cryptographic un gnupg-doc <none> <none> (no description available) ii gnupg2 2.1.11-6ubun amd64 GNU privacy guard - a free PGP re
    – Justin
    Oct 2, 2019 at 1:03
  • What "original command" are you referring to?
    – womble
    Oct 2, 2019 at 2:14
  • I was referring to $ gpg --auto-key-locate nodefault,wkd --locate-keys torbrowser@torproject.org.
    – Justin
    Oct 3, 2019 at 1:50
  • You ran gpg and it told you to install gnupg? I have never seen anything even vaguely like that. Unless, perhaps, it's Ubuntu's "command not found" handler getting in the way; try running hash -r, or starting a new shell. That might fix it. The exact error message, rather than an interpretation of it, may otherwise be helpful.
    – womble
    Oct 3, 2019 at 2:48
  • 1
    @womble Can you please contact the person in charge of the How can I verify Tor Browser's signature? | Tor Project | Support and tell him/her to precise in their doc that gnupg2 version >= 2.1.12 is needed ?
    – SebMa
    May 27, 2020 at 11:43

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .