0

I'm attempting to install Tor, but I can't get the signing key to verify the download.

$ gpg --auto-key-locate nodefault,wkd --locate-keys torbrowser@torproject.org
gpg: invalid auto-key-locate list
gpg: Invalid option "--locate-keys"

Ubuntu 16.04 LTS Any help would be greatly appreciated.

Thanks

0

There are two versions of the gpg command available in Ubuntu 16.04, in separate packages:

  • gnupg, which is GnuPG version 1.4.20; and
  • gnupg2, which is GnuPG version 2.1.11.

The --locate-keys option was added in 2.0.10, as was the nodefault value for --auto-key-locate. Given that you're unable to use the --locate-keys option, I strongly suspect that the version of GnuPG you're running is version 1.4.20.

To run the newer version of GnuPG on an Ubuntu 16.04 system, you need to install the gnupg2 package, and use the gpg2 command rather than gpg.

However, WKD support was added in GnuPG 2.1.12, which means that even using gpg2 you won't be able to run the command given on the Tor project webpage. However...

The WKD protocol is a public one, and via the magic of tutorials like this one I've figured out that the key you need can be downloaded via HTTPS. Thus, the complete command you can use (which should, I think, work even in GnuPG 1.4.20) looks like this:

wget -O - https://openpgpkey.torproject.org/.well-known/openpgpkey/hu/kounek7zrdx745qydx6p59t9mqjpuhdf | gpg --import
  • Both gnupg & gnupg2 were installed, showing the versions you listed. I removed gnupg and the original command now gives a message saying I need to install gnupg. The dpkg command shows un gnupg <none> <none> (no description available) ii gnupg-agent 2.1.11-6ubun amd64 GNU privacy guard - cryptographic un gnupg-doc <none> <none> (no description available) ii gnupg2 2.1.11-6ubun amd64 GNU privacy guard - a free PGP re – Justin Oct 2 at 1:03
  • What "original command" are you referring to? – womble Oct 2 at 2:14
  • I was referring to $ gpg --auto-key-locate nodefault,wkd --locate-keys torbrowser@torproject.org. – Justin Oct 3 at 1:50
  • You ran gpg and it told you to install gnupg? I have never seen anything even vaguely like that. Unless, perhaps, it's Ubuntu's "command not found" handler getting in the way; try running hash -r, or starting a new shell. That might fix it. The exact error message, rather than an interpretation of it, may otherwise be helpful. – womble Oct 3 at 2:48
  • Here's the command and response: $ gpg --auto-key-locate nodefault,wkd --locate-keys torbrowser@torproject.org The program 'gpg' is currently not installed. You can install it by typing: sudo apt install gnupg I ran a hash -r. It completed without printing anything to the console. – Justin Oct 4 at 1:33

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.