Getting bad signature for tor-browser-linux64-4.0.4_en-US.tar.xz [duplicate]

Question

Hi I am getting a bad signature for the tor browser for 64 bit GNU/Linux. I have followed the instructions from the website completely which are :

The next step is to use GnuPG to import the key that signed your package. The Tor Browser team signs the Tor Browsers. Import its key (0x4E2C6E8793298290) by starting the terminal (under "Applications" in Mac OS X) and typing:

gpg --keyserver x-hkp://pool.sks-keyservers.net --recv-keys 0x4E2C6E8793298290

After importing the key, you can verify that the fingerprint is correct:

gpg --fingerprint 0x4E2C6E8793298290

You should see:

pub   4096R/93298290 2014-12-15
      Key fingerprint = EF6E 286D DA85 EA2A 4BA7  DE68 4E2C 6E87 9329 8290
uid                  Tor Browser Developers (signing key) 
sub   4096R/F65C2036 2014-12-15
sub   4096R/D40814E0 2014-12-15
sub   4096R/589839A3 2014-12-15

To verify the signature of the package you downloaded, you will need to download the ".asc" file as well. Assuming you downloaded the package and its signature to your Desktop, run -

gpg --verify ~/Desktop/tor-browser-linux64-4.0.4_en-US.tar.xz{.asc*,}

But then when I run the above command line , I am getting this response:

gpg: Signature made Tue 24 Feb 2015 11:55:16 PM PST using RSA key ID F65C2036

gpg: BAD signature from "Tor Browser Developers (signing key) "

Can anyone help me with this problem? Thanks.

Answer 1

Yeah this is just for anyone who gets this problem, just uninstall the tor package and .asc file and re-download both of them again.

Answer 2

Uninstalling the package shouldn't be required, but a transmission error is likely. If a signature verification error persists, one should try to contact the developers to ensure it is properly investigated.