January 2015 - tor-commits - lists.torproject.org

[webwml/staging] Provide link for TB modification documents
by sebastian＠torproject.org 20 Jan '15

20 Jan '15

commit c88b90f2efbde47bd49702b00e8f0de37cc4fbea Author: Sebastian Hahn <sebastian(a)torproject.org> Date: Tue Jan 20 13:37:13 2015 +0100 Provide link for TB modification documents --- projects/en/torbrowser.wml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/projects/en/torbrowser.wml b/projects/en/torbrowser.wml index 3a1fc50..b6dd29a 100644 --- a/projects/en/torbrowser.wml +++ b/projects/en/torbrowser.wml @@ -289,7 +289,7 @@ <p>See our instructions on <a href="<page docs/verifying-signatures>">how to verify package signatures</a>, which allows you to make sure you've downloaded the file we intended you to get. Also, note that the Firefox ESR in our bundles is - modified from the <a + <a href="https://gitweb.torproject.org/tor-browser.git">modified</a> from the <a href="https://www.mozilla.org/en-US/firefox/organizations/">default Firefox ESR</a></p>

1 0

[webwml/master] Bug 14304: Document stripping of MAR files
by sebastian＠torproject.org 20 Jan '15

20 Jan '15

commit 82fcda5832cbc098be5fe7b5ac55fb7cf68242ba Author: Georg Koppen <gk(a)torproject.org> Date: Tue Jan 20 13:00:36 2015 +0000 Bug 14304: Document stripping of MAR files We add a section explaining how to verify that the signed MAR files we ship are essentially the ones our Gitian setup produced. --- docs/en/verifying-signatures.wml | 58 ++++++++++++++++++++++++++------------ 1 file changed, 40 insertions(+), 18 deletions(-) diff --git a/docs/en/verifying-signatures.wml b/docs/en/verifying-signatures.wml index b9eeb03..84cda7e 100644 --- a/docs/en/verifying-signatures.wml +++ b/docs/en/verifying-signatures.wml @@ -186,8 +186,8 @@ <h3><a class="anchor" href="#BuildVerification"> Verifying sha256sums (advanced)</a></h3> <hr> - <p>Build reproducibility is a <a - href="https://blog.torproject.org/blog/deterministic-builds-part-one-cyberwar-and…">security + <p>Build reproducibility is a <a + href="https://blog.torproject.org/blog/deterministic-builds-part-one-cyberwar-and…">security property</a> of Tor Browser 3.0 and later. Anyone can build Tor Browser on their own machine and produce a binary that is bit-for-bit identical to the binary we offer on the download page. @@ -201,22 +201,22 @@ <ul> <li>Download the Tor Browser package, the sha256sums.txt file, and the - sha256sums signature files. They can all be found in the same directory + sha256sums signature files. They can all be found in the same directory under <a href="https://www.torproject.org/dist/torbrowser/"> - https://www.torproject.org/dist/torbrowser/</a>, for example in '3.6.1' + https://www.torproject.org/dist/torbrowser/</a>, for example in '3.6.1' for TBB 3.6.1.</li> - <li>Retrieve the signers' GPG keys. This can be done from the command - line by entering something like + <li>Retrieve the signers' GPG keys. This can be done from the command + line by entering something like <pre>gpg --keyserver keys.mozilla.org --recv-keys 0x29846B3C683686CC</pre> - (This will bring you developer Mike Perry's public key. Other + (This will bring you developer Mike Perry's public key. Other developers' key IDs can be found on - <a href="<page docs/signing-keys>">this + <a href="<page docs/signing-keys>">this page</a>.)</li> <li>Verify the sha256sums.txt file by executing this command: <pre>gpg --verify <NAME OF THE SIGNATURE FILE>.asc sha256sums.txt</pre></li> - <li>You should see a message like "Good signature from <DEVELOPER + <li>You should see a message like "Good signature from <DEVELOPER NAME>". If you don't, there is a problem. Try these steps again.</li> - <li>Now you can take the sha256sum of the Tor Browser package. On + <li>Now you can take the sha256sum of the Tor Browser package. On Windows you can use the <a href="http://md5deep.sourceforge.net/"> hashdeep utility</a> and run <pre>C:\location\where\you\saved\hashdeep -c sha256sum <TOR BROWSER FILE NAME>.exe</pre> @@ -225,17 +225,39 @@ <li>Open sha256sums.txt in a text editor.</li> <li>Locate the name of the Tor Browser file you downloaded.</li> <li>Compare the string of letters and numbers to the left of your - filename with the string of letters and numbers that appeared - on your command line. If they match, you've successfully verified the - build.</li> + filename with the string of letters and numbers that appeared + on your command line. If they match, you've successfully verified the + build.</li> </ul> - - <p><a href="https://github.com/isislovecruft/scripts/blob/master/verify-gitian-builder-…">Scripts</a> - to <a href="http://tor.stackexchange.com/questions/648/how-to-verify-tor-browser-bundle…">automate</a> - these steps have been written, but to use them you will need to modify + + <p><a href="https://github.com/isislovecruft/scripts/blob/master/verify-gitian-builder-…">Scripts</a> + to <a href="http://tor.stackexchange.com/questions/648/how-to-verify-tor-browser-bundle…">automate</a> + these steps have been written, but to use them you will need to modify them yourself with the latest Tor Browser filename.</p> - + + <hr> + + <a id="MARVerification"></a> + <h3><a class="anchor" href="#MARVerification"> + Verifying MAR files we ship (advanced)</a></h3> <hr> + <p>Starting with Tor Browser 4.5a4 we sign our MAR files which helps + securing our update process. The downside of this is the need for additional + instructions to verify that the MAR files we ship are indeed the ones we + produced with our Gitian setup.</p> + + <p>Assuming the verification happens on a Linux computer one first needs the + <tt>mar-tools-linux*.zip</tt> out of the <tt>gitian-builder/inputs</tt> + directory to remove the embedded signature(s). The steps to get the unsigned + MAR file on a 64 bit Linux are</p> + <pre> + cd /path/to/MAR/file + unzip /path/to/gitian-builder/inputs/mar-tools-linux64.zip + mar-tools/signmar -r your-signed-mar-file.mar your-unsigned-mar-file.mar</pre> + <p>Now you can compare the SHA256 sum of <tt>your-unsigned-mar-file.mar</tt> + with the one provided in the <tt>sha265sums.txt</tt> or + <tt>sha256sums.incremental.txt</tt> as outlined in <a href="#BuildVerification">Verifying + sha256sums (advancded)</a> above.</p> </div>

1 0

[webwml/master] Update win32 expert bundle stable tag
by sebastian＠torproject.org 20 Jan '15

20 Jan '15

commit 6186ce3d83b3b8861918a091bd91f9b28efd05f0 Author: Sebastian Hahn <sebastian(a)torproject.org> Date: Tue Jan 20 13:24:46 2015 +0100 Update win32 expert bundle stable tag --- include/versions.wmi | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/include/versions.wmi b/include/versions.wmi index 24bc0be..6dcedb6 100644 --- a/include/versions.wmi +++ b/include/versions.wmi @@ -1,8 +1,8 @@ <define-tag version-stable whitespace=delete>0.2.5.10</define-tag> <define-tag version-alpha whitespace=delete>0.2.6.2-alpha</define-tag> -<define-tag version-win32-stable whitespace=delete>0.2.4.23</define-tag> -<define-tag version-win32-alpha whitespace=delete>0.2.4.23</define-tag> +<define-tag version-win32-stable whitespace=delete>0.2.5.10</define-tag> +<define-tag version-win32-alpha whitespace=delete>0.2.5.10</define-tag> <define-tag version-win32-bundle-stable whitespace=delete>0.2.4.23</define-tag> <define-tag version-win32-bundle-alpha whitespace=delete>0.2.4.23</define-tag>

1 0

[webwml/master] Update Torbrowser changelog link
by sebastian＠torproject.org 20 Jan '15

20 Jan '15

commit 95f6cfec4d7fa1676a555fb79e7a8b01edbc87c8 Author: Sebastian Hahn <sebastian(a)torproject.org> Date: Tue Jan 20 13:28:56 2015 +0100 Update Torbrowser changelog link --- projects/en/torbrowser.wml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/projects/en/torbrowser.wml b/projects/en/torbrowser.wml index 4055009..3a1fc50 100644 --- a/projects/en/torbrowser.wml +++ b/projects/en/torbrowser.wml @@ -604,8 +604,8 @@ <a href="https://www.torproject.org/projects/torbrowser/design/">design document</a>, the <a - href="https://gitweb.torproject.org/builders/tor-browser-bundle.git/blob/refs/hea…">ChangeLog - for the 3.6 branch</a>, and the <a + href="https://gitweb.torproject.org/builders/tor-browser-bundle.git/tree/Bundle-D…">ChangeLog + for the 4.0 branch</a>, and the <a href="https://gitweb.torproject.org/builders/tor-browser-bundle.git/tree/Bundle-D…">ChangeLog for the alpha branch</a>. </p>

1 0

[webwml/staging] Update Torbrowser changelog link
by sebastian＠torproject.org 20 Jan '15

20 Jan '15

commit 95f6cfec4d7fa1676a555fb79e7a8b01edbc87c8 Author: Sebastian Hahn <sebastian(a)torproject.org> Date: Tue Jan 20 13:28:56 2015 +0100 Update Torbrowser changelog link --- projects/en/torbrowser.wml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/projects/en/torbrowser.wml b/projects/en/torbrowser.wml index 4055009..3a1fc50 100644 --- a/projects/en/torbrowser.wml +++ b/projects/en/torbrowser.wml @@ -604,8 +604,8 @@ <a href="https://www.torproject.org/projects/torbrowser/design/">design document</a>, the <a - href="https://gitweb.torproject.org/builders/tor-browser-bundle.git/blob/refs/hea…">ChangeLog - for the 3.6 branch</a>, and the <a + href="https://gitweb.torproject.org/builders/tor-browser-bundle.git/tree/Bundle-D…">ChangeLog + for the 4.0 branch</a>, and the <a href="https://gitweb.torproject.org/builders/tor-browser-bundle.git/tree/Bundle-D…">ChangeLog for the alpha branch</a>. </p>

1 0

[webwml/staging] Update win32 expert bundle stable tag
by sebastian＠torproject.org 20 Jan '15

20 Jan '15

commit 6186ce3d83b3b8861918a091bd91f9b28efd05f0 Author: Sebastian Hahn <sebastian(a)torproject.org> Date: Tue Jan 20 13:24:46 2015 +0100 Update win32 expert bundle stable tag --- include/versions.wmi | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/include/versions.wmi b/include/versions.wmi index 24bc0be..6dcedb6 100644 --- a/include/versions.wmi +++ b/include/versions.wmi @@ -1,8 +1,8 @@ <define-tag version-stable whitespace=delete>0.2.5.10</define-tag> <define-tag version-alpha whitespace=delete>0.2.6.2-alpha</define-tag> -<define-tag version-win32-stable whitespace=delete>0.2.4.23</define-tag> -<define-tag version-win32-alpha whitespace=delete>0.2.4.23</define-tag> +<define-tag version-win32-stable whitespace=delete>0.2.5.10</define-tag> +<define-tag version-win32-alpha whitespace=delete>0.2.5.10</define-tag> <define-tag version-win32-bundle-stable whitespace=delete>0.2.4.23</define-tag> <define-tag version-win32-bundle-alpha whitespace=delete>0.2.4.23</define-tag>

1 0

[webwml/staging] Add new TBB version
by sebastian＠torproject.org 20 Jan '15

20 Jan '15

commit 07f661bf111532c8ee921133f4183e475dc6145a Author: Georg Koppen <gk(a)torproject.org> Date: Mon Jan 19 09:55:51 2015 +0000 Add new TBB version --- include/versions.wmi | 10 +++++----- projects/torbrowser/RecommendedTBBVersions | 4 ++++ 2 files changed, 9 insertions(+), 5 deletions(-) diff --git a/include/versions.wmi b/include/versions.wmi index 0075fef..24bc0be 100644 --- a/include/versions.wmi +++ b/include/versions.wmi @@ -24,10 +24,10 @@ <define-tag version-osx-ppc-alpha whitespace=delete>0.2.4.17-rc</define-tag> <define-tag version-torbrowserbundledir whitespace=delete>4.0.3</define-tag> -<define-tag version-torbrowserbundlebetadir whitespace=delete>4.5-alpha-2</define-tag> +<define-tag version-torbrowserbundlebetadir whitespace=delete>4.5a3</define-tag> <define-tag version-torbrowserbundle whitespace=delete>4.0.3</define-tag> -<define-tag version-torbrowserbundlebeta whitespace=delete>4.5-alpha-2</define-tag> +<define-tag version-torbrowserbundlebeta whitespace=delete>4.5a3</define-tag> <define-tag version-torbrowser-tor whitespace=delete>0.2.4.19</define-tag> <define-tag version-torbrowser-tor-components whitespace=delete>libevent-2.0.21-stable, zlib-1.2.8, openssl-1.0.1e</define-tag> <define-tag version-torbrowser-firefox whitespace=delete>24.2.0esr</define-tag> @@ -39,8 +39,8 @@ <define-tag version-torbrowserbundlelinux32 whitespace=delete>4.0.3</define-tag> <define-tag version-torbrowserbundlelinux64 whitespace=delete>4.0.3</define-tag> -<define-tag version-torbrowserbundlelinux32beta whitespace=delete>4.5-alpha-2</define-tag> -<define-tag version-torbrowserbundlelinux64beta whitespace=delete>4.5-alpha-2</define-tag> +<define-tag version-torbrowserbundlelinux32beta whitespace=delete>4.5a3</define-tag> +<define-tag version-torbrowserbundlelinux64beta whitespace=delete>4.5a3</define-tag> <define-tag version-gnu-torbrowser-tor whitespace=delete>0.2.4.19</define-tag> <define-tag version-gnu-torbrowser-tor-components whitespace=delete>libevent-2.0.21-stable, zlib-1.2.8, openssl-1.0.0k</define-tag> <define-tag version-gnu-torbrowser-firefox whitespace=delete>24.2.0esr</define-tag> @@ -49,7 +49,7 @@ <define-tag version-torbrowserbundleosx32 whitespace=delete>4.0.3</define-tag> <define-tag version-torbrowserbundleosx64 whitespace=delete>2.3.25-15</define-tag> -<define-tag version-torbrowserbundleosx64beta whitespace=delete>4.5-alpha-2</define-tag> +<define-tag version-torbrowserbundleosx64beta whitespace=delete>4.5a3</define-tag> <define-tag version-osx-torbrowser-tor whitespace=delete>0.2.4.19</define-tag> <define-tag version-osx-torbrowser-firefox whitespace=delete>24.2.0esr</define-tag> <define-tag version-osx-torbrowser-torbutton whitespace=delete>1.5.2</define-tag> diff --git a/projects/torbrowser/RecommendedTBBVersions b/projects/torbrowser/RecommendedTBBVersions index 4785612..7cb0ac0 100644 --- a/projects/torbrowser/RecommendedTBBVersions +++ b/projects/torbrowser/RecommendedTBBVersions @@ -7,4 +7,8 @@ "4.5-alpha-2-Linux", "4.5-alpha-2-MacOS", "4.5-alpha-2-Windows" +"4.5a3", +"4.5a3-Linux", +"4.5a3-MacOS", +"4.5a3-Windows" ]

1 0

[webwml/staging] Deprecate old TBB version
by sebastian＠torproject.org 20 Jan '15

20 Jan '15

commit f464a370f4fa70837f6db8d89013562791ff4d6d Author: Georg Koppen <gk(a)torproject.org> Date: Mon Jan 19 12:30:50 2015 +0000 Deprecate old TBB version --- projects/torbrowser/RecommendedTBBVersions | 4 ---- 1 file changed, 4 deletions(-) diff --git a/projects/torbrowser/RecommendedTBBVersions b/projects/torbrowser/RecommendedTBBVersions index 7cb0ac0..4a5eb92 100644 --- a/projects/torbrowser/RecommendedTBBVersions +++ b/projects/torbrowser/RecommendedTBBVersions @@ -3,10 +3,6 @@ "4.0.3-Linux", "4.0.3-MacOS", "4.0.3-Windows", -"4.5-alpha-2", -"4.5-alpha-2-Linux", -"4.5-alpha-2-MacOS", -"4.5-alpha-2-Windows" "4.5a3", "4.5a3-Linux", "4.5a3-MacOS",

1 0

[webwml/staging] Add recent articles and PR to press page
by sebastian＠torproject.org 20 Jan '15

20 Jan '15

commit 0a5f322605a040b3b195a8dd0677c0e3c816c262 Author: Matthew Finkel <Matthew.Finkel(a)gmail.com> Date: Tue Jan 20 01:46:01 2015 +0000 Add recent articles and PR to press page --- press/en/press.wml | 75 +++++++++++++++++++++++++++++++++++++++++++++++++++- 1 file changed, 74 insertions(+), 1 deletion(-) diff --git a/press/en/press.wml b/press/en/press.wml index 756ae5a..0774f61 100644 --- a/press/en/press.wml +++ b/press/en/press.wml @@ -33,6 +33,77 @@ newest to oldest: </p> </tr> </thead> <tr style="background-color: #e5e5e5;"> +<td>2015 Jan 7</td> +<td>Inside BitCoins</td> +<td><a +href="http://insidebitcoins.com/news/developers-say-privacy-network-tor-was-not-c…">Developers +Say Privacy Network Tor Was Not Compromised During Silk Road Takedown</a></td> +</tr> +<tr style=""> +<td>2014 Dec 30</td> +<td>31C3</td> +<td><a +href="http://media.ccc.de/browse/congress/2014/31c3_-_6251_-_en_-_saal_1_-_201412…">“State +of the Onion"</a> video on the state of the Tor Project with Roger +Dingledine, Jacob Appelbaum, Arturo Filastò, and Laura Poitras.</td> +</tr> +<tr style="background-color: #e5e5e5;"> +<td>2014 Dec 26</td> +<td>Engadget</td> +<td><a +href="http://www.engadget.com/2014/12/26/lizard-squad-hackers-attack-tor/">Band +of hackers manages to take down Sony--but not Tor</a></td> +</tr> +<tr style=""> +<td>2014 Dec 19</td> +<td>The Guardian</td> +<td><a +href="http://www.theguardian.com/technology/2014/dec/05/how-faceboook-tor-service…">How +Facebook's Tor service could encourage a more open web</a></td> +</tr> +<tr style="background-color: #e5e5e5;"> +<td>2014 Dec 17</td> +<td>Gizmodo</td> +<td><a +href="http://gizmodo.com/tor-is-still-safe-1669011966">Tor is Still Safe +</a></td> +</tr> +<tr style=""> +<td>2014 Dec 12</td> +<td>The Independent</td> +<td><a +href="http://www.independent.co.uk/voices/comment/the-dark-web-is-not-just-for-pa…">OpEd +</a>on hidden services and censorship</td> +</tr> +<tr style="background-color: #e5e5e5;"> +<td>2014 Dec 11</td> +<td>DCInno</td> +<td><a +href="http://dcinno.streetwise.co/2014/11/11/mozilla-firefox-anonymous-internet-t…">Firefox +is Building an Anonymous Internet Browser With Tor</a> via @DC_Inno</td> +</tr> +<tr style=""> +<td>2014 Nov 10</td> +<td>Gizmodo</td> +<td><a +href="http://gizmodo.com/mozilla-is-helping-tor-get-bigger-and-better-1656860653">Mozilla +get bigger and better</a></td> +</tr> +<tr style="background-color: #e5e5e5;"> +<td>2014 Nov 20</td> +<td>Wired.co.UK</td> +<td><a +href="http://www.wired.co.uk/news/archive/2014-11/20/tor-still-secure">Don't +panic, Tor is still safe and Here’s Why</a></td> +</tr> +<tr style=""> +<td>2014 Oct 31</td> +<td>The Next Web</td> +<td><a +href="http://thenextweb.com/facebook/2014/10/31/facebook-now-available-tor-networ…">Facebook +is now available on Tor for more secure browsing</a></td> +</tr> +<tr style="background-color: #e5e5e5;"> <td>2014 Jul 8</td> <td>Cambridge Community Television</td> <td><a href="http://www.cctvcambridge.org/NSATor">NSA Surveillance Targets Cambridge - based TOR Project</a></td> @@ -2047,7 +2118,9 @@ Traffic</a></td> <tr style="background-color: #e5e5e5;"> <td>2004 Aug 30</td> <td>Newsweek</td> -<td>Technology: Instant Security (no link)</td> +<td><a +href="http://www.newsweek.com/technology-instant-security-126733">Technology: +Instant Security</a></td> </tr> <tr>

1 0

[webwml/staging] Bug 14304: Document stripping of MAR files
by sebastian＠torproject.org 20 Jan '15

20 Jan '15

commit 82fcda5832cbc098be5fe7b5ac55fb7cf68242ba Author: Georg Koppen <gk(a)torproject.org> Date: Tue Jan 20 13:00:36 2015 +0000 Bug 14304: Document stripping of MAR files We add a section explaining how to verify that the signed MAR files we ship are essentially the ones our Gitian setup produced. --- docs/en/verifying-signatures.wml | 58 ++++++++++++++++++++++++++------------ 1 file changed, 40 insertions(+), 18 deletions(-) diff --git a/docs/en/verifying-signatures.wml b/docs/en/verifying-signatures.wml index b9eeb03..84cda7e 100644 --- a/docs/en/verifying-signatures.wml +++ b/docs/en/verifying-signatures.wml @@ -186,8 +186,8 @@ <h3><a class="anchor" href="#BuildVerification"> Verifying sha256sums (advanced)</a></h3> <hr> - <p>Build reproducibility is a <a - href="https://blog.torproject.org/blog/deterministic-builds-part-one-cyberwar-and…">security + <p>Build reproducibility is a <a + href="https://blog.torproject.org/blog/deterministic-builds-part-one-cyberwar-and…">security property</a> of Tor Browser 3.0 and later. Anyone can build Tor Browser on their own machine and produce a binary that is bit-for-bit identical to the binary we offer on the download page. @@ -201,22 +201,22 @@ <ul> <li>Download the Tor Browser package, the sha256sums.txt file, and the - sha256sums signature files. They can all be found in the same directory + sha256sums signature files. They can all be found in the same directory under <a href="https://www.torproject.org/dist/torbrowser/"> - https://www.torproject.org/dist/torbrowser/</a>, for example in '3.6.1' + https://www.torproject.org/dist/torbrowser/</a>, for example in '3.6.1' for TBB 3.6.1.</li> - <li>Retrieve the signers' GPG keys. This can be done from the command - line by entering something like + <li>Retrieve the signers' GPG keys. This can be done from the command + line by entering something like <pre>gpg --keyserver keys.mozilla.org --recv-keys 0x29846B3C683686CC</pre> - (This will bring you developer Mike Perry's public key. Other + (This will bring you developer Mike Perry's public key. Other developers' key IDs can be found on - <a href="<page docs/signing-keys>">this + <a href="<page docs/signing-keys>">this page</a>.)</li> <li>Verify the sha256sums.txt file by executing this command: <pre>gpg --verify <NAME OF THE SIGNATURE FILE>.asc sha256sums.txt</pre></li> - <li>You should see a message like "Good signature from <DEVELOPER + <li>You should see a message like "Good signature from <DEVELOPER NAME>". If you don't, there is a problem. Try these steps again.</li> - <li>Now you can take the sha256sum of the Tor Browser package. On + <li>Now you can take the sha256sum of the Tor Browser package. On Windows you can use the <a href="http://md5deep.sourceforge.net/"> hashdeep utility</a> and run <pre>C:\location\where\you\saved\hashdeep -c sha256sum <TOR BROWSER FILE NAME>.exe</pre> @@ -225,17 +225,39 @@ <li>Open sha256sums.txt in a text editor.</li> <li>Locate the name of the Tor Browser file you downloaded.</li> <li>Compare the string of letters and numbers to the left of your - filename with the string of letters and numbers that appeared - on your command line. If they match, you've successfully verified the - build.</li> + filename with the string of letters and numbers that appeared + on your command line. If they match, you've successfully verified the + build.</li> </ul> - - <p><a href="https://github.com/isislovecruft/scripts/blob/master/verify-gitian-builder-…">Scripts</a> - to <a href="http://tor.stackexchange.com/questions/648/how-to-verify-tor-browser-bundle…">automate</a> - these steps have been written, but to use them you will need to modify + + <p><a href="https://github.com/isislovecruft/scripts/blob/master/verify-gitian-builder-…">Scripts</a> + to <a href="http://tor.stackexchange.com/questions/648/how-to-verify-tor-browser-bundle…">automate</a> + these steps have been written, but to use them you will need to modify them yourself with the latest Tor Browser filename.</p> - + + <hr> + + <a id="MARVerification"></a> + <h3><a class="anchor" href="#MARVerification"> + Verifying MAR files we ship (advanced)</a></h3> <hr> + <p>Starting with Tor Browser 4.5a4 we sign our MAR files which helps + securing our update process. The downside of this is the need for additional + instructions to verify that the MAR files we ship are indeed the ones we + produced with our Gitian setup.</p> + + <p>Assuming the verification happens on a Linux computer one first needs the + <tt>mar-tools-linux*.zip</tt> out of the <tt>gitian-builder/inputs</tt> + directory to remove the embedded signature(s). The steps to get the unsigned + MAR file on a 64 bit Linux are</p> + <pre> + cd /path/to/MAR/file + unzip /path/to/gitian-builder/inputs/mar-tools-linux64.zip + mar-tools/signmar -r your-signed-mar-file.mar your-unsigned-mar-file.mar</pre> + <p>Now you can compare the SHA256 sum of <tt>your-unsigned-mar-file.mar</tt> + with the one provided in the <tt>sha265sums.txt</tt> or + <tt>sha256sums.incremental.txt</tt> as outlined in <a href="#BuildVerification">Verifying + sha256sums (advancded)</a> above.</p> </div>

1 0