October 2018 - tor-commits - lists.torproject.org

[webwml/staging] press: add news (#27619)
by hiro＠torproject.org 22 Oct '18

22 Oct '18

commit 45d68837cab843dad265b502c8e0bcb1b8f5046e Author: traumschule <traumschuleriebau(a)riseup.net> Date: Tue Sep 11 13:10:47 2018 +0200 press: add news (#27619) --- press/en/press.wml | 72 ++++++++++++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 72 insertions(+) diff --git a/press/en/press.wml b/press/en/press.wml index 4ff6779e..f841fc90 100644 --- a/press/en/press.wml +++ b/press/en/press.wml @@ -51,6 +51,78 @@ some of the significant Tor-related stories that have popped up.</p> </thead> <tr> +<td>2018 July 09</td> +<td>Tech Republic</td> +<td><a href="https://www.techrepublic.com/article/5-ways-to-protect-your-privacy/">Top 5: Ways to protect your privacy</a></td> +</tr> + +<tr> +<td>2018 July 17</td> +<td>CyberScoop</td> +<td><a href="https://www.cyberscoop.com/domain-fronting-ban-letter-ron-wyden-marco-rubio…">Lawmakers call on Amazon and Google to reconsider ban on domain fronting</a></td> +</tr> + +<tr> +<td>2018 July 23</td> +<td>Motherboard</td> +<td><a href=" https://motherboard.vice.com/en_us/article/wjkjzm/what-went-wrong-at-the-ho…">What Went Wrong at the HOPE Hacking Conference?</a></td> +</tr> + +<tr> +<td>2018 September 05</td> +<td>ghacks.net</td> +<td><a href="https://www.ghacks.net/2018/09/05/tor-browser-8-0-is-a-big-update">Tor Browser 8.0 is a big update</a></td> +</tr> + +<tr> +<td>2018 September 06</td> +<td>ZDNet</td> +<td><a href="https://www.zdnet.com/article/tor-browser-gets-a-redesign-switches-to-new-f…">Tor Browser gets a redesign</a></td> +</tr> + +<tr> +<td>2018 September 05</td> +<td>VentureBeat</td> +<td><a href="https://fossbytes.com/tor-browser-8-0-released-features-download/">Tor Browser 8.0 arrives with new user onboarding,https://venturebeat.com/2018/09/05/tor-browser-8-0-arrives-with-… 9/6/18,FossBytes,Tor Browser 8.0 Released: New Onboarding Experience & Optimized Bridge Fetching</a></td> +</tr> + +<tr> +<td>2018 September 07</td> +<td>VentureBeat</td> +<td><a href="https://venturebeat.com/2018/09/07/tor-gets-its-first-official-mobile-brows…">Tor gets its first official mobile browser</a></td> +</tr> + +<tr> +<td>2018 September 05</td> +<td>Irish Times </td> +<td><a href="https://www.irishtimes.com/business/technology/chrome-lost-its-shine-five-a…">Chrome lost its shine? Five alternative browsers to try</a></td> +</tr> + +<tr> +<td>2018 September 07</td> +<td>CyberScoop</td> +<td><a href="https://www.cyberscoop.com/adware-doctor-mac-os-china/">Tor launches official anonymous Android browser</a></td> +</tr> + +<tr> +<td>2018 September 08</td> +<td>Gizmodo</td> +<td><a href="http://www.gizmodo.co.uk/2018/09/the-tor-web-browser-officially-lands-on-an…">The Tor Web Browser Officially Lands on Android in Alpha</a></td> +</tr> + +<tr> +<td>2018 September 10</td> +<td>Version2</td> +<td><a href="https://www.version2.dk/artikel/anonym-tor-browser-naesten-klar-android-108…">Anonym Tor Browser er - nÌ_sten - klar til Android</a></td> +</tr> + +<tr> +<td>2018 September 10</td> +<td>ThreatPost</td> +<td><a href="https://threatpost.com/tor-brings-onion-browser-to-android-devices/137325/">Tor Brings Browser to Android Devices</a></td> +</tr> + +<tr> <td>2018 July 02</td> <td>Mada Masr</td> <td><a

1 0

[webwml/staging] signing-keys: replace some short with long ids
by hiro＠torproject.org 22 Oct '18

22 Oct '18

commit 4abe7606a05ab054d0b3e13b7529b97265041673 Author: traumschule <traumschuleriebau(a)riseup.net> Date: Sat Sep 1 04:58:23 2018 +0200 signing-keys: replace some short with long ids --- include/keys.txt | 10 +++++----- include/keys.wmi | 12 ++++-------- 2 files changed, 9 insertions(+), 13 deletions(-) diff --git a/include/keys.txt b/include/keys.txt index 81b881cb..a9868a58 100644 --- a/include/keys.txt +++ b/include/keys.txt @@ -1,8 +1,8 @@ [Tor Browser releases] The Tor Browser Developers: 0x4E2C6E8793298290 -Mike Perry: 0x0E3A92E4 +Mike Perry: 0x29846B3C683686CC Georg Koppen: 0x4B7C3223 -Nicolas Vigier: 0xD0220E4B +Nicolas Vigier: 0xE5B81856D0220E4B Linus Nordberg: 0x23291265 Arthur Edelstein: 0xD752F538C0D38C3A @@ -14,13 +14,13 @@ Nick Mathewson: 0xFE43009C4607B1FB, 0x6AFEE6D49E92B601(signing key) Nick Mathewson: 0x165733EA, 0x8D29319A(signing key) [deb.torproject.org repositories and archives] -Tor Project Archive: 0x886DDD89 +Tor Project Archive: 0xEE8CBC9E886DDD89 [Arm releases] Damian Johnson: 0x9ABBEEC6 [Tails live system releases] -The Tails team: 0x58ACD84F +The Tails team: 0xDBB802B258ACD84F [Torsocks releases] David Goulet: 0x42E86A2A11F48D36 @@ -29,4 +29,4 @@ David Goulet: 0x42E86A2A11F48D36 Sukhbir Singh: 0xB01C8B006DA77FAA [other] -Peter Palfrader: 0xC82E0039, 0xE1DEC577(subkey) +Peter Palfrader: 0x62AF4031C82E0039 diff --git a/include/keys.wmi b/include/keys.wmi index 89bfab17..9bb30369 100644 --- a/include/keys.wmi +++ b/include/keys.wmi @@ -1,15 +1,15 @@ #!/usr/bin/env wml <p>The signing keys we use are:</p> <ul> -<li>The Tor Browser Developers (0x4E2C6E8793298290), Mike Perry (0x0E3A92E4), Georg Koppen (0x4B7C3223), Nicolas Vigier (0xD0220E4B), Linus Nordberg (0x23291265), Arthur Edelstein (0xD752F538C0D38C3A) sign <strong>Tor Browser releases</strong></li> +<li>The Tor Browser Developers (0x4E2C6E8793298290), Mike Perry (0x29846B3C683686CC), Georg Koppen (0x4B7C3223), Nicolas Vigier (0xE5B81856D0220E4B), Linus Nordberg (0x23291265), Arthur Edelstein (0xD752F538C0D38C3A) sign <strong>Tor Browser releases</strong></li> <li>Roger Dingledine (0x28988BF5 and 0x19F78451), Nick Mathewson (0x165733EA with its signing key 0x8D29319A) sign <strong>Tor source tarballs</strong></li> <li>Nick Mathewson (0x165733EA with its signing key 0x8D29319A) signed <strong>older Tor tarballs</strong></li> -<li>Tor Project Archive (0x886DDD89) signs <strong>deb.torproject.org repositories and archives</strong></li> +<li>Tor Project Archive (0xEE8CBC9E886DDD89) signs <strong>deb.torproject.org repositories and archives</strong></li> <li>Damian Johnson (0x9ABBEEC6) signs <strong>Arm releases</strong></li> -<li>The Tails team (0x58ACD84F) signs <strong>Tails live system releases</strong></li> +<li>The Tails team (0xDBB802B258ACD84F) signs <strong>Tails live system releases</strong></li> <li>David Goulet (0x42E86A2A11F48D36) signs <strong>Torsocks releases</strong></li> <li>Sukhbir Singh (0xB01C8B006DA77FAA) signs <strong>TorBirdy releases</strong></li> -<li>Other developers include Peter Palfrader (0xC82E0039 with its subkey 0xE1DEC577).</li> +<li>Other developers include Peter Palfrader (0x62AF4031C82E0039).</li> </ul> <h2>Fingerprints</h2> <p>The fingerprints for the keys are:</p> @@ -180,8 +180,4 @@ uid [ unknown] Peter Palfrader <peter#palfrader.org> sub rsa2048/0x8602C8203872331F 2014-05-04 [S] [expires: 2020-09-01] sub rsa2048/0xE377AED938E4E080 2014-05-04 [E] [expires: 2020-09-01] -pub rsa4096/0x7675B62DC82E0039 2014-06-16 [SCEA] [revoked: 2016-08-16] - Key fingerprint = A110 43D3 C8A6 395D DDD0 EE85 7675 B62D C82E 0039 -uid [ revoked] Peter Palfrader - </pre>

1 0

[webwml/staging] Fix comment in homepage
by hiro＠torproject.org 22 Oct '18

22 Oct '18

commit 858bb0b757e63daa274574c671d87159a0c97e18 Author: hiro <hiro(a)torproject.org> Date: Tue Sep 11 17:06:11 2018 +0200 Fix comment in homepage --- include/versions.wmi | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/include/versions.wmi b/include/versions.wmi index 60d6b9f6..8e2a0040 100644 --- a/include/versions.wmi +++ b/include/versions.wmi @@ -1,5 +1,5 @@ <define-tag version-stable whitespace=delete>0.3.4.8</define-tag> -<-- <define-tag version-alpha whitespace=delete>0.3.4.7-rc</define-tag> --> + <define-tag version-torbrowserdevelopbranch whitespace=delete>maint-7.5</define-tag>

1 0

[webwml/staging] Merge branch 'securitytxt'
by hiro＠torproject.org 22 Oct '18

22 Oct '18

commit 8c3248241dab2b889b85ec586e84b37239520ccc Merge: 6d3033ab f1c80a46 Author: hiro <hiro(a)torproject.org> Date: Tue Sep 11 18:27:18 2018 +0200 Merge branch 'securitytxt' .well-known/security.txt | 18 +++++++++++------- about/en/contact.wml | 3 ++- 2 files changed, 13 insertions(+), 8 deletions(-)

1 0

[webwml/staging] press: add press/press.pl to ease updates
by hiro＠torproject.org 22 Oct '18

22 Oct '18

commit e2276dc0de2a258652dce7d2a253974087875ca4 Author: traumschule <traumschuleriebau(a)riseup.net> Date: Tue Sep 11 13:11:21 2018 +0200 press: add press/press.pl to ease updates --- press/press.pl | 59 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 59 insertions(+) diff --git a/press/press.pl b/press/press.pl new file mode 100755 index 00000000..d0c16a9e --- /dev/null +++ b/press/press.pl @@ -0,0 +1,59 @@ +#!/usr/bin/env perl +# Returns html rows based on csv lines +# Usage: /path/to/script /path/to/csv/file > file +use strict; +use warnings; +#use HTML::Escape qw/escape_html/; + +my $str; # append all strings here + +sub print_rows { + my $string = shift; + + # define where to output to: + # 1) STDOUT + print "$string"; + + # 2) press.html + #open my $out, '>>', 'press.html'; + #print $out $string; + # 3) escaped htmlfile (install module above: cpan -i HTML::Escape + #print $out escape_html($string); + #close $out; +} +sub add_row { + $str .= shift; +} +sub parse_line { + my $str = shift; + if ($str =~ /(\d+\/\d+\/\d+),([^,]+),(.+),(.+)/) { # magic regex :) + chomp(my $date = qx/LANG=en_US.UTF-8 date -d "$1" "+%Y %B %d"/); + chomp(my $source = $2); + my $name = $3; + my $url = $4; + my $string = " +<tr> +<td>$date</td> +<td>$source</td> +<td><a href=\"$url\">$name</a></td> +</tr> +"; + add_row $string; + } +} + +foreach my $arg (@ARGV) { + chomp($arg); + if (-f $arg) { + open my $fh, '<', $arg + or warn "Can't open '$arg': $!\n" and next; + foreach (<$fh>) { + parse_line $_; + } + close $fh; + } else { + parse_line $arg; + } +} +if ($str) { print_rows $str; } +else { print "Nothing found.\n"; exit 1; }

1 0

[webwml/staging] Die Vista and XP, die
by hiro＠torproject.org 22 Oct '18

22 Oct '18

commit 5415a0e966b3da941040d62a84d55202c5ad5b36 Author: Georg Koppen <gk(a)torproject.org> Date: Mon Sep 10 13:06:09 2018 +0000 Die Vista and XP, die --- download/en/download.wml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/download/en/download.wml b/download/en/download.wml index ffe5151a..d96896ea 100644 --- a/download/en/download.wml +++ b/download/en/download.wml @@ -54,7 +54,7 @@ you are used to. Please read the <a href="#warning">full list of warnings</a> fo </form> <h2>Tor Browser</h2> - <em>Version <version-torbrowserbundle> (<releasedate-torbrowserbundle>) - Windows 10, 8, 7, Vista, and XP</em> + <em>Version <version-torbrowserbundle> (<releasedate-torbrowserbundle>) - Windows 10, 8, and 7</em> <p>Everything you need to safely browse the Internet. <a href="<page projects/torbrowser>">Learn more »</a></p> </div>

1 0

[webwml/staging] Merge branch 'signing-keys'
by hiro＠torproject.org 22 Oct '18

22 Oct '18

commit daa743880552e660862c4ba4ab102317d788f783 Merge: 8c324824 455b29bf Author: hiro <hiro(a)torproject.org> Date: Thu Sep 13 15:58:28 2018 +0200 Merge branch 'signing-keys'

1 0

[webwml/staging] jobs: deactivate Grant Writer job posting (#27755)
by hiro＠torproject.org 22 Oct '18

22 Oct '18

commit 654286ca6c0ea7b2e20f2c7cd4cdf279b5895da1 Author: traumschule <traumschuleriebau(a)riseup.net> Date: Tue Sep 18 01:57:27 2018 +0200 jobs: deactivate Grant Writer job posting (#27755) --- about/en/jobs.wml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/about/en/jobs.wml b/about/en/jobs.wml index 181fc925..cd14071c 100644 --- a/about/en/jobs.wml +++ b/about/en/jobs.wml @@ -18,7 +18,6 @@ <p>Specifically, we're looking for the following people currently:</p> <ul> <li><a href="<page about/jobs-sysadmin>">Senior Systems Administrator</a></li> - <li><a href="<page about/jobs-grantwriter>">Grant Writer</a></li> </ul> <p>In the past, we looked for the following people:</p> @@ -44,6 +43,7 @@ <li>Project Manager with Product Experience</li> <li>Bookkeeper/Payroll Specialist</li> <li>Grants Manager</li> + <li>Grant Writer</li> </ul> <p>About the company:<br>

1 0

[webwml/staging] fix links in include/README
by hiro＠torproject.org 22 Oct '18

22 Oct '18

commit 6d3033ab95f97b887962bb35e71c78394dc3a35a Author: traumschule <traumschuleriebau(a)riseup.net> Date: Tue Sep 4 18:41:41 2018 +0200 fix links in include/README --- include/README | 18 +++++++++++------- 1 file changed, 11 insertions(+), 7 deletions(-) diff --git a/include/README b/include/README index 676e8387..05a00f3c 100644 --- a/include/README +++ b/include/README @@ -2,8 +2,8 @@ Here's a brief overview of how our wml set-up works. ---------------------------------------------------- Here's a typical wml file: -http://jqs44zhtxl2uo6gk.onion/project/web/webwml.git/docs/en/bridges.wml -https://gitweb.torproject.org/project/web/webwml.git/docs/en/bridges.wml +https://gitweb.torproject.org/project/web/webwml.git/tree/docs/en/bridges.wml +http://jqs44zhtxl2uo6gk.onion/project/web/webwml.git/tree/docs/en/bridges.wml The top of the file has: @@ -26,13 +26,16 @@ and the middle is standard html, plus a few extra tags like pages when they exist. So that wml page produces this html page: https://www.torproject.org/bridges aka https://www.torproject.org/bridges.html.en +https://www.torproject.org/docs/bridges http://expyuzz4wqqyqhjn.onion/docs/bridges Then head.wmi and foot.wmi are just other mostly-html files you import to handle the repeat parts of each page (well, that plus some embedded perl scripts to generate some of the static content). -http://jqs44zhtxl2uo6gk.onion/project/web/webwml.git/include/head.wmi -http://jqs44zhtxl2uo6gk.onion/project/web/webwml.git/include/foot.wmi +https://gitweb.torproject.org/project/web/webwml.git/tree/include/head.wmi +http://jqs44zhtxl2uo6gk.onion/project/web/webwml.git/tree/include/head.wmi +https://gitweb.torproject.org/project/web/webwml.git/tree/include/foot.wmi +http://jqs44zhtxl2uo6gk.onion/project/web/webwml.git/tree/include/foot.wmi You can basically ignore the wml part of them, and to a first approximation just think of them as more html. @@ -42,12 +45,13 @@ So in summary, wml is like html with a bit more markup. ---------------------------------------------------- Where it gets interesting is the download page: -http://jqs44zhtxl2uo6gk.onion/project/web/webwml.git/download/en/download-easy.wml +https://gitweb.torproject.org/project/web/webwml.git/tree/download/en/download-easy.wml +http://jqs44zhtxl2uo6gk.onion/project/web/webwml.git/tree/download/en/download-easy.wml It has the standard header and footer section, but in the body of the page it includes links like <a href="<package-osx-bundle-stable>". Rather than putting URLs and Tor versions into every wml page, and then requiring the translators to update their page whenever we bump a version number, we instead define each URL and version as a new wml element: -http://jqs44zhtxl2uo6gk.onion/project/web/webwml.git/include/versions.wmi - +https://gitweb.torproject.org/project/web/webwml.git/tree/include/versions.wmi +http://jqs44zhtxl2uo6gk.onion/project/web/webwml.git/tree/include/versions.wmi

1 0

[webwml/staging] signing-keys: generate fingerprints from script (#22637)
by hiro＠torproject.org 22 Oct '18

22 Oct '18

commit afb8219eaccb2cedb6d21e12ee84136b58133f5d Author: traumschule <traumschuleriebau(a)riseup.net> Date: Sat Sep 1 04:46:15 2018 +0200 signing-keys: generate fingerprints from script (#22637) To update docs/en/singing-keys.wmi execute the perl script docs/en/update_signing-keys.pl and commit include/keys.wmi Signing keys are stored in include/keys.txt --- docs/en/signing-keys.wml | 140 +----------------------------- docs/en/update_signing-keys.pl | 116 +++++++++++++++++++++++++ include/keys.txt | 32 +++++++ include/keys.wmi | 187 +++++++++++++++++++++++++++++++++++++++++ 4 files changed, 336 insertions(+), 139 deletions(-) diff --git a/docs/en/signing-keys.wml b/docs/en/signing-keys.wml index d08b4033..42d7f3f7 100644 --- a/docs/en/signing-keys.wml +++ b/docs/en/signing-keys.wml @@ -12,145 +12,7 @@ <h1>Which PGP keys sign which packages</h1> <hr> - <p>The signing keys we use are:</p> - <ul> - <li>The Tor Browser Developers (0x4E2C6E8793298290), - Mike Perry (0x0E3A92E4), Georg Koppen (0x4B7C3223), - Nicolas Vigier (0xD0220E4B), Linus Nordberg (0x23291265) - and Arthur Edelstein (0xD752F538C0D38C3A) - sign the Tor Browser releases.</li> - <li>Roger Dingledine (0x28988BF5 and 0x19F78451) or Nick Mathewson - (0xFE43009C4607B1FB with signing key 0x6AFEE6D49E92B601) - sign the Tor source code tarballs. (Nick's old key was 0x165733EA - with signing key 0x8D29319A; it signed older tarballs.)</li> - <li>Tor Project Archive (0x886DDD89) signs the deb.torproject.org - repositories and archives.</li> - <li>Damian Johnson (0x9ABBEEC6) signs Arm releases.</li> - <li>The Tails team (0x58ACD84F) signs the Tails live system releases.</li> - <li>David Goulet (0x42E86A2A11F48D36) signs Torsocks releases.</li> - <li>Sukhbir Singh (0xB01C8B006DA77FAA) signs Tor Messenger and TorBirdy releases.</li> - <li>Other developers include Peter Palfrader (0xC82E0039, or its - subkey 0xE1DEC577).</li> - </ul> - - The fingerprints for the keys should be: - - <pre> - pub 1024D/28988BF5 2000-02-27 - Key fingerprint = B117 2656 DFF9 83C3 042B C699 EB5A 896A 2898 8BF5 - uid Roger Dingledine <arma(a)mit.edu> - - pub 4096R/19F78451 2010-05-07 - Key fingerprint = F65C E37F 04BA 5B36 0AE6 EE17 C218 5258 19F7 8451 - uid Roger Dingledine <arma(a)torproject.org> - sub 4096R/B0E5067D 2015-06-10 [expires: 2016-06-09] - - pub 4096R/FE43009C4607B1FB 2016-09-21 [expires: 2019-09-21] - Key fingerprint = 2133 BC60 0AB1 33E1 D826 D173 FE43 009C 4607 B1FB - uid Nick Mathewson <nickm(a)alum.mit.edu> - uid Nick Mathewson <nickm(a)wangafu.net> - uid Nick Mathewson <nickm(a)torproject.org> - uid Nick Mathewson <nickm(a)freehaven.net> - sub 4096R/6AFEE6D49E92B601 2016-09-23 [expires: 2018-09-23] - sub 4096R/91DDED0286AC8BFF 2016-09-23 [expires: 2018-09-23] - - pub 3072R/165733EA 2004-07-03 - Key fingerprint = B35B F85B F194 89D0 4E28 C33C 2119 4EBB 1657 33EA - uid Nick Mathewson <nickm(a)alum.mit.edu> - uid Nick Mathewson <nickm(a)wangafu.net> - uid Nick Mathewson <nickm(a)freehaven.net> - sub 3072R/8D29319A 2004-07-03 - sub 3072R/F25B8E5E 2004-07-03 - - pub 2048R/63FEE659 2003-10-16 - Key fingerprint = 8738 A680 B84B 3031 A630 F2DB 416F 0610 63FE E659 - uid Erinn Clark <erinn(a)torproject.org> - sub 2048R/EB399FD7 2003-10-16 - - pub 1024D/F1F5C9B5 2010-02-03 - Key fingerprint = C2E3 4CFC 13C6 2BD9 2C75 79B5 6B8A AEB1 F1F5 C9B5 - uid Erinn Clark <erinn(a)torproject.org> - sub 1024g/7828F26A 2010-02-03 - - pub 2048R/886DDD89 2009-09-04 [expires: 2020-08-29] - Key fingerprint = A3C4 F0F9 79CA A22C DBA8 F512 EE8C BC9E 886D DD89 - uid deb.torproject.org archive signing key - sub 2048R/219EC810 2009-09-04 [expires: 2018-08-30] - - pub 1024D/9ABBEEC6 2009-06-17 - Key fingerprint = 6827 8CC5 DD2D 1E85 C4E4 5AD9 0445 B7AB 9ABB EEC6 - uid Damian Johnson <atagar(a)torproject.org> - sub 2048g/146276B2 2009-06-17 - sub 2048R/87F30690 2010-08-07 - - pub 8192R/683686CC 2013-09-11 - Key fingerprint = C963 C21D 6356 4E2B 10BB 335B 2984 6B3C 6836 86CC - uid Mike Perry (Regular use key) <mikeperry(a)torproject.org> - sub 4096R/0F129402 2015-09-07 [expires: 2016-09-11] - sub 4096R/ACC0A961 2015-09-07 [expires: 2016-09-11] - - pub 4096R/C5AA446D 2010-07-14 - Key fingerprint = 261C 5FBE 7728 5F88 FB0C 3432 66C8 C2D7 C5AA 446D - uid Sebastian Hahn <mail(a)sebastianhahn.net> - sub 2048R/A2499719 2010-07-14 - sub 2048R/140C961B 2010-07-14 - - pub 4096R/C82E0039 2003-03-24 - Key fingerprint = 25FC 1614 B8F8 7B52 FF2F 99B9 62AF 4031 C82E 0039 - uid Peter Palfrader <peter(a)palfrader.org> - uid Peter Palfrader <weasel(a)debian.org> - - pub 8192R/C11F6276 2012-07-21 - Key fingerprint = AD1A B35C 674D F572 FBCE 8B0A 6BC7 58CB C11F 6276 - uid David Fifield <david(a)bamsoftware.com> - sub 4096R/D90A8E40 2012-07-21 - sub 4096R/5CD388E5 2012-07-21 - - pub 4096R/23291265 2010-05-07 - Key fingerprint = 8C4C D511 095E 982E B0EF BFA2 1E8B F349 2329 1265 - uid Linus Nordberg <linus(a)torproject.org> - sub 4096R/B5F7D1B1 2016-04-14 [expires: 2017-04-14] - - pub rsa4096/0x94373AA94B7C3223 2013-07-30 - Key fingerprint = 35CD 74C2 4A9B 15A1 9E1A 81A1 9437 3AA9 4B7C 3223 - uid Georg Koppen <gk(a)torproject.org> - sub rsa4096/0x5778071EE2DE675B 2017-09-11 [expires: 2018-09-11] - sub rsa4096/0x72E841BB93148AD2 2017-09-11 [expires: 2018-09-11] - - pub 4096R/3E39CEABFC69F6F7 2015-09-24 - Key fingerprint = 6AB6 AEE9 776E 7827 23C8 ACE8 3E39 CEAB FC69 F6F7 - uid [ unknown] Nicolas Vigier (boklm) <boklm(a)torproject.org> - sub 4096R/07B7CFD7A0FBA062 2017-01-25 [expires: 2019-01-22] - - pub 2048R/D752F538C0D38C3A 2014-12-10 - Key fingerprint = 20B2 4CEF E6AF D615 0B6A 6F18 D752 F538 C0D3 8C3A - uid [ full ] Arthur Edelstein <arthuredelstein(a)gmail.com> - sub 2048R/3306E88D27211E0B 2014-12-10 - - pub 4096R/0x4E2C6E8793298290 2014-12-15 [expires: 2020-08-24] - Key fingerprint = EF6E 286D DA85 EA2A 4BA7 DE68 4E2C 6E87 9329 8290 - uid Tor Browser Developers (signing key) <torbrowser(a)torproject.org> - sub 4096R/0xD1483FA6C3C07136 2016-08-24 [expires: 2018-08-24] - sub 4096R/0xEB774491D9FF06E2 2018-05-26 [expires: 2020-09-12] - - pub 2048R/0x42E86A2A11F48D36 2011-05-11 [expires: 2017-05-09] - Key fingerprint = B744 17ED DF22 AC9F 9E90 F491 42E8 6A2A 11F4 8D36 - uid David Goulet <dgoulet(a)torproject.org> - sub 4096g/FE9D6620 2011-05-11 [expires: 2017-05-09] - sub 4096R/93CC198D 2013-09-10 [expires: 2016-09-10] - - pub 4096R/0xB01C8B006DA77FAA 2016-02-25 [expires: 2020-02-24] - Key fingerprint = E4AC D397 5427 A5BA 8450 A1BE B01C 8B00 6DA7 7FAA - uid Sukhbir Singh <azadi(a)riseup.net> - uid Sukhbir Singh <sukhbir(a)torproject.org> - sub 4096R/0x1AF20C043D9F9289 2016-02-25 [expires: 2020-02-24] - - pub 4096R/58ACD84F 2015-01-18 [expires: 2017-01-11] - Key fingerprint = A490 D0F4 D311 A415 3E2B B7CA DBB8 02B2 58AC D84F - uid Tails developers <tails(a)boum.org> - sub 4096R/752A3DB6 2015-01-18 [expires: 2017-01-11] - sub 4096R/2F699C56 2015-01-18 [expires: 2017-01-11] - </pre> +#include "keys.wmi" TITLE="Tor Project: Signing keys" CHARSET="UTF-8" </div>  diff --git a/docs/en/update_signing-keys.pl b/docs/en/update_signing-keys.pl new file mode 100755 index 00000000..11c04eda --- /dev/null +++ b/docs/en/update_signing-keys.pl @@ -0,0 +1,116 @@ +#!/usr/bin/env perl +use strict; +use warnings; + +my $keysfile = "include/keys.txt"; +my $wmifile = 'include/keys.wmi'; +my $forcekeyupdates = 0; +my $skipkeyupdates = 0; + +# First we load the keys, then we create a wmi file which is included by +# https://www.torproject.org/docs/signing-keys.html.en + +# Determine the base directory in case we are called from somewhere else. +# We assume to sit in docs/en. Update $root path if this file has moved: +$0 =~ /^(.+)\/[^\/]+$/; +my $root = "$1/../.."; +chdir $root or die "Could not enter $root: $! (script path: $0)\n"; + +open my $kf, '<', "$keysfile" # read keys + or die "Could not open $keysfile: $!\n"; + +my %sections; # project => key owners +my %owners; # key owner => string with all keys +my @projects; # save sections in order of appearance +my $section; +foreach (<$kf>) { + # filters comment and empty lines + next if ($_ eq "\n"); + if (/^#/) { + # [section] / project + } elsif (/^\[(.+)\]$/) { + $section = "$1"; + $sections{"$section"} = (); + push (@projects, $section); + # key owner with list of key id(s) + } elsif (/^([^:]+):(.+)$/) { + my $owner = "$1"; + my $keys = "$2"; + push( @{$sections{"$section"}}, $owner); + $owners{"$owner"} = "$keys"; + # tell about unrecognized lines + } else { print "Ignored line: $_\n"; } +} +close $kf; +my @owners = keys %owners; +print "Loaded $keysfile. Found $#owners key owners in $#projects projects.\n"; + +# If the keysfile did not change since the last run, we will not update them. +# To update all keys anyway, set $forcekeyupdates = 1 above, or comment: +if (-f $wmifile && qx/[ $wmifile -nt $keysfile ]/) { + $forcekeyupdates or $skipkeyupdates++; +} + +open my $out, '>', "$wmifile" + or die "Could not write to $wmifile; $!\n"; +print $out "#!/usr/bin/env wml\n<p>The signing keys we use are:</p>\n<ul>\n"; +my %fingerprints; +foreach my $project (@projects) { + my $owners = ''; + my $suf = 's'; + my @keysinproject; + # we grab the key owners for each project and iterate over their keys + foreach my $owner (@{$sections{"$project"}}) { # iterate over owners + my $keys = $owners{"$owner"}; + # example for $keys: 0x165733EA, 0x8D29319A(signing key) + my $inbrackets = ''; + $suf = '' if ($owners ne ''); + my @keys = split (',', $keys); + foreach my $key (@keys) { # iterate over keys + # validate key format. all regexp are beautiful. + if ($key =~ /^\s?(0x[^$]+)(\(([^$]+)\))?/) { + my $key = $1; + push (@keysinproject, $key); + # named alternative key + if ($2) { + $inbrackets .= " with its $3 $key"; + # first key + } elsif ($inbrackets eq '') { + $inbrackets = "$key"; + # second key + } else { + $inbrackets .= " and $key"; + } + } else { # tell if the format is wrong + print "Unrecognized key format: $key\n"; + } + } + my $sep = ($owners eq '') ? '' : ', '; + # Add owner to the list + $owners .= "$sep$owner ($inbrackets)"; + print " - $owner ($inbrackets) [$project]\n"; + } + if ($project eq 'other') { + print $out "<li>Other developers include $owners.</li>\n"; + } else { + $suf = 'ed' if ($project =~ /older/); + print $out "<li>$owners sign$suf <strong>$project</strong></li>\n"; + } + my $keyids = join (' ', @keysinproject); + # update keys form keyserver pool + if ($forcekeyupdates or not $skipkeyupdates) { + print "Fetching $keyids from keyserver:\n"; + qx/gpg --recv-key $keyids/; + } + # save gpg output for later + my $str = qx/gpg --list-keys --keyid-format 0xlong --with-fingerprint $keyids/; + $str =~ s/</</g; $str =~ s/>/>/g; $str =~ s/@/#/g; # replace html codes + $fingerprints{"$project"} = "<pre>\n$str</pre>\n"; +} + +# print keys for each project to file +print $out "</ul>\n<h2>Fingerprints</h2>\n<p>The fingerprints for the keys are:</p>\n"; +foreach my $project (@projects) { + print $out "<h3>$project</h3>\n". $fingerprints{"$project"}; +} +close $out; print "Wrote $wmifile.\n"; exit 0; diff --git a/include/keys.txt b/include/keys.txt new file mode 100644 index 00000000..81b881cb --- /dev/null +++ b/include/keys.txt @@ -0,0 +1,32 @@ +[Tor Browser releases] +The Tor Browser Developers: 0x4E2C6E8793298290 +Mike Perry: 0x0E3A92E4 +Georg Koppen: 0x4B7C3223 +Nicolas Vigier: 0xD0220E4B +Linus Nordberg: 0x23291265 +Arthur Edelstein: 0xD752F538C0D38C3A + +[Tor source tarballs] +Roger Dingledine: 0x28988BF5, 0x19F78451 +Nick Mathewson: 0xFE43009C4607B1FB, 0x6AFEE6D49E92B601(signing key) + +[older Tor tarballs] +Nick Mathewson: 0x165733EA, 0x8D29319A(signing key) + +[deb.torproject.org repositories and archives] +Tor Project Archive: 0x886DDD89 + +[Arm releases] +Damian Johnson: 0x9ABBEEC6 + +[Tails live system releases] +The Tails team: 0x58ACD84F + +[Torsocks releases] +David Goulet: 0x42E86A2A11F48D36 + +[TorBirdy releases] +Sukhbir Singh: 0xB01C8B006DA77FAA + +[other] +Peter Palfrader: 0xC82E0039, 0xE1DEC577(subkey) diff --git a/include/keys.wmi b/include/keys.wmi new file mode 100644 index 00000000..89bfab17 --- /dev/null +++ b/include/keys.wmi @@ -0,0 +1,187 @@ +#!/usr/bin/env wml +<p>The signing keys we use are:</p> +<ul> +<li>The Tor Browser Developers (0x4E2C6E8793298290), Mike Perry (0x0E3A92E4), Georg Koppen (0x4B7C3223), Nicolas Vigier (0xD0220E4B), Linus Nordberg (0x23291265), Arthur Edelstein (0xD752F538C0D38C3A) sign <strong>Tor Browser releases</strong></li> +<li>Roger Dingledine (0x28988BF5 and 0x19F78451), Nick Mathewson (0x165733EA with its signing key 0x8D29319A) sign <strong>Tor source tarballs</strong></li> +<li>Nick Mathewson (0x165733EA with its signing key 0x8D29319A) signed <strong>older Tor tarballs</strong></li> +<li>Tor Project Archive (0x886DDD89) signs <strong>deb.torproject.org repositories and archives</strong></li> +<li>Damian Johnson (0x9ABBEEC6) signs <strong>Arm releases</strong></li> +<li>The Tails team (0x58ACD84F) signs <strong>Tails live system releases</strong></li> +<li>David Goulet (0x42E86A2A11F48D36) signs <strong>Torsocks releases</strong></li> +<li>Sukhbir Singh (0xB01C8B006DA77FAA) signs <strong>TorBirdy releases</strong></li> +<li>Other developers include Peter Palfrader (0xC82E0039 with its subkey 0xE1DEC577).</li> +</ul> +<h2>Fingerprints</h2> +<p>The fingerprints for the keys are:</p> +<h3>Tor Browser releases</h3> +<pre> +pub rsa4096/0x4E2C6E8793298290 2014-12-15 [C] [expires: 2020-08-24] + Key fingerprint = EF6E 286D DA85 EA2A 4BA7 DE68 4E2C 6E87 9329 8290 +uid [ unknown] Tor Browser Developers (signing key) <torbrowser#torproject.org> +sub rsa4096/0xEB774491D9FF06E2 2018-05-26 [S] [expires: 2020-09-12] + +pub rsa8192/0x29846B3C683686CC 2013-09-11 [SC] + Key fingerprint = C963 C21D 6356 4E2B 10BB 335B 2984 6B3C 6836 86CC +uid [ unknown] Mike Perry <mikeperry#endarken.info> +uid [ unknown] Mike Perry <mikeperry#unencrypted.info> +uid [ unknown] Mike Perry (Regular use key) <mikeperry#fscked.org> +uid [ unknown] Mike Perry (Regular use key) <mikeperry#torproject.org> +sub rsa4096/0x004AD1045BA0FE28 2017-10-31 [S] [expires: 2018-10-31] +sub rsa4096/0xEEC50E9938F9F4E9 2017-10-31 [E] [expires: 2018-10-31] + +pub rsa4096/0x4FEA46574B7C3223 2014-06-16 [SCEA] [revoked: 2016-08-16] + Key fingerprint = DFE0 2163 0B44 5B24 DE2D CDAC 4FEA 4657 4B7C 3223 +uid [ revoked] Georg Koppen <georg#getfoxyproxy.org> + +pub rsa4096/0x94373AA94B7C3223 2013-07-30 [SC] + Key fingerprint = 35CD 74C2 4A9B 15A1 9E1A 81A1 9437 3AA9 4B7C 3223 +uid [ unknown] Georg Koppen <gk#torproject.org> +uid [ unknown] Georg Koppen <groeg#vfemail.net> +uid [ unknown] Georg Koppen <georg#getfoxyproxy.org> +sub rsa4096/0x5778071EE2DE675B 2017-09-11 [E] [expires: 2018-09-11] +sub rsa4096/0x72E841BB93148AD2 2017-09-11 [S] [expires: 2018-09-11] + +pub rsa4096/0xE5B81856D0220E4B 2014-03-19 [SC] + Key fingerprint = 4A90 646C 0BAE D9D4 56AB 3111 E5B8 1856 D022 0E4B +uid [ unknown] Nicolas Vigier (TBB Builds Signing Key) <boklm#torproject.org> + +pub rsa4096/0x1E8BF34923291265 2010-05-07 [SC] + Key fingerprint = 8C4C D511 095E 982E B0EF BFA2 1E8B F349 2329 1265 +uid [ unknown] Linus Nordberg <linus#nordberg.se> +uid [ unknown] Linus Nordberg <linus#dfri.se> +uid [ unknown] Linus Nordberg <linus#sunet.se> +uid [ unknown] Linus Nordberg <linus#nordu.net> +uid [ unknown] Linus Nordberg <linus#torproject.org> +uid [ unknown] [jpeg image of size 2906] +sub rsa4096/0xC1788C2B0B3120D3 2018-02-17 [A] +sub rsa4096/0x9DC3E9C66DDABD48 2018-04-11 [E] [expires: 2019-04-11] + +pub rsa4096/0xAADF069E23291265 2014-06-16 [SCEA] [revoked: 2016-08-16] + Key fingerprint = 43D1 9E7B DB63 A474 0B0C B555 AADF 069E 2329 1265 +uid [ revoked] Linus Nordberg <linus#nordberg.se> + +pub rsa2048/0xD752F538C0D38C3A 2014-12-10 [SC] + Key fingerprint = 20B2 4CEF E6AF D615 0B6A 6F18 D752 F538 C0D3 8C3A +uid [ unknown] Arthur Edelstein <arthuredelstein#gmail.com> +sub rsa2048/0x3306E88D27211E0B 2014-12-10 [E] + +</pre> +<h3>Tor source tarballs</h3> +<pre> +pub dsa1024/0xEB5A896A28988BF5 2000-02-27 [SCA] + Key fingerprint = B117 2656 DFF9 83C3 042B C699 EB5A 896A 2898 8BF5 +uid [ unknown] Roger Dingledine <arma#mit.edu> +sub elg2048/0x147FF421788AFDCE 2000-02-27 [E] + +pub rsa1024/0x9C01813428988BF5 2014-06-16 [SCEA] [revoked: 2016-08-16] + Key fingerprint = 2629 5471 A26A B9F9 6C0C 45BB 9C01 8134 2898 8BF5 +uid [ revoked] Roger Dingledine <arma#mit.edu> + +pub rsa4096/0xC218525819F78451 2010-05-07 [SC] + Key fingerprint = F65C E37F 04BA 5B36 0AE6 EE17 C218 5258 19F7 8451 +uid [ unknown] Roger Dingledine <arma#mit.edu> +uid [ unknown] Roger Dingledine <arma#freehaven.net> +uid [ unknown] Roger Dingledine <arma#torproject.org> +sub rsa4096/0x1A61312B4600E8BE 2018-06-03 [E] [expires: 2019-06-03] + +pub rsa4096/0x468FAE2919F78451 2014-06-16 [SCEA] [revoked: 2016-08-16] + Key fingerprint = 9C95 0D05 FC80 2DFA 79C3 7629 468F AE29 19F7 8451 +uid [ revoked] Roger Dingledine <arma#mit.edu> + +pub rsa1024/0xD50624EC165733EA 2014-06-16 [SCEA] [revoked: 2016-08-16] + Key fingerprint = 33DC 81DC C099 4E0A 10D8 048B D506 24EC 1657 33EA +uid [ revoked] Nick Mathewson <nickm#alum.mit.edu> + +pub rsa3072/0x21194EBB165733EA 2004-07-03 [SC] + Key fingerprint = B35B F85B F194 89D0 4E28 C33C 2119 4EBB 1657 33EA +uid [ unknown] Nick Mathewson <nickm#alum.mit.edu> +uid [ unknown] Nick Mathewson <nickm#wangafu.net> +uid [ unknown] Nick Mathewson <nickm#freehaven.net> +uid [ unknown] [jpeg image of size 3369] +sub rsa3072/0x910397D88D29319A 2004-07-03 [S] +sub rsa3072/0xD2CA27F3F25B8E5E 2004-07-03 [E] + +</pre> +<h3>older Tor tarballs</h3> +<pre> +pub rsa1024/0xD50624EC165733EA 2014-06-16 [SCEA] [revoked: 2016-08-16] + Key fingerprint = 33DC 81DC C099 4E0A 10D8 048B D506 24EC 1657 33EA +uid [ revoked] Nick Mathewson <nickm#alum.mit.edu> + +pub rsa3072/0x21194EBB165733EA 2004-07-03 [SC] + Key fingerprint = B35B F85B F194 89D0 4E28 C33C 2119 4EBB 1657 33EA +uid [ unknown] Nick Mathewson <nickm#alum.mit.edu> +uid [ unknown] Nick Mathewson <nickm#wangafu.net> +uid [ unknown] Nick Mathewson <nickm#freehaven.net> +uid [ unknown] [jpeg image of size 3369] +sub rsa3072/0x910397D88D29319A 2004-07-03 [S] +sub rsa3072/0xD2CA27F3F25B8E5E 2004-07-03 [E] + +</pre> +<h3>deb.torproject.org repositories and archives</h3> +<pre> +pub rsa2048/0xEE8CBC9E886DDD89 2009-09-04 [SC] [expires: 2022-08-05] + Key fingerprint = A3C4 F0F9 79CA A22C DBA8 F512 EE8C BC9E 886D DD89 +uid [ unknown] deb.torproject.org archive signing key +sub rsa2048/0x74A941BA219EC810 2009-09-04 [S] [expires: 2020-11-23] + +</pre> +<h3>Arm releases</h3> +<pre> +pub rsa1024/0xF94ABB509ABBEEC6 2014-06-16 [SCEA] [revoked: 2016-08-16] + Key fingerprint = D8AA CF11 9067 89E8 91DD 2C27 F94A BB50 9ABB EEC6 +uid [ revoked] Damian Johnson (www.atagar.com) <atagar1#gmail.com> + +pub dsa1024/0x0445B7AB9ABBEEC6 2009-06-17 [SC] + Key fingerprint = 6827 8CC5 DD2D 1E85 C4E4 5AD9 0445 B7AB 9ABB EEC6 +uid [ unknown] Damian Johnson (www.atagar.com) <atagar1#gmail.com> +uid [ unknown] Damian Johnson <atagar#torproject.org> +sub rsa2048/0x888404C187F30690 2010-08-07 [S] +sub elg2048/0x04F1B63D146276B2 2009-06-17 [E] + +</pre> +<h3>Tails live system releases</h3> +<pre> +pub rsa4096/0xDBB802B258ACD84F 2015-01-18 [C] [expires: 2019-01-11] + Key fingerprint = A490 D0F4 D311 A415 3E2B B7CA DBB8 02B2 58AC D84F +uid [ unknown] Tails developers <tails#boum.org> +uid [ unknown] Tails developers (offline long-term identity key) <tails#boum.org> +sub ed25519/0x90B2B4BD7AED235F 2017-08-28 [S] [expires: 2019-01-11] +sub rsa4096/0xD21DAD38AF281C0B 2017-08-28 [S] [expires: 2019-01-11] +sub rsa4096/0x3020A7A9C2B72733 2017-08-28 [S] [expires: 2019-01-11] + +</pre> +<h3>Torsocks releases</h3> +<pre> +pub rsa2048/0x42E86A2A11F48D36 2011-05-11 [SC] [expires: 2019-05-01] + Key fingerprint = B744 17ED DF22 AC9F 9E90 F491 42E8 6A2A 11F4 8D36 +uid [ unknown] David Goulet <dgoulet#ev0ke.net> +uid [ unknown] David Goulet <dgoulet#riseup.net> +uid [ unknown] David Goulet <dgoulet#torproject.org> +sub rsa4096/0x2AC6036C93CC198D 2013-09-10 [E] [expires: 2019-08-17] + +</pre> +<h3>TorBirdy releases</h3> +<pre> +pub rsa4096/0xB01C8B006DA77FAA 2016-02-25 [SC] [expires: 2020-02-24] + Key fingerprint = E4AC D397 5427 A5BA 8450 A1BE B01C 8B00 6DA7 7FAA +uid [ unknown] Sukhbir Singh <azadi#riseup.net> +uid [ unknown] Sukhbir Singh <sukhbir#torproject.org> +sub rsa4096/0x1AF20C043D9F9289 2016-02-25 [E] [expires: 2020-02-24] + +</pre> +<h3>other</h3> +<pre> +pub rsa4096/0x62AF4031C82E0039 2003-03-24 [SC] [expires: 2024-08-28] + Key fingerprint = 25FC 1614 B8F8 7B52 FF2F 99B9 62AF 4031 C82E 0039 +uid [ unknown] Peter Palfrader +uid [ unknown] Peter Palfrader <weasel#debian.org> +uid [ unknown] Peter Palfrader <peter#palfrader.org> +sub rsa2048/0x8602C8203872331F 2014-05-04 [S] [expires: 2020-09-01] +sub rsa2048/0xE377AED938E4E080 2014-05-04 [E] [expires: 2020-09-01] + +pub rsa4096/0x7675B62DC82E0039 2014-06-16 [SCEA] [revoked: 2016-08-16] + Key fingerprint = A110 43D3 C8A6 395D DDD0 EE85 7675 B62D C82E 0039 +uid [ revoked] Peter Palfrader + +</pre>

1 0