August 2018 - tor-commits - lists.torproject.org

[webwml/master] GetTor: mention that HTML are not supported
by hiro＠torproject.org 22 Aug '18

22 Aug '18

commit 9160646bc3d4f62970f9c36507a9b05feb819727 Author: traumschule <traumschuleriebau(a)riseup.net> Date: Wed Aug 15 13:01:30 2018 +0200 GetTor: mention that HTML are not supported --- projects/en/gettor.wml | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/projects/en/gettor.wml b/projects/en/gettor.wml index 1cbbf2c0..b98cea93 100644 --- a/projects/en/gettor.wml +++ b/projects/en/gettor.wml @@ -24,7 +24,8 @@ Currently, the best known email address to do this is gettor(a)torproject.org. This should be the most current and stable GetTor robot as it is operated by Tor Project itself.</p> -<p>To ask for Tor Browser, a user should send an email to GetTor robot with +<p>To ask for Tor Browser, send a plaintext email (at best disable HTML +mails in your email client completely) to the GetTor robot with one of the following options in the body of the message:</p> <ul>

1 0

[webwml/master] about/contact: Add links to .well-known/security.txt and security policy
by hiro＠torproject.org 22 Aug '18

22 Aug '18

commit 75db0a11e3156bbd96210b9502d97cf4b78c8f88 Author: traumschule <traumschuleriebau(a)riseup.net> Date: Wed Aug 15 09:59:43 2018 +0200 about/contact: Add links to .well-known/security.txt and security policy --- about/en/contact.wml | 1 + 1 file changed, 1 insertion(+) diff --git a/about/en/contact.wml b/about/en/contact.wml index 6444138f..539ea547 100644 --- a/about/en/contact.wml +++ b/about/en/contact.wml @@ -115,6 +115,7 @@ uid tor-security(a)lists.torproject.org <tor-security-owner@lists uid tor-security(a)lists.torproject.org <tor-security-request(a)lists.torproject.org> sub 4096R/C00942E4 2017-03-13 </pre></blockquote> + Find links to <a href="https://trac.torproject.org/projects/tor/wiki/org/teams/NetworkTeam/Securit…">acknowledgments and our security policy</a> in machine readable form at <a href="">https://torproject.org/.well-known/security.txt</a>. </p> <a id="badrelays"></a>

1 0

[webwml/master] Add .well-known/security.txt draft
by hiro＠torproject.org 22 Aug '18

22 Aug '18

commit 90e639ada3fc9acd8a0dfcbc688c25952944c7e7 Author: traumschule <traumschuleriebau(a)riseup.net> Date: Wed Aug 15 10:00:51 2018 +0200 Add .well-known/security.txt draft --- .well-known/security.txt | 12 ++++++++++++ 1 file changed, 12 insertions(+) diff --git a/.well-known/security.txt b/.well-known/security.txt new file mode 100644 index 00000000..9d9af26c --- /dev/null +++ b/.well-known/security.txt @@ -0,0 +1,12 @@ +# https://www.torproject.org/about/contact#security +Contact: tor-security(a)lists.torproject.org +Encryption: openpgp4fpr:8B904624C5A28654E4539BC2E135A8B41A7BF184 +Acknowledgments: https://trac.torproject.org/projects/tor/wiki/org/teams/NetworkTeam/Securit… + +Policy: https://trac.torproject.org/projects/tor/wiki/org/teams/NetworkTeam/Securit… +Hiring: https://www.torproject.org/about/jobs + +Permission: None + +# RFC-URL: https://tools.ietf.org/html/draft-foudil-securitytxt-04 +Signature: https://torproject.org/.well-known/security.txt.sig

1 0

[webwml/master] Publish onion address in footer (fixes #23972)
by hiro＠torproject.org 22 Aug '18

22 Aug '18

commit 0820bc349c9eb89c2d98184e58fa8428f490df75 Author: traumschule <traumschuleriebau(a)riseup.net> Date: Wed Aug 15 04:24:47 2018 +0200 Publish onion address in footer (fixes #23972) - use spaces instead of tabs --- include/foot.wmi | 12 ++++++++---- 1 file changed, 8 insertions(+), 4 deletions(-) diff --git a/include/foot.wmi b/include/foot.wmi index a0a505af..3aa3db4c 100644 --- a/include/foot.wmi +++ b/include/foot.wmi @@ -2,10 +2,14 @@ #use "functions.wmi" <div id="footer"> - <div class="onion"><img src="$(IMGROOT)/onion.jpg" alt="Tor"></div> + <div class="onion"><img src="$(IMGROOT)/onion.jpg" alt="Tor"></div> <div class="about"> <p>Trademark, copyright notices, and rules for use by third parties can be found <a href="<page docs/trademark-faq>">in our FAQ</a>.</p> + <p>We offer an <a href="https://www.torproject.org/docs/hidden-services">onion service</a> + for this site: <a href="http://expyuzz4wqqyqhjn.onion/">expyuzz4wqqyqhjn.onion/</a>.<br/> + See <a href="https://onion.torproject.org">https://onion.torproject.org</a> for all + torproject.org onion addresses.</p>  <div class="col first"> - <h4>About Tor</h4> + <h4>About Tor</h4> <ul> <li><a href="<page about/overview>">What Tor Does</a></li> <li><a href="<page about/torusers>">Users of Tor</a></li> @@ -41,7 +45,7 @@ </div>  <div class="col"> - <h4>Get Involved</h4> + <h4>Get Involved</h4> <ul> <li><a href="<page donate/donate-foot>">Donate</a></li> <li><a href="<page docs/documentation>#MailingLists">Mailing Lists</a></li> @@ -52,7 +56,7 @@ </div>  <div class="col"> - <h4>Documentation</h4> + <h4>Documentation</h4> <ul> <li><a href="<page docs/tor-manual>">Manuals</a></li> <li><a href="<page docs/documentation>">Installation Guides</a></li>

1 0

[webwml/master] update gpg fingerprint output (fixes #23586)
by hiro＠torproject.org 22 Aug '18

22 Aug '18

commit fd381d0cf98779d2e21044f2172a09c09b69af90 Author: traumschule <traumschuleriebau(a)riseup.net> Date: Mon Aug 13 22:56:59 2018 +0200 update gpg fingerprint output (fixes #23586) --- docs/en/verifying-signatures.wml | 27 +++++++++++++++------------ 1 file changed, 15 insertions(+), 12 deletions(-) diff --git a/docs/en/verifying-signatures.wml b/docs/en/verifying-signatures.wml index e29fde81..dc55b265 100644 --- a/docs/en/verifying-signatures.wml +++ b/docs/en/verifying-signatures.wml @@ -110,12 +110,13 @@ <pre>"C:\Program Files\Gnu\GnuPg\gpg.exe" --fingerprint 0x4E2C6E8793298290</pre> <p>You should see:</p> <pre> - pub 4096R/93298290 2014-12-15 - Key fingerprint = EF6E 286D DA85 EA2A 4BA7 DE68 4E2C 6E87 9329 8290 - uid Tor Browser Developers (signing key) <torbrowser(a)torproject.org> - sub 4096R/F65C2036 2014-12-15 - sub 4096R/D40814E0 2014-12-15 - sub 4096R/C3C07136 2016-08-24 +pub rsa4096/0x4E2C6E8793298290 2014-12-15 [C] [expires: 2020-08-24] + Key fingerprint = EF6E 286D DA85 EA2A 4BA7 DE68 4E2C 6E87 9329 8290 +uid [ unknown] Tor Browser Developers (signing key) <torbrowser(a)torproject.org> +sub rsa4096/0xD1483FA6C3C07136 2016-08-24 [S] [expires: 2018-08-24] + Key fingerprint = A430 0A6B C93C 0877 A445 1486 D148 3FA6 C3C0 7136 +sub rsa4096/0xEB774491D9FF06E2 2018-05-26 [S] [expires: 2020-09-12] + Key fingerprint = 1107 75B5 D101 FB36 BC6C 911B EB77 4491 D9FF 06E2 </pre> <p>To verify the signature of the package you downloaded, you will need to download the ".asc" file as well. Assuming you downloaded the @@ -168,12 +169,14 @@ <p>You should see:</p> <pre> - pub 4096R/93298290 2014-12-15 - Key fingerprint = EF6E 286D DA85 EA2A 4BA7 DE68 4E2C 6E87 9329 8290 - uid Tor Browser Developers (signing key) <torbrowser(a)torproject.org> - sub 4096R/F65C2036 2014-12-15 - sub 4096R/D40814E0 2014-12-15 - sub 4096R/C3C07136 2016-08-24</pre> +pub rsa4096/0x4E2C6E8793298290 2014-12-15 [C] [expires: 2020-08-24] + Key fingerprint = EF6E 286D DA85 EA2A 4BA7 DE68 4E2C 6E87 9329 8290 +uid [ unknown] Tor Browser Developers (signing key) <torbrowser(a)torproject.org> +sub rsa4096/0xD1483FA6C3C07136 2016-08-24 [S] [expires: 2018-08-24] + Key fingerprint = A430 0A6B C93C 0877 A445 1486 D148 3FA6 C3C0 7136 +sub rsa4096/0xEB774491D9FF06E2 2018-05-26 [S] [expires: 2020-09-12] + Key fingerprint = 1107 75B5 D101 FB36 BC6C 911B EB77 4491 D9FF 06E2 + </pre> <p>To verify the signature of the package you downloaded, you will need to download the ".asc" file as well. Assuming you downloaded the package and its signature to your Downloads folder, run:</p>

1 0

[webwml/master] docs/verifying-signatures: update TBB verification output
by hiro＠torproject.org 22 Aug '18

22 Aug '18

commit 50de7c65723eae5bfbeaa2d5d7575a53e5730aa1 Author: traumschule <traumschuleriebau(a)riseup.net> Date: Mon Aug 13 23:10:49 2018 +0200 docs/verifying-signatures: update TBB verification output Note: This updates the output of gpg --verify once to reflect latest changes gpg. However we need an automated solution in the future to not confuse users with outdated timestamps. --- docs/en/verifying-signatures.wml | 34 ++++++++++++++++++++-------------- 1 file changed, 20 insertions(+), 14 deletions(-) diff --git a/docs/en/verifying-signatures.wml b/docs/en/verifying-signatures.wml index dc55b265..c3e5f3e5 100644 --- a/docs/en/verifying-signatures.wml +++ b/docs/en/verifying-signatures.wml @@ -122,16 +122,18 @@ sub rsa4096/0xEB774491D9FF06E2 2018-05-26 [S] [expires: 2020-09-12] to download the ".asc" file as well. Assuming you downloaded the package and its signature to your Desktop, run:</p> <pre>"C:\Program Files\Gnu\GnuPg\gpg.exe" --verify \ - C:\Users\Alice\Desktop\torbrowser-install-<version-torbrowserbundle>_en-US.exe.asc \ - C:\Users\Alice\Desktop\torbrowser-install-<version-torbrowserbundle>_en-US.exe</pre> + C:\Users\Alice\Desktop\torbrowser-install-<version-torbrowserbundle>_en-US.exe.asc</pre> <p>Please substitute "Alice" with your own username.</p> <p>The output should say "Good signature": </p> <pre> - gpg: Signature made Tue 24 Jan 2015 09:29:09 AM CET using RSA key ID D40814E0 - gpg: Good signature from "Tor Browser Developers (signing key) <torbrowser(a)torproject.org>" - gpg: WARNING: This key is not certified with a trusted signature! - gpg: There is no indication that the signature belongs to the owner. - Primary key fingerprint: EF6E 286D DA85 EA2A 4BA7 DE68 4E2C 6E87 9329 8290</pre> +gpg: assuming signed data in 'torbrowser-install-<version-torbrowserbundle>_en-US.exe' +gpg: Signature made Wed 15 Nov 2017 05:52:38 PM CET +gpg: using RSA key 0xD1483FA6C3C07136 +gpg: Good signature from "Tor Browser Developers (signing key) <torbrowser(a)torproject.org>" [unknown] +gpg: WARNING: This key is not certified with a trusted signature! +gpg: There is no indication that the signature belongs to the owner. +Primary key fingerprint: EF6E 286D DA85 EA2A 4BA7 DE68 4E2C 6E87 9329 8290 + Subkey fingerprint: A430 0A6B C93C 0877 A445 1486 D148 3FA6 C3C0 7136 <p>Currently valid subkey fingerprints are: <pre> 5242 013F 02AF C851 B1C7 36B8 7017 ADCE F65C 2036 @@ -185,17 +187,21 @@ sub rsa4096/0xEB774491D9FF06E2 2018-05-26 [S] [expires: 2020-09-12] <pre>gpg --verify ~/Downloads/TorBrowser-<version-torbrowserbundleosx64>-osx64_en-US.dmg{.asc*,}</pre> <strong>For Linux users</strong> (change 64 to 32 if you have the 32-bit package):<br /> - <pre>gpg --verify tor-browser-linux64-<version-torbrowserbundlelinux64>_en-US.tar.xz.asc \ - tor-browser-linux64-<version-torbrowserbundlelinux64>_en-US.tar.xz</pre> + <pre>gpg --verify tor-browser-linux64-<version-torbrowserbundlelinux64>_en-US.tar.xz.asc</pre> <p>The output should say "Good signature":</p> <pre> - gpg: Signature made Tue 24 Jan 2015 09:29:09 AM CET using RSA key ID D40814E0 - gpg: Good signature from "Tor Browser Developers (signing key) <torbrowser(a)torproject.org>" - gpg: WARNING: This key is not certified with a trusted signature! - gpg: There is no indication that the signature belongs to the owner. - Primary key fingerprint: EF6E 286D DA85 EA2A 4BA7 DE68 4E2C 6E87 9329 8290</pre> <p> Currently valid subkey fingerprints are: +gpg: assuming signed data in 'tor-browser-linux64-<version-torbrowserbundlelinux64>_en-US.tar.xz' +gpg: Signature made Wed 15 Nov 2017 05:52:38 PM CET +gpg: using RSA key 0xD1483FA6C3C07136 +gpg: Good signature from "Tor Browser Developers (signing key) <torbrowser(a)torproject.org>" [unknown] +gpg: WARNING: This key is not certified with a trusted signature! +gpg: There is no indication that the signature belongs to the owner. +Primary key fingerprint: EF6E 286D DA85 EA2A 4BA7 DE68 4E2C 6E87 9329 8290 + Subkey fingerprint: A430 0A6B C93C 0877 A445 1486 D148 3FA6 C3C0 7136 + </pre> + <p> Currently valid subkey fingerprints are: <pre> 5242 013F 02AF C851 B1C7 36B8 7017 ADCE F65C 2036 BA1E E421 BBB4 5263 180E 1FC7 2E1A C68E D408 14E0

1 0

[webwml/master] remove full path from windows gpg command (see #3893#comment:7)
by hiro＠torproject.org 22 Aug '18

22 Aug '18

commit 95d93dd93afd33396a2ee9f91d8686c125984ac9 Author: traumschule <traumschuleriebau(a)riseup.net> Date: Mon Aug 13 23:29:30 2018 +0200 remove full path from windows gpg command (see #3893#comment:7) --- docs/en/verifying-signatures.wml | 10 +++------- 1 file changed, 3 insertions(+), 7 deletions(-) diff --git a/docs/en/verifying-signatures.wml b/docs/en/verifying-signatures.wml index c3e5f3e5..7a311365 100644 --- a/docs/en/verifying-signatures.wml +++ b/docs/en/verifying-signatures.wml @@ -99,15 +99,12 @@ <p>Once it's installed, use GnuPG to import the key that signed your package. In order to verify the signature you will need to type a few commands in windows command-line, <i>cmd.exe</i>. - <p>Unless you edit your PATH environment variable, you will need to tell Windows - the full path to the GnuPG program. If you installed GnuPG with the default values, the path should be - something like this: <i>C:\Program Files\Gnu\GnuPg\gpg.exe</i>.</p> <p>The Tor Browser team signs Tor Browser releases. Import its key (0x4E2C6E8793298290) by starting <i>cmd.exe</i> and typing:</p> - <pre>"C:\Program Files\Gnu\GnuPg\gpg.exe" --keyserver pool.sks-keyservers.net --recv-keys 0x4E2C6E8793298290</pre> + <pre>gpg.exe --keyserver pool.sks-keyservers.net --recv-keys 0x4E2C6E8793298290</pre> <p>After importing the key, you can verify that the fingerprint is correct:</p> - <pre>"C:\Program Files\Gnu\GnuPg\gpg.exe" --fingerprint 0x4E2C6E8793298290</pre> + <pre>gpg.exe --fingerprint 0x4E2C6E8793298290</pre> <p>You should see:</p> <pre> pub rsa4096/0x4E2C6E8793298290 2014-12-15 [C] [expires: 2020-08-24] @@ -121,8 +118,7 @@ sub rsa4096/0xEB774491D9FF06E2 2018-05-26 [S] [expires: 2020-09-12] <p>To verify the signature of the package you downloaded, you will need to download the ".asc" file as well. Assuming you downloaded the package and its signature to your Desktop, run:</p> - <pre>"C:\Program Files\Gnu\GnuPg\gpg.exe" --verify \ - C:\Users\Alice\Desktop\torbrowser-install-<version-torbrowserbundle>_en-US.exe.asc</pre> + <pre>gpg.exe --verify C:\Users\Alice\Desktop\torbrowser-install-<version-torbrowserbundle>_en-US.exe.asc</pre> <p>Please substitute "Alice" with your own username.</p> <p>The output should say "Good signature": </p> <pre>

1 0

[webwml/master] change tor link to docs/documentation
by hiro＠torproject.org 22 Aug '18

22 Aug '18

commit ca26be1852f7f1e396a364e16edd7c0f1f4c685a Author: traumschule <traumschuleriebau(a)riseup.net> Date: Fri Aug 17 00:15:48 2018 +0200 change tor link to docs/documentation --- projects/en/projects.wml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/projects/en/projects.wml b/projects/en/projects.wml index f138205c..e087f182 100644 --- a/projects/en/projects.wml +++ b/projects/en/projects.wml @@ -14,10 +14,10 @@ experience safer and better.</p> <div class="projectbox"> -<a href="<page projects/tor>"><img class="icon" src="$(IMGROOT)/icon-Tor.jpg" +<a href="<page docs/documentation>"><img class="icon" src="$(IMGROOT)/icon-Tor.jpg" alt="Tor Icon" width="75" height="75"></a> <div class="projectdesc"><div class="name"><a href="<page -projects/tor>">Tor</a></div> <p>Tor is free software and an open network +docs/documentation>">Tor</a></div> <p>Tor is free software and an open network that helps you defend against traffic analysis, a form of network surveillance that threatens personal freedom and privacy, confidential business activities and relationships, and state security.</p>

1 0

[webwml/master] add Tor to project list (fixes #16406)
by hiro＠torproject.org 22 Aug '18

22 Aug '18

commit b441f4ae6f2866eec471bea5ff314e7f181f93e7 Author: traumschule <traumschuleriebau(a)riseup.net> Date: Mon Aug 13 22:43:51 2018 +0200 add Tor to project list (fixes #16406) --- projects/en/projects.wml | 10 ++++++++++ 1 file changed, 10 insertions(+) diff --git a/projects/en/projects.wml b/projects/en/projects.wml index c819c2ee..f138205c 100644 --- a/projects/en/projects.wml +++ b/projects/en/projects.wml @@ -14,6 +14,16 @@ experience safer and better.</p> <div class="projectbox"> +<a href="<page projects/tor>"><img class="icon" src="$(IMGROOT)/icon-Tor.jpg" +alt="Tor Icon" width="75" height="75"></a> +<div class="projectdesc"><div class="name"><a href="<page +projects/tor>">Tor</a></div> <p>Tor is free software and an open network +that helps you defend against traffic analysis, a form of network +surveillance that threatens personal freedom and privacy, confidential +business activities and relationships, and state security.</p> +</div></div> + +<div class="projectbox"> <a href="<page projects/torbrowser>"><img class="icon" src="$(IMGROOT)/icon-TorBrowser.jpg" alt="TorBrowser Icon" width="75" height="75"></a>

1 0

[webwml/master] Remove blank new line character
by hiro＠torproject.org 22 Aug '18

22 Aug '18

commit a9ba136255686c2b359931e54825601d108a23d3 Author: hiro <hiro(a)torproject.org> Date: Wed Aug 22 08:54:07 2018 +0200 Remove blank new line character --- docs/en/debian.wml | 10 +++------- 1 file changed, 3 insertions(+), 7 deletions(-) diff --git a/docs/en/debian.wml b/docs/en/debian.wml index b4008f33..30684a4a 100644 --- a/docs/en/debian.wml +++ b/docs/en/debian.wml @@ -155,9 +155,7 @@ in place of <DISTRIBUTION>. </p> <p> -If you want to use the <a href="<page download/download-unix>#packagediff">development branch</a> of Tor -instead (more features and more bugs), you need add a different set of lines to your -<i>/etc/apt/sources.list</i> file:<br /> +If you want to use the <a href="<page download/download-unix>#packagediff">development branch</a> of Tor instead (more features and more bugs), you need add a different set of lines to your <i>/etc/apt/sources.list</i> file:<br /> <pre style="margin: 1.5em 0 1.5em 2em"> deb https://deb.torproject.org/torproject.org <DISTRIBUTION> main deb https://deb.torproject.org/torproject.org tor-experimental-0.3.4.x-<DISTRIBUTION> main @@ -172,8 +170,7 @@ apt install apt-transport-https </pre></blockquote> to enable the usage of 'deb https://foo distro main' lines in the /etc/apt/sources.list so that all package managers using the libapt-pkg library can access metadata and packages available in sources accessible over https (Hypertext Transfer Protocol Secure).</p> -<p>To use Apt with Tor later replace <tt>https://</tt> with <tt>tor://</tt> and run -<blockquote><pre> +<p>To use Apt with Tor later replace <tt>https://</tt> with <tt>tor://</tt> and run <blockquote><pre> apt install apt-transport-tor </pre></blockquote> </p> @@ -219,8 +216,7 @@ access it you might try to use the name of one of its part instead. Try </p> <p><code>deb.torproject.org</code> is also served through now also served via onion service: -<a href="http://sdscoq7snqtznauu.onion">http://sdscoq7snqtznauu.onion/</a> To use the onion service with -apt, replace the address in the previously added lines: +<a href="http://sdscoq7snqtznauu.onion">http://sdscoq7snqtznauu.onion/</a> To use the onion service with apt, replace the address in the previously added lines: <pre style="margin: 1.5em 0 1.5em 2em">. # For the stable version. deb tor://sdscoq7snqtznauu.onion/torproject.org buster main

1 0