[tor-relays] Tor download signatures

krishna e bera keb at cyblings.on.ca
Sat Apr 5 17:06:08 UTC 2014


On Fri, Mar 28, 2014 at 5:02 AM, Lunar <lunar at torproject.org> wrote:

> Tora Tora Tora:
> > OK, perhaps I have missed "the how" and "which" somewhere, but which
> > signature am I supposed to verify the new Tor 0.2.5.3 tarball against? I
> > tried the ones mentioned on Tor signing page and none seem to stick. A
> > typical message is:
> >
> >
> > # gpg --verify tor-0.2.5.3-alpha.tar.gz{.asc,}
> >
> > gpg: Signature made Sun 23 Mar 2014 02:40:49 AM UTC using RSA key ID
> > 8D29319A
> > gpg: Good signature from "Nick Mathewson <nickm at alum.mit.edu>"
> > gpg:                 aka "Nick Mathewson <nickm at wangafu.net>"
> > gpg:                 aka "Nick Mathewson <nickm at freehaven.net>"
> > gpg:                 aka "[jpeg image of size 3369]"
> > gpg: WARNING: This key is not certified with a trusted signature!
> > gpg:          There is no indication that the signature belongs to the
> > owner.
> > Primary key fingerprint: B35B F85B F194 89D0 4E28  C33C 2119 4EBB 1657
> 33EA
> >      Subkey fingerprint: EF00 F369 1387 FCC5 8CD6  8E13 9103 97D8 8D29
> 319A
>
> That's the correct signature. Quoting
> https://lists.torproject.org/pipermail/tor-talk/2014-March/032448.html:
>
>     (I'm trying to take some load off of Roger's shoulders by doing
>     releases myself.  This means that the signatures on the release are
>     be made with my PGP key, not Roger's.  Please don't freak out.)
>
> Nick's key is listed on the first line of:
> https://www.torproject.org/docs/signing-keys.html
>
> --
> Lunar                                             <lunar at torproject.org>
>
>
See also the paragraph explaining the WARNING (from
https://www.torproject.org/docs/verifying-signatures.html.en
)
"Notice that there is a warning because you haven't assigned a trust index
to this person. This means that GnuPG verified that the key made that
signature, but it's up to you to decide if that key really belongs to the
developer. The best method is to meet the developer in person and exchange
key fingerprints."

Some notes from Mike Perry on the GPG web of trust at
https://lists.torproject.org/pipermail/tor-talk/2013-September/030235.html

Are there any initiatives to remedy the problems, and do people have key
signing meetups?
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.torproject.org/pipermail/tor-relays/attachments/20140405/0355b877/attachment-0001.html>


More information about the tor-relays mailing list