first cut of the new, shiny...
Andrew Lewman authored 13 years ago
|
1) ## translation metadata
2) # Revision: $Revision: 22418 $
3) # Translation-Priority: 2-medium
4)
5) #include "head.wmi" TITLE="Tor Project: Verifying Signatures" CHARSET="UTF-8"
6) <div id="content" class="clearfix">
7) <div id="breadcrumbs">
|
change all of the breadcrum...
Andrew Lewman authored 13 years ago
|
8) <a href="<page index>">Home » </a>
|
first cut of the new, shiny...
Andrew Lewman authored 13 years ago
|
9) <a href="<page docs/verifying-signatures>">Verifying Signatures</a>
10) </div>
11) <div id="maincol">
12) <h1>How to verify signatures for packages</h1>
|
We decided to go with HTML...
Sebastian Hahn authored 13 years ago
|
13) <hr>
|
first cut of the new, shiny...
Andrew Lewman authored 13 years ago
|
14)
15) <p>Each file on <a href="<page download/download>">our download page</a> is accompanied
16) by a file with the same name as the package and the extension
17) ".asc". These .asc files are GPG signatures. They allow you to verify
18) the file you've downloaded is exactly the one that we intended you to
19) get. For example, vidalia-bundle-0.2.1.25-0.2.7.exe is accompanied by
20) vidalia-bundle-0.2.1.25-0.2.7.exe.asc.</p>
21)
22) <p>Of course, you'll need to have our GPG keys in your keyring: if you don't
23) know the GPG key, you can't be sure that it was really us who signed it. The
24) signing keys we use are:</p>
25) <ul>
26) <li>Roger's (0x28988BF5) typically signs the source code file.</li>
27) <li>Nick's (0x165733EA, or its subkey 0x8D29319A).</li>
28) <li>Andrew's (0x31B0974B) typically signs packages for windows and mac.</li>
29) <li>Peter's (0x94C09C7F, or its subkey 0xAFA44BDD).</li>
30) <li>Matt's (0x5FA14861).</li>
31) <li>Jacob's (0xE012B42D).</li>
32) <li>Erinn's (0x63FEE659) and (0xF1F5C9B5) typically signs the linux packages.</li>
33) <li>Mike's (0xDDC6C0AD) signs the Torbutton xpi.</li>
34) </ul>
35)
36) <h3>Step Zero: Install GnuPG</h3>
|
We decided to go with HTML...
Sebastian Hahn authored 13 years ago
|
37) <hr>
|
first cut of the new, shiny...
Andrew Lewman authored 13 years ago
|
38) <p>You need to have GnuPG installed before you can verify
39) signatures.</p>
40)
41) <ul>
42) <li>Linux: see <a
43) href="http://www.gnupg.org/download/">http://www.gnupg.org/download/</a>
44) or install <i>gnupg</i> from the package management system.</li>
45) <li>Windows: see <a
46) href="http://www.gnupg.org/download/">http://www.gnupg.org/download/</a>. Look
47) for the "version compiled for MS-Windows" under "Binaries".</li>
48) <li>Mac: see <a
49) href="http://macgpg.sourceforge.net/">http://macgpg.sourceforge.net/</a>.</li>
50) </ul>
51)
52) <h3>Step One: Import the keys</h3>
|
We decided to go with HTML...
Sebastian Hahn authored 13 years ago
|
53) <hr>
|
first cut of the new, shiny...
Andrew Lewman authored 13 years ago
|
54) <p>The next step is to import the key. This can be done directly from
55) GnuPG. Make sure you import the correct key. For example, if you
56) downloaded a Windows package, you will need to import Andrew's key.</p>
57)
58) <p><b>Windows:</b></p>
59) <p>GnuPG for Windows is a command line tool, and you will need to use
60) <i>cmd.exe</i>. Unless you edit your PATH environment variable, you will
61) need to tell Windows the full path to the GnuPG program. If you installed GnuPG
62) with the default values, the path should be something like this: <i>C:\Program
63) Files\Gnu\GnuPg\gpg.exe</i>.</p>
64)
65) <p>To import the key 0x28988BF5, start <i>cmd.exe</i> and type:</p>
66)
67) <pre>C:\Program Files\Gnu\GnuPg\gpg.exe --recv-keys 0x28988BF5</pre>
68)
69) <p><b>Mac and Linux</b></p>
70) <p>Whether you have a Mac or you run Linux, you will need to use the terminal
71) to run GnuPG. Mac users can find the terminal under "Applications". If you run
72) Linux and use Gnome, the terminal should be under "Applications menu" and
73) "Accessories". KDE users can find the terminal under "Menu" and "System".</p>
74)
75) <p>To import the key 0x28988BF5, start the terminal and type:</p>
76)
77) <pre>gpg --recv-keys 0x28988BF5</pre>
78)
79) <h3>Step Two: Verify the fingerprints</h3>
|
We decided to go with HTML...
Sebastian Hahn authored 13 years ago
|
80) <hr>
|
first cut of the new, shiny...
Andrew Lewman authored 13 years ago
|
81) <p>After importing the key, you will want to verify that the fingerprint is correct.</p>
82)
83) <p><b>Windows:</b></p>
84) <pre>C:\Program Files\Gnu\GnuPg\gpg.exe --fingerprint (insert keyid here)</pre>
85)
86) <p><b>Mac and Linux</b></p>
87) <pre>gpg --fingerprint (insert keyid here)</pre>
88)
89) The fingerprints for the keys should be:
90)
91) <pre>
92) pub 1024D/28988BF5 2000-02-27
93) Key fingerprint = B117 2656 DFF9 83C3 042B C699 EB5A 896A 2898 8BF5
94) uid Roger Dingledine <arma@mit.edu>
95)
96) pub 3072R/165733EA 2004-07-03
97) Key fingerprint = B35B F85B F194 89D0 4E28 C33C 2119 4EBB 1657 33EA
98) uid Nick Mathewson <nickm@alum.mit.edu>
99) uid Nick Mathewson <nickm@wangafu.net>
100) uid Nick Mathewson <nickm@freehaven.net>
101)
102) pub 1024D/31B0974B 2003-07-17
103) Key fingerprint = 0295 9AA7 190A B9E9 027E 0736 3B9D 093F 31B0 974B
104) uid Andrew Lewman (phobos) <phobos@rootme.org>
105) uid Andrew Lewman <andrew@lewman.com>
106) uid Andrew Lewman <andrew@torproject.org>
107) sub 4096g/B77F95F7 2003-07-17
108)
109) pub 1024D/94C09C7F 1999-11-10
110) Key fingerprint = 5B00 C96D 5D54 AEE1 206B AF84 DE7A AF6E 94C0 9C7F
111) uid Peter Palfrader
112) uid Peter Palfrader <peter@palfrader.org>
113) uid Peter Palfrader <weasel@debian.org>
114)
115) pub 1024D/5FA14861 2005-08-17
116) Key fingerprint = 9467 294A 9985 3C9C 65CB 141D AF7E 0E43 5FA1 4861
117) uid Matt Edman <edmanm@rpi.edu>
118) uid Matt Edman <Matt_Edman@baylor.edu>
119) uid Matt Edman <edmanm2@cs.rpi.edu>
120) sub 4096g/EA654E59 2005-08-17
121)
122) pub 1024D/9D0FACE4 2008-03-11 [expires: 2010-10-07]
123) Key fingerprint = 12E4 04FF D3C9 31F9 3405 2D06 B884 1A91 9D0F ACE4
124) uid Jacob Appelbaum <jacob@appelbaum.net>
125) sub 4096R/F8D04B59 2010-03-11 [expires: 2010-10-07]
126)
127) pub 2048R/63FEE659 2003-10-16
128) Key fingerprint = 8738 A680 B84B 3031 A630 F2DB 416F 0610 63FE E659
129) uid Erinn Clark <erinn@torproject.org>
130) uid Erinn Clark <erinn@debian.org>
131) uid Erinn Clark <erinn@double-helix.org>
132) sub 2048R/EB399FD7 2003-10-16
133)
134) pub 1024D/F1F5C9B5 2010-02-03
135) Key fingerprint = C2E3 4CFC 13C6 2BD9 2C75 79B5 6B8A AEB1 F1F5 C9B5
136) uid Erinn Clark <erinn@torproject.org>
137) sub 1024g/7828F26A 2010-02-03
138)
139) pub 1024D/DDC6C0AD 2006-07-26
140) Key fingerprint = BECD 90ED D1EE 8736 7980 ECF8 1B0C A30C DDC6 C0AD
141) uid Mike Perry <mikeperry@fscked.org>
142) uid Mike Perry <mikepery@fscked.org>
143) sub 4096g/AF0A91D7 2006-07-26
144)
145) </pre>
146)
147) <h3>Step Three: Verify the downloaded package</h3>
|
We decided to go with HTML...
Sebastian Hahn authored 13 years ago
|
148) <hr>
|