git.schokokeks.org
Repositories
Help
Report an Issue
tor-webwml.git
Code
Commits
Branches
Tags
Suche
Strukturansicht:
58ab286ad
Branches
Tags
bridges
docs-debian
jobs
master
press-clips
tor-webwml.git
en
verifying-signatures.wml
add gpg fingerprint info for my keys and update volunteer page to reflect current tbb status
Erinn Clark
commited
58ab286ad
at 2010-03-29 07:32:29
verifying-signatures.wml
Blame
History
Raw
## translation metadata # Revision: $Revision$ # Translation-Priority: 2-medium #include "head.wmi" TITLE="Verifying Signatures" CHARSET="UTF-8" <div class="main-column"> <h2>How to verify signatures for packages</h2> <hr /> <p>Each file on <a href="<page download>">our download page</a> is accompanied by a file with the same name as the package and the extension ".asc". For example, the current Installation Bundle for Windows: <package-win32-bundle-stable-sig>.</p> <p>These .asc files are PGP signatures. They allow you to verify the file you've downloaded is exactly the one that we intended you to get.</p> <p>Of course, you'll need to have our pgp keys in your keyring: if you don't know the pgp key, you can't be sure that it was really us who signed it. The signing keys we use are:</p> <ul> <li>Roger's (0x28988BF5) typically signs the source code file.</li> <li>Nick's (0x165733EA, or its subkey 0x8D29319A)</li> <li>Andrew's (0x31B0974B)</li> <li>Peter's (0x94C09C7F, or its subkey 0xAFA44BDD)</li> <li>Matt's (0x5FA14861)</li> <li>Jacob's (0x9D0FACE4)</li> <li>Erinn's (0x63FEE659) and (0xF1F5C9B5)</li> </ul> <h3>Step One: Import the keys</h3> <hr /> <p>You can import keys directly from GnuPG as well:</p> <pre>gpg --keyserver subkeys.pgp.net --recv-keys 0x28988BF5</pre> <p>or search for keys with</p> <pre>gpg --keyserver subkeys.pgp.net --search-keys 0x28988BF5</pre> <p>and when you select one, it will be added to your keyring.</p> <h3>Step Two: Verify the fingerprints</h3> <hr /> <p>Verify the pgp fingerprints using:</p> <pre>gpg --fingerprint (insert keyid here)</pre> The fingerprints for the keys should be: <pre> pub 1024D/28988BF5 2000-02-27 Key fingerprint = B117 2656 DFF9 83C3 042B C699 EB5A 896A 2898 8BF5 uid Roger Dingledine <arma@mit.edu> pub 3072R/165733EA 2004-07-03 Key fingerprint = B35B F85B F194 89D0 4E28 C33C 2119 4EBB 1657 33EA uid Nick Mathewson <nickm@alum.mit.edu> uid Nick Mathewson <nickm@wangafu.net> uid Nick Mathewson <nickm@freehaven.net> pub 1024D/31B0974B 2003-07-17 Key fingerprint = 0295 9AA7 190A B9E9 027E 0736 3B9D 093F 31B0 974B uid Andrew Lewman (phobos) <phobos@rootme.org> uid Andrew Lewman <andrew@lewman.com> uid Andrew Lewman <andrew@torproject.org> sub 4096g/B77F95F7 2003-07-17 pub 1024D/94C09C7F 1999-11-10 Key fingerprint = 5B00 C96D 5D54 AEE1 206B AF84 DE7A AF6E 94C0 9C7F uid Peter Palfrader uid Peter Palfrader <peter@palfrader.org> uid Peter Palfrader <weasel@debian.org> pub 1024D/5FA14861 2005-08-17 Key fingerprint = 9467 294A 9985 3C9C 65CB 141D AF7E 0E43 5FA1 4861 uid Matt Edman <edmanm@rpi.edu> uid Matt Edman <Matt_Edman@baylor.edu> uid Matt Edman <edmanm2@cs.rpi.edu> sub 4096g/EA654E59 2005-08-17 pub 1024D/9D0FACE4 2008-03-11 [expires: 2010-03-11] Key fingerprint = 12E4 04FF D3C9 31F9 3405 2D06 B884 1A91 9D0F ACE4 uid Jacob Appelbaum <jacob@appelbaum.net> sub 4096g/D5E87583 2008-03-11 [expires: 2010-03-11] pub 2048R/63FEE659 2003-10-16 Key fingerprint = 8738 A680 B84B 3031 A630 F2DB 416F 0610 63FE E659 uid Erinn Clark <erinn@torproject.org> uid Erinn Clark >erinn@debian.org> uid Erinn Clark >erinn@double-helix.org> sub 2048R/EB399FD7 2003-10-16 pub 1024D/F1F5C9B5 2010-02-03 Key fingerprint = C2E3 4CFC 13C6 2BD9 2C75 79B5 6B8A AEB1 F1F5 C9B5 uid Erinn Clark >erinn@torproject.org> sub 1024g/7828F26A 2010-02-03 </pre> <p>(Of course if you want to be really certain that those are the real ones then you should check this from more places or even better get into key signing and build a trust path to those keys.)</p> <h3>Step Three: Verify the downloaded package</h3> <hr /> <p>If you're using GnuPG, then put the .asc and the download in the same directory and type "gpg --verify (whatever).asc (whatever)". It will say something like "Good signature" or "BAD signature" using the following type of command:</p> <pre> gpg --verify tor-0.1.0.17.tar.gz.asc tor-0.1.0.17.tar.gz gpg: Signature made Wed Feb 23 01:33:29 2005 EST using DSA key ID 28988BF5 gpg: Good signature from "Roger Dingledine <arma@mit.edu>" gpg: aka "Roger Dingledine <arma@mit.edu>" gpg: WARNING: This key is not certified with a trusted signature! gpg: There is no indication that the signature belongs to the owner. Primary key fingerprint: B117 2656 DFF9 83C3 042B C699 EB5A 896A 2898 8BF5 </pre> <p> Notice that there is a warning because you haven't assigned a trust index to this user. This means that your program verified the key made that signature. It's up to the user to decide if that key really belongs to the developers. The best method is to meet them in person and exchange gpg fingerprints. Keys can also be signed. If you look up Roger or Nick's keys, other people have essentially said "we have verified this is Roger/Nick". So if you trust that third party, then you have a level of trust for that arma/nick. </p> <p>All this means is you can ignore the message or assign a trust level.</p> <p>For your reference, this is an example of a <em>BAD</em> verification. It means that the signature and file contents do not match:</p> <pre> gpg --verify tor-0.1.0.17.tar.gz.asc gpg: Signature made Wed Feb 23 01:33:29 2005 EST using DSA key ID 28988BF5 gpg: BAD signature from "Roger Dingledine <arma@mit.edu>" </pre> <p>If you see a message like the above one, then you should not trust the file contents.</p> <p>If you are running Tor on Debian you should read the instructions on <a href="<page docs/debian>#packages">importing these keys to apt</a>.</p> </div><!-- #main --> #include <foot.wmi>
