On Fri, Mar 28, 2014 at 5:02 AM, Lunar lunar@torproject.org wrote:
Tora Tora Tora:
OK, perhaps I have missed "the how" and "which" somewhere, but which signature am I supposed to verify the new Tor 0.2.5.3 tarball against? I tried the ones mentioned on Tor signing page and none seem to stick. A typical message is:
# gpg --verify tor-0.2.5.3-alpha.tar.gz{.asc,}
gpg: Signature made Sun 23 Mar 2014 02:40:49 AM UTC using RSA key ID 8D29319A gpg: Good signature from "Nick Mathewson nickm@alum.mit.edu" gpg: aka "Nick Mathewson nickm@wangafu.net" gpg: aka "Nick Mathewson nickm@freehaven.net" gpg: aka "[jpeg image of size 3369]" gpg: WARNING: This key is not certified with a trusted signature! gpg: There is no indication that the signature belongs to the owner. Primary key fingerprint: B35B F85B F194 89D0 4E28 C33C 2119 4EBB 1657
33EA
Subkey fingerprint: EF00 F369 1387 FCC5 8CD6 8E13 9103 97D8 8D29319A
That's the correct signature. Quoting https://lists.torproject.org/pipermail/tor-talk/2014-March/032448.html:
(I'm trying to take some load off of Roger's shoulders by doing releases myself. This means that the signatures on the release are be made with my PGP key, not Roger's. Please don't freak out.)Nick's key is listed on the first line of: https://www.torproject.org/docs/signing-keys.html
-- Lunar lunar@torproject.org
See also the paragraph explaining the WARNING (from https://www.torproject.org/docs/verifying-signatures.html.en ) "Notice that there is a warning because you haven't assigned a trust index to this person. This means that GnuPG verified that the key made that signature, but it's up to you to decide if that key really belongs to the developer. The best method is to meet the developer in person and exchange key fingerprints."
Some notes from Mike Perry on the GPG web of trust at https://lists.torproject.org/pipermail/tor-talk/2013-September/030235.html
Are there any initiatives to remedy the problems, and do people have key signing meetups?