How to use the signature of tor on macos. It’s a asc file, when I ask for the latest version of tor, the email send it with the dmg file.
@Potter, ref. How can I verify Tor Browser's signature? | Tor Project | Support
For macOS users:
If you are using macOS, you can install GPGTools.
In order to verify the signature you will need to type a few commands in the Terminal (under “Applications”).
Fetching the Tor Developers key
The Tor Browser team signs Tor Browser releases. Import the Tor Browser Developers signing key (0xEF6E286DDA85EA2A4BA7DE684E2C6E8793298290):
gpg --auto-key-locate nodefault,wkd --locate-keys torbrowser@torproject.org
This should show you something like:
gpg: key 4E2C6E8793298290: public key "Tor Browser Developers (signing key) <torbrowser@torproject.org>" imported gpg: Total number processed: 1 gpg: imported: 1 pub rsa4096 2014-12-15 [C] [expires: 2025-07-21] EF6E286DDA85EA2A4BA7DE684E2C6E8793298290 uid [ unknown] Tor Browser Developers (signing key) <torbrowser@torproject.org> sub rsa4096 2018-05-26 [S] [expires: 2020-12-19]
If you get an error message, something has gone wrong and you cannot continue until you’ve figured out why this didn’t work. You might be able to import the key using the Workaround (using a public key) section instead.
After importing the key, you can save it to a file (identifying it by its fingerprint here):
gpg --output ./tor.keyring --export 0xEF6E286DDA85EA2A4BA7DE684E2C6E8793298290
This command results in the key being saved to a file found at the path
./tor.keyring
, i.e. in the current directory. If./tor.keyring
doesn’t exist after running this command, something has gone wrong and you cannot continue until you’ve figured out why this didn’t work.Verifying the signature
To verify the signature of the package you downloaded, you will need to download the corresponding “.asc” signature file as well as the installer file itself, and verify it with a command that asks GnuPG to verify the file that you downloaded.
The examples below assume that you downloaded these two files to your “Downloads” folder. Note that these commands use example file names and yours will be different: you will have downloaded a different version than 9.0 and you may not have chosen the English (en-US) version.
For macOS users:
gpgv --keyring ./tor.keyring ~/Downloads/TorBrowser-9.0-osx64_en-US.dmg.asc ~/Downloads/TorBrowser-9.0-osx6
The result of the command should produce something like this:
gpgv: Signature made 07/08/19 04:03:49 Pacific Daylight Time gpgv: using RSA key EB774491D9FF06E2 gpgv: Good signature from "Tor Browser Developers (signing key) <torbrowser@torproject.org>"
If you get error messages containing ‘No such file or directory’, either something went wrong with one of the previous steps, or you forgot that these commands use example file names and yours will be a little different.