Re: [tor-talk] confusion over verification instructions for build verification on Mac OS X

[Jonathan Marquardt <mail@xxxxxxxxxxxx>]

On Mon, Dec 12, 2016 at 10:48:46AM -0500, Tor-talk wrote:
> Reading through this:
> https://www.torproject.org/docs/verifying-signatures.html.en#BuildVerification
> 
> Trying to do this on Mac OS X.
> 
> `shasum -a 256 <tor browser distro>.dmg` clearly gives me a checksum that doesn't match the one in the "sha256sums-unsigned-build.txt" file. Tried it with 6.0.6 and 6.0.7.
> 
> From what I understand, if the PGP signature is valid that confirms the package wasn't tampered with.
> 
> But it is confusing and disturbing to a newbie to try this and get a mismatched checksum. Please modify these instructions so it's clear what this process is and what you have to do to get it to work because it doesn't work "out of the box" for Mac OS X.
> 
> Thanks--
> -- 
> tor-talk mailing list - tor-talk@xxxxxxxxxxxxxxxxxxxx
> To unsubscribe or change other settings go to
> https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-talk

I had to ask the guys on the IRC myself. The hashes don't match because they 
were created before Apple does their code signing. Hence the "unsigned-build" 
in the filename. If you want to verify Windows/OS X builds, you can only use 
the individual .asc signatures as described in the paragraphs above.
-- 
tor-talk mailing list - tor-talk@xxxxxxxxxxxxxxxxxxxx
To unsubscribe or change other settings go to
https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-talk