Jonathan Marquardt: > On Mon, Dec 12, 2016 at 10:48:46AM -0500, Tor-talk wrote: >> Reading through this: >> https://www.torproject.org/docs/verifying-signatures.html.en#BuildVerification >> >> Trying to do this on Mac OS X. >> >> `shasum -a 256 <tor browser distro>.dmg` clearly gives me a checksum that doesn't match the one in the "sha256sums-unsigned-build.txt" file. Tried it with 6.0.6 and 6.0.7. >> >> From what I understand, if the PGP signature is valid that confirms the package wasn't tampered with. >> >> But it is confusing and disturbing to a newbie to try this and get a mismatched checksum. Please modify these instructions so it's clear what this process is and what you have to do to get it to work because it doesn't work "out of the box" for Mac OS X. >> >> Thanks-- >> -- >> tor-talk mailing list - tor-talk@xxxxxxxxxxxxxxxxxxxx >> To unsubscribe or change other settings go to >> https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-talk > > I had to ask the guys on the IRC myself. The hashes don't match because they > were created before Apple does their code signing. Hence the "unsigned-build" > in the filename. If you want to verify Windows/OS X builds, you can only use > the individual .asc signatures as described in the paragraphs above. FWIW: we adapted the website to make it more clear that plain checking of SHA-256 sums is not giving the expected results on OS X. That said there are ways to verify Windows binaries just by checking the signature of the sha256sums file, stripping the installer signature and doing a SHA-256 sum calculation. They are desribed on the verifying-signatures-website. We are working on that for OS X as well, see https://trac.torproject.org/projects/tor/ticket/18925. Georg
Attachment:
signature.asc
Description: OpenPGP digital signature
-- tor-talk mailing list - tor-talk@xxxxxxxxxxxxxxxxxxxx To unsubscribe or change other settings go to https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-talk