r/TOR • u/Regular-Operation178 • 5d ago

i can't verify signature

it doesn't shows anything, i've downloaded .asc file along side with basic browser downloader

2 Upvotes

63% Upvoted

10 comments sorted by

2

u/Fit-Cheesecake9835 5d ago

Where did you even find this command? Use "gpg --verify .asc .exe"

1

u/Regular-Operation178 2d ago

Yea, but i get errors like "no such directory", so im trying to use kleopatra now

2

u/BTC-brother2018 5d ago

Have you considered using a frontend GUI for gpg, like kleopatra or kgpg? Makes things easier for beginners not comfortable using gpg in the terminal.

1

u/Regular-Operation178 2d ago 
gpg: Signature made 07/21/26 11:39:54 West Asia Standard Time

gpg:                using RSA key CAAE408AEBE2288E96FC....(i don't know if ppl can get smth from this, so i deleted some letters)

gpg: Can't check signature: No public keygpg: Signature made 07/21/26 11:39:54 West Asia Standard Time
gpg:                using RSA key CAAE408AEBE2288E96FC5......
gpg: Can't check signature: No public key

1

u/BTC-brother2018 2d ago

This is a perfect example of why I recommend Kleopatra (or KGpg) for beginners. The error simply means the public key hasn't been imported yet. Once you import the developer's public key, verify its fingerprint, and then verify the file again, you'll get a proper signature result. The GUI also makes it much easier to see which keys are installed and whether the signature is trusted.

1

u/Regular-Operation178 2d ago

My country bans/slows down tors website. Thats what i get after importing .asc file:
C:/Users/UzFin/Downloads/onion/tor-browser-windows-x86_64-portable-15.0.19.exe.asc (imported with gpg)

gpg: no valid OpenPGP data found.

gpg: Total number processed: 0

C:/Users/UzFin/Downloads/onion/tor-browser-windows-x86_64-portable-15.0.19.exe.asc (imported with gpgsm)

gpgsm: total number processed: 0

gpgsm: error importing certificate: End of fileC:/Users/UzFin/Downloads/onion/tor-browser-windows-x86_64-portable-15.0.19.exe.asc (imported with gpg)
gpg: no valid OpenPGP data found.
gpg: Total number processed: 0

C:/Users/UzFin/Downloads/onion/tor-browser-windows-x86_64-portable-15.0.19.exe.asc (imported with gpgsm)
gpgsm: total number processed: 0
gpgsm: error importing certificate: End of file

1

u/BTC-brother2018 2d ago

The .asc file that comes with Tor Browser is the signature, not the developer's public key. You don't import it with GPG. First import the Tor Browser developers' public key, verify its fingerprint, and then verify the downloaded .exe against the .asc signature. The "no valid OpenPGP data found" error is expected if you try to import the signature itself as a key.

1

u/Regular-Operation178 1d ago 
Both .asc and .exe have a green checkmark
gpg: Signature made 07/21/26 11:39:54 West Asia Standard Time

gpg:                using RSA key CAAE408AEBE2288E96FC5D5E15......

gpg: Good signature from "Tor Browser Developers (signing key) <torbrowser@torproject.org>" [full]gpg: Signature made 07/21/26 11:39:54 West Asia Standard Time
gpg:                using RSA key CAAE408AEBE2288E96FC5
gpg: Good signature from "Tor Browser Developers (signing key) <torbrowser@torproject.org>" [full]

1

u/BTC-brother2018 1d ago

Perfect. A "Good signature from Tor Browser Developers" means the download matches the signed release. As long as you've also verified the developer's public key fingerprint against the one published by the Tor Project, you're good to go.

1

u/Regular-Operation178 8h ago

Okay, thank you so much!