Little-t-tor
How can I verify tor source code?
Attention: These instructions are to verify the tor source code. Please follow the right instructions to verify Tor Browser's signature.
数字签名是一个确保某个包由其开发人员生成并且未被篡改的过程。 Below we explain why it is important and how to verify that the tor source code you download is the one we have created and has not been modified by some attacker.
Each file on our download page is accompanied by a file labelled "sig" with the same name as the package and the extension ".asc". These .asc files are OpenPGP signatures. 它们允许你验证你下载的文件正是我们希望你获取的文件。 This will vary by web browser, but generally you can download this file by right-clicking the "sig" link and selecting the "save file as" option.
For example, tor-0.4.6.7.tar.gz is accompanied by tor-0.4.6.7.tar.gz.asc.
These are example file names and will not exactly match the file names that you download.
我们现在展示如何在不同的操作系统上验证下载文件的数字签名。 请注意数字签名是标注该包被签名的时间。 因此，每个新文件上传时，都会生成具有不同日期的新签名。 只要您验证了签名，就不必担心报告的日期可能有所不同。
正在安装 GnuPG
首先你需要安装GnuPG才能验证签名。
对于 Windows 的用户：
如果您使用 Windows， 下载 Gpg4win并运行其安装包。
为了验证签名，您需要在 Windows 命令行（cmd.exe）中输入一些命令。
对于 macOS 的用户：
如果您正在使用 macOS，您可以安装 GPGTools。
为了验证签名，您需要在（“应用程序”下的）终端中输入一些命令
对于 GNU/Linux 的用户：
如果你使用 GNU/Linux，那么可能在你的系统中已经安装了 GnuPG，因为大多数 Linux 发行版都预装了它。
In order to verify the signature you will need to type a few commands in a terminal window. How to do this will vary depending on your distribution.
正在提取 Tor 开发者密钥
Roger Dingledine (0xEB5A896A28988BF5 and 0xC218525819F78451), Nick Mathewson (0xFE43009C4607B1FB) sign Tor source tarballs.
Fetching Nick Mathewson most recent key:
$ gpg --auto-key-locate nodefault,wkd --locate-keys nickm@torproject.org
这会向您展示像这样的内容：
gpg: key FE43009C4607B1FB: public key "Nick Mathewson <nickm@torproject.org>" imported
gpg: Total number processed: 1
gpg: imported: 1
pub rsa4096 2016-09-21 [C] [expires: 2025-10-04]
2133BC600AB133E1D826D173FE43009C4607B1FB
uid [ unknown] Nick Mathewson <nickm@torproject.org>
sub rsa4096 2016-09-23 [S] [expires: 2025-10-04]
sub rsa4096 2016-09-23 [E] [expires: 2025-10-04]
If you get an error message, something has gone wrong and you cannot continue until you've figured out why this didn't work. You might be able to import the key using the Workaround (using a public key) section instead.
After importing the key, you can save it to a file (identifying it by its fingerprint here):
$ gpg --output ./tor.keyring --export 0x2133BC600AB133E1D826D173FE43009C4607B1FB
This command results in the key being saved to a file found at the path ./tor.keyring, i.e. in the current directory.
If ./tor.keyring doesn't exist after running this command, something has gone wrong and you cannot continue until you've figured out why this didn't work.
验证签名
为了验证你下载的包的签名，除了安装文件本身，你还需要下载相应的“.asc”签名文件，并用一个命令让 GnuPG 验证你下载的文件。
下面的例子假设你已经下载了这样的两个文件到你的"下载"文件夹。 Note that these commands use example file names and yours will be different: you will have downloaded a different version than 9.0 and you may not have chosen the English (en-US) version.
对于 Windows 的用户：
gpgv --keyring .\tor.keyring Downloads\tor-0.4.6.7.tar.gz.asc Downloads\tor-0.4.6.7.tar.gz
对于 macOS 的用户：
gpgv --keyring ./tor.keyring ~/Downloads/tor-0.4.6.7.tar.gz.asc ~/Downloads/tor-0.4.6.7.tar.gz
对于 GNU/Linux 的用户：
gpgv --keyring ./tor.keyring ~/Downloads/tor-0.4.6.7.tar.gz.asc ~/Downloads/tor-0.4.6.7.tar.gz
命令的结果应该与以下输出相似的内容：
gpgv: Signature made Mon 16 Aug 2021 04:44:27 PM -03
gpgv: using RSA key 7A02B3521DC75C542BA015456AFEE6D49E92B601
gpgv: Good signature from "Nick Mathewson <nickm@torproject.org>"
If you get error messages containing 'No such file or directory', either something went wrong with one of the previous steps, or you forgot that these commands use example file names and yours will be a little different.
更多操作（使用公钥）
如果您遇到了无法解决的问题，不妨下载并使用这个公钥来代替。或者，您还可以使用以下指令：
$ curl -s https://openpgpkey.torproject.org/.well-known/openpgpkey/torproject.org/hu/kounek7zrdx745qydx6p59t9mqjpuhdf |gpg --import -
Nick Mathewson key is also available on keys.openpgp.org and can be downloaded from https://keys.openpgp.org/vks/v1/by-fingerprint/2133BC600AB133E1D826D173FE43009C4607B1FB.
If you're using macOS or GNU/Linux, the key can also be fetched by running the following command:
$ gpg --keyserver keys.openpgp.org --search-keys nickm@torproject.org
你也许会想了解更多关于 GnuPG。