logs archiveIRC Archive / Oftc / #tor / 2015 / September / 25 / 1
user476
hello
my TBB downloaded some updates and this was printed to console:
ERROR: Error verifying signature.
ERROR: Not all signatures were verified.
so does this mean that someone has tampered with the download?
i didn't let it install any updates
i downloaded the package manually
cacahuatl
what signature are you downloading and how are you verifying it?
user476
i dont' know, i mean TBB printed those messages to the console
cacahuatl
is this...torbrowser-launcher or something?
user476
tor browser bundle for linux
cacahuatl
okay, you downloaded it manually, you've got the .tar.xz and the .tar.xz.asc files?
kernelcorn
it sounds like it's coming from the launcher during the update process
cacahuatl
https://www.torproject.org/docs/verifying-signatures.html.en
user476
i mean, it auto downloaded updates and printed that error, i didn't let it install any updates, but downloaded the newest TBB manually and unpacked it
         

cacahuatl
weird, it doesn't by default log to the console anymore?
so are the .mar files signed now? they weren't before but I know it was planned
user476
well i started it with ./start-tor-browser.desktop --verbose
so it prints more information
cacahuatl
user476: I'm not 100% sure of how it's checking those signatures, if you try to verify the signature for the manual download, does that work okay?
user476
cacahuatl: didn't try yet, i just checked sha256sum
but i can try
cacahuatl
ouch, sha256 on it's own is to check for accidental data corruption in the download, not intentional foul play.
user476
hmm i thought sha256 would be quite secure... unlikely md5
cacahuatl
sure, it's a good hash algorithm but if someone could tamper with the .tar.xz they could just change the contents of the text file listing it's hash too :) but I'm interested, I suspect it's using the local gpg so if you don't have the tor browser dev signing key in your keyring that might be why it's failing to verify?
user476
cacahuatl: i checked the sha256 on the torproject.org website that shows all checksums
not just via the text file
but ill check the sig too
gpg: keyserver receive failed: No keyserver available
this was the command: gpg --keyserver x-hkp://pool.sks-keyservers.net --recv-keys 0x4E2C6E8793298290
cacahuatl
depends on your gpg version :) unfortunately it's not very consistent, try just removing the keyserver option and using the default one
user476
so cacahuatl left but the sig is good
however gpg shows only 2 subkeys when checking the key fingerprint and 1 subkey when verifying sig, while torproject webpage shows 3, but i guess this is not an issue
all the subkeys are valid
torQUES
configure: Transparent proxy support enabled, but missing headers.
configure: exit 0
$ make check
make: *** No rule to make target `check'. Stop.
Tor v0.2.7.3-rc (git-eb2188168e2eca96) running on Windows XP with Libevent 2.0.22-stable, OpenSSL 1.0.2d and Zlib 1.2.8.
nickm
torQUES: what options did you pass to configure (if any?)
torQUES
CPPFLAGS="-I/usr/local/include" LDFLAGS="-L/usr/local/lib" \
./configure --prefix=/usr/local --disable-asciidoc --enable-static-tor \
--with-libevent-dir=/usr/local/ \
--with-openssl-dir=/usr/local/ssl/ \
--with-zlib-dir=/usr/local/
it's a full static build
nickm
torQUES: hm. that seems strange
does that work for 0.2.7.2-alpha ? Does it work for 0.2.6.latest ?
torQUES
0.2.7.2-alpha and 0.2.7.2-alpha-dev yes
nickm
those both work?
do you know how to use git bisect?
torQUES
i didn't tested with previous versions
nickm
or , does current master work?
torQUES
works well
as a client and as a relay
0.2.7.2-alpha and 0.2.7.2-alpha-dev all tests OK but fail in backtrace test "assert" and "crash"
Tor v0.2.7.3-rc is stuck at "[notice] Bootstrapped 0%: Starting" but works
atlas and consensus health don'recognize this version
test-bt-cl.exe "crash" give violation in EAX-000000000
only test-bt-cl.exe "none" returns a negative value
nickm
test-bt-cl is supposed to crash, that's what it does
it's supposed to see if it can generate a stack trace
so current master builds, but the tarball doesn't build?
         

torQUES
i downloaded the rc from link you give here
nickm
right. And it didn't build right, but master does?
torQUES
make check doensn'y work
make: *** No rule to make target `check'. Stop.
nickm
does 'make' work?
torQUES
rest is ok
nickm
I bet configure failed so it will make nothing at all
so the makefile doesn't get generated
is that right?
torQUES
yes actually i run the built version
nickm
can you do "make clean" or does that fail too?
torQUES
just a moment
$ make clean
make: *** No rule to make target `clean'. Stop.
nickm
ok, so the makefile is messed up because configure failed, I think
torQUES
configure: exit 0
nickm
can you send me the complete output of running configure? paste.debian.net would be good
torQUES
i can send you the config.log
ok
nickm
thanks
nickm@torproject.org is fine, compression is lovely. Or tell me a URL
torQUES
nickm
if you do "make" now, does it work?
oh m g
you are running "make check"
and "make clean"
with your current directory == /usr/local/bin
cd /c/tor-0.2.7.3-rc then try again?
;)
torQUES
my fault i was in other path with msys bash ;-)
test works
nickm
ok cool
glad we could figure that out!
torQUES
I'll send you the tests too - in minutes
I included in tor.exe the latest stable libs - all inclusive for win32
nickm
keen
« prev 1 2 3 4 next »