diff --git a/docs/en/verifying-signatures.wml b/docs/en/verifying-signatures.wml index 9d586e56..2629ff3f 100644 --- a/docs/en/verifying-signatures.wml +++ b/docs/en/verifying-signatures.wml @@ -59,6 +59,9 @@ of which developer signs which package, see our signing keys page.

+ Download the bundle and the signature + +

Windows


@@ -68,24 +71,19 @@

Once it's installed, use GnuPG to import the key that signed your package. Since GnuPG for Windows is a command-line tool, you will need - to use cmd.exe. Unless you edit your PATH environment variable, - you will need to tell Windows the full path to the GnuPG program. If - you installed GnuPG with the default values, the path should be - something like this: C:\Program Files\Gnu\GnuPg\gpg.exe.

- -

Note for Windows 8 Users: Your GnuPG binary is probably - located at C:\Program Files (x86)\Gnu\GnuPg\gpg2.exe. You should replace - all of the commands below with this path instead.

+ to use cmd.exe.

+ cmd.exe +

Erinn Clark signs the Tor Browser Bundles. Import her key - (0x416F061063FEE659) by starting cmd.exe and typing:

+ (0x63FEE659) by starting cmd.exe and typing:

-
"C:\Program Files\Gnu\GnuPg\gpg.exe" --keyserver x-hkp://pool.sks-keyservers.net --recv-keys 0x416F061063FEE659
+
gpg --keyserver hkp://keys.gnupg.net --recv-keys 0x63FEE659
-

After importing the key, you can verify that the fingerprint +

Note that Windows 8 users may need to type gpg2 rather than gpg.
After importing the key, you can verify that the fingerprint is correct:

-
"C:\Program Files\Gnu\GnuPg\gpg.exe" --fingerprint 0x416F061063FEE659
+
gpg --fingerprint 0x63FEE659

You should see:

@@ -100,8 +98,9 @@
     

To verify the signature of the package you downloaded, you will need to download the ".asc" file as well. Assuming you downloaded the package and its signature to your Desktop, run:

- -
"C:\Program Files\Gnu\GnuPg\gpg.exe" --verify C:\Users\Alice\Desktop\tor-browser-_en-US.exe.asc C:\Users\Alice\Desktop\tor-browser-_en-US.exe
+ +
cd Desktop
+
gpg --verify tor-browser-< VERSION NUMBER >_en-US.exe.asc tor-browser-< VERSION NUMBER >_en-US.exe

The output should say "Good signature":

@@ -122,7 +121,8 @@ to the developer. The best method is to meet the developer in person and exchange key fingerprints.

- + Verify the signature +

Mac OS X