| Git Clone URL: | https://aur.archlinux.org/tor-browser-bin.git (read-only, click to copy) |
|---|---|
| Package Base: | tor-browser-bin |
| Description: | Tor Browser Bundle: anonymous browsing using Firefox and Tor |
| Upstream URL: | https://www.torproject.org/projects/torbrowser.html |
| Licenses: | MPL-2.0 |
| Conflicts: | tor-browser |
| Provides: | tor-browser |
| Submitter: | FabioLolix |
| Maintainer: | grufo (jugs) |
| Last Packager: | jugs |
| Votes: | 1280 |
| Popularity: | 1.05 |
| First Submitted: | 2023-09-24 17:45 (UTC) |
| Last Updated: | 2024-12-06 14:48 (UTC) |
"tor-browser -u" doesn't work:
"==> Verifying source file signatures with gpg... tor-browser-linux64-11.0.3_en-US.tar.xz ... FAILED (unknown public key E53D989A9E2D47BF) ==> ERROR: One or more PGP signatures could not be verified! "
Thankfully "gpg --auto-key-locate nodefault,wkd --locate-keys torbrowser@torproject.org " does.
Upstream has added another subkey to the same GPG key, so it needs to be pulled. The pinned command does this, and you need to run it even if you already have the key pulled locally (this is rather unintuitive, hence the clarification).
AUR helpers generally don't do this for you.
@miku86 In case of Darkness yes, but as explained a bit below by @zethra there seems to be another problem which should affect most people updating with AUR helpers.
However you can manually update without the AUR helpers running "tor-browser -u" as normal user. See comment by @zethra for explanations.
@Darkness
The solution is in the pinned comments.
==> Verifying source file signatures with gpg... tor-browser-linux64-11.0.3_en-US.tar.xz ... FAILED (unknown public key E53D989A9E2D47BF) ==> ERROR: One or more PGP signatures could not be verified! -> error making: tor-browser
$ makepkg -scf
==> Making package: tor-browser 11.0.3-1 (2021-12-22T14:46:30 CET)
==> Checking runtime dependencies...
==> Checking buildtime dependencies...
==> Retrieving sources...
-> Found tor-browser.desktop.in
-> Found tor-browser.in
-> Found tor-browser.png
-> Found tor-browser.svg
-> Downloading tor-browser-linux64-11.0.3_en-US.tar.xz...
% Total % Received % Xferd Average Speed Time Time Time Current
Dload Upload Total Spent Left Speed
100 82.2M 100 82.2M 0 0 7669k 0 0:00:10 0:00:10 --:--:-- 8467k
-> Downloading tor-browser-linux64-11.0.3_en-US.tar.xz.asc...
% Total % Received % Xferd Average Speed Time Time Time Current
Dload Upload Total Spent Left Speed
100 819 100 819 0 0 1705 0 --:--:-- --:--:-- --:--:-- 1702
==> Validating source files with sha256sums...
tor-browser.desktop.in ... Passed
tor-browser.in ... Passed
tor-browser.png ... Passed
tor-browser.svg ... Passed
==> Validating source_x86_64 files with sha256sums...
tor-browser-linux64-11.0.3_en-US.tar.xz ... Passed
tor-browser-linux64-11.0.3_en-US.tar.xz.asc ... Skipped
==> Verifying source file signatures with gpg...
tor-browser-linux64-11.0.3_en-US.tar.xz ... FAILED (unknown public key E53D989A9E2D47BF)
==> ERROR: One or more PGP signatures could not be verified!
but
$ gpg --auto-key-locate nodefault,wkd --locate-keys torbrowser@torproject.org
pub rsa4096/0x4E2C6E8793298290 2014-12-15 [C] [expires: 2025-07-21]
Key fingerprint = EF6E 286D DA85 EA2A 4BA7 DE68 4E2C 6E87 9329 8290
uid [ full ] Tor Browser Developers (signing key) <torbrowser@torproject.org>
The .SRCINFO file has invalid checksums, and AUR helpers (paru in my case) complain about this:
source_i686 = https://dist.torproject.org/torbrowser/11.0.2/tor-browser-linux32-11.0.2_en-US.tar.xz
source_i686 = https://dist.torproject.org/torbrowser/11.0.2/tor-browser-linux32-11.0.2_en-US.tar.xz.asc
sha256sums_i686 =
sha256sums_i686 = SKIP
source_x86_64 = https://dist.torproject.org/torbrowser/11.0.2/tor-browser-linux64-11.0.2_en-US.tar.xz
source_x86_64 = https://dist.torproject.org/torbrowser/11.0.2/tor-browser-linux64-11.0.2_en-US.tar.xz.asc
sha256sums_x86_64 =
sha256sums_x86_64 = SKIP
An empty string is not a valid value.
Running mksrcinfo fixes this.
Lines 42 and 46 of .SRCINFO are causing issues when trying to install with paru because they have a key with no value. I'm not sure why they're there. When I run makepkg --printsrcinfo those lines aren't present. Those lines where added in the most recent commit FYI.
Can you change the desktop file from
Exec=/usr/bin/tor-browser %u
To:
Exec=tor-browser %u
This makes using wrapper scripts or things like firejail a bit smoother, but won't change anything for the usual use-case.
Pinned Comments
grufo commented on 2019-08-15 02:22 (UTC)
Before running
makepkg, you must do this (as normal user):$ gpg --auto-key-locate nodefault,wkd --locate-keys torbrowser@torproject.orgIf you want to update tor-browser from AUR without AUR helpers you can run in a terminal:
$ tor-browser -u