[tor-talk] Bad signature of tor expert bundle

[Lu Wei]

On Wed, Apr 28, 2021 at 10:28 PM Matthew Finkel <sysrqb at torproject.org> wrote:
>
> On Mon, Apr 26, 2021 at 10:12:04PM +0800, Lu Wei wrote:
> > Could anyone verify Tor bundle at
> > http://web.archive.org/web/20210222205405/https://www.torproject.org/download/tor/
> > ? I got a "Bad signature". The zip file tor-win32-0.4.4.6.zip seems
> > work though. its SHA1: 4F8BBC9B79A1B03197C9444391105E28B19DE3FF could
> > be found in Virustotal. The direct link is
> > http://web.archive.org/web/20210222205405/https://www.torproject.org/dist/torbrowser/10.0.10/tor-win32-0.4.4.6.zip
>
> Hi! Do you need an old version of the Windows Expert Bundle? If you
> don't need an old version, then you should download the most recent one:
> https://www.torproject.org/dist/torbrowser/10.0.16/tor-win32-0.4.5.7.zip
> https://www.torproject.org/dist/torbrowser/10.0.16/tor-win32-0.4.5.7.zip.asc
>
I need a most recent version of the Windows Expert Bundle that could
run on Windows XP. Version 0.4.5.7 do not work for me.

> When I download the .asc file for 0.4.4.6 from archive.org, the file is
> empty.
>
> The version 0.4.4.6 package is available from Tor's archive site, and
> the signature is valid:
> https://archive.torproject.org/tor-package-archive/torbrowser/10.0.10/tor-win32-0.4.4.6.zip
> https://archive.torproject.org/tor-package-archive/torbrowser/10.0.10/tor-win32-0.4.4.6.zip.asc
>
Yes, but my point is why there are two tor-win32-0.4.4.6.zip files. Is
there anything wrong with the file on archive.org? That would cast a
cloud of suspicion on archive.org's credibility.

-- 
Regards,
Lu Wei
IM:     xmpp:luweitest at riotcat.org
PGP:    0xA12FEF7592CCE1EA