restructure verification page (#3893, #17413) by traumschule · Pull Request #31 · torproject/webwml

traumschule · 2018-08-26T09:10:22Z

http://ea5faa5po25cf7fb.onion/projects/tor/ticket/3893

Current plan is to collapse the page with a css-only accordion and split it in basic steps

introduction
install gpg
download signing key
verify gpg signature
verify checksums

Each section will have OS specific instructions. When all sections are collapsed at the beginning and users only open what they are interested in, my hope is the page will be much less confusing.
According to browser support for CSS3 properties the used transition feature is not supported by browsers older than: IE 10, FF 16, Chrome 26, Safari 6.1 and Opera 12.1

docs/en/verifying-signatures.wml

teor2345 · 2018-08-28T13:12:59Z

docs/en/verifying-signatures.wml

+
+    <p>The next step is to use GnuPG to import the key that signed
+    your package. The Tor Browser team signs Tor Browser releases. Import its
+    key (0x4E2C6E8793298290) by starting the terminal under "Applications"


Terminal.app is in Applications/Utilities on macOS

teor2345 · 2018-08-28T13:13:18Z

docs/en/verifying-signatures.wml

+    <h3>Import OpenPGP key on Linux</h3>
+    <p>
+    You need to have GnuPG installed before you can verify
+    signatures. It's probably GnuPG is alreadyy installed on your


Typo: alreadyy

docs/en/verifying-signatures.wml

teor2345 · 2018-08-28T13:16:55Z

docs/en/verifying-signatures.wml

-      Key fingerprint = A430 0A6B C93C 0877 A445  1486 D148 3FA6 C3C0 7136
-sub   rsa4096/0xEB774491D9FF06E2 2018-05-26 [S] [expires: 2020-09-12]
-      Key fingerprint = 1107 75B5 D101 FB36 BC6C  911B EB77 4491 D9FF 06E2
+gpg: assuming signed data in 'tor-browser-osx64-<version-torbrowserbundleosx64>_en-US.tar.xz'


This is the Linux file name

thanks for catching this!

docs/en/verifying-signatures.wml

teor2345 · 2018-08-28T13:19:10Z

docs/en/verifying-signatures.wml

@@ -210,113 +391,250 @@ Primary key fingerprint: EF6E 286D DA85 EA2A 4BA7  DE68 4E2C 6E87 9329 8290
    exchange key fingerprints.


For most of our users, international travel is really not the best method. We need to provide a better explanation here.

Good point, changing to "As international travel to meet the developer might be
unfeasable you are left with trusting other people who signed this key."

teor2345 · 2018-08-28T13:19:47Z

docs/en/verifying-signatures.wml

+   </label>
+  <article>
+    <p>
+    Note: This process does not work on OS X yet due to Apple's codesigning requirement.


Please consistently use "macOS" throughout the document

teor2345 · 2018-08-28T13:21:14Z

docs/en/verifying-signatures.wml

+    <input id="ac-4-1" name="accordion-4" type="radio" checked />
+   <article class="ac-os">
+    <!--<pre id="ttb-key">
+    > gpg.exe --keyserver pool.sks-keyservers.net --recv-keys 0x4E2C6E8793298290


These instructions duplicate earlier instructions, but they're also slightly different. Is there a better way?

This is commented because I assume at this point it is ok, to tell users reproduce above step to import the key by just telling the key id. I see no better option at the moment.

You should feel free to delete obsolete instructions.
We can always get them back out of git.

docs/en/verifying-signatures.wml

teor2345

Hi, just a few minor changes left.

I feel like this document is way too wordy, but that might be ok as a reference for advanced users.

docs/en/verifying-signatures.wml

teor2345 · 2018-08-30T07:45:06Z

docs/en/verifying-signatures.wml

-    to the developer. The best method is to meet the developer in person and
-    exchange key fingerprints.
+    to the developer. As international travel to meet the developer might be
+    unfeasable you are left with trusting other people who signed this key.


This explanation raises security concerns, but it doesn't tell people what they should do.

If you can't give people a useful action to take to improve their security, please just tell them to ignore the warning.

One useful action might be: "use another device or another internet connection to check the key fingerprints listed on the tor website at ..."

teor2345 · 2018-08-30T07:46:45Z

docs/en/verifying-signatures.wml

 <div>
   <article class="ac-os">
-     This process does not work on OS X yet due to Apple's codesigning requirement.
+     This process does not work on macOS yet due to Apple's codesigning requirement.


Please consistently use "OS X", "macOS", or "Mac OS X" throughout the document.

You could choose "macOS", because that's what Apple calls it now. Or you could match the Tor download page.

teor2345 · 2018-08-30T07:50:18Z

docs/en/verifying-signatures.wml

+    <input id="ac-4-1" name="accordion-4" type="radio" checked />
+   <article class="ac-os">
+    <!--<pre id="ttb-key">
+    > gpg.exe --keyserver pool.sks-keyservers.net --recv-keys 0x4E2C6E8793298290


You should feel free to delete obsolete instructions.
We can always get them back out of git.

teor2345 · 2018-08-30T07:50:22Z

docs/en/verifying-signatures.wml

+  <div>
+   <input id="ac-4-3" name="accordion-4" type="radio" />
+   <article class="ac-os ac-4-3">
+    <!--<pre id="ttb-key">


You should feel free to delete obsolete instructions.
We can always get them back out of git.

hiromipaw · 2018-09-04T16:03:37Z

Hey, could you just resolve conflicts before I merge this?

traumschule · 2018-09-05T10:03:57Z

rebased.

@teor2345 sorry, lost your comments through push -f. Something above is still unresolved.

I feel like this document is way too wordy, but that might be ok as a reference for advanced users.

Maybe that's ok because we (hopefully) soon have are shorter version in the tb-manual:
http://ea5faa5po25cf7fb.onion/projects/tor/ticket/9843

traumschule · 2018-10-12T08:56:49Z

squashed commits to docs/en/verification.wml into one and removed unrelated changes to make reviewing easier.

- add TOC - only show instructions for selected OS - improve usability of MacOS installation process (#17413) - Add instructions how to verify signatures on Android (#27514)

traumschule · 2018-10-24T15:21:17Z

updated css.
@teor2345 are you still requesting changes here?

The review is outdated.

traumschule force-pushed the verification branch from a2ab6fb to b77b1d9 Compare August 26, 2018 15:01

teor2345 reviewed Aug 28, 2018

View reviewed changes

docs/en/verifying-signatures.wml Outdated Show resolved Hide resolved

teor2345 reviewed Aug 28, 2018

View reviewed changes

docs/en/verifying-signatures.wml Show resolved Hide resolved

teor2345 reviewed Aug 28, 2018

View reviewed changes

docs/en/verifying-signatures.wml Show resolved Hide resolved

teor2345 reviewed Aug 28, 2018

View reviewed changes

docs/en/verifying-signatures.wml Show resolved Hide resolved

teor2345 reviewed Aug 28, 2018

View reviewed changes

docs/en/verifying-signatures.wml Show resolved Hide resolved

teor2345 previously requested changes Aug 30, 2018

View reviewed changes

traumschule changed the title ~~WIP: verification (#3893)~~ restructure verification page (#3893, #17413) Aug 30, 2018

traumschule force-pushed the verification branch from 229ac12 to ec59f0b Compare September 5, 2018 09:56

traumschule force-pushed the verification branch 2 times, most recently from eb87916 to 3ed3936 Compare September 10, 2018 07:56

traumschule mentioned this pull request Sep 10, 2018

merge download pages into one (#14686) #12

Open

1 task

traumschule force-pushed the verification branch from 3ed3936 to 57d6d3e Compare October 12, 2018 08:54

traumschule force-pushed the verification branch from 57d6d3e to 411fa77 Compare October 12, 2018 09:13

add css accordion to verification page (#3893)

180b8f1

- add TOC - only show instructions for selected OS - improve usability of MacOS installation process (#17413) - Add instructions how to verify signatures on Android (#27514)

traumschule force-pushed the verification branch from 411fa77 to 180b8f1 Compare October 24, 2018 15:20

		@@ -210,113 +391,250 @@ Primary key fingerprint: EF6E 286D DA85 EA2A 4BA7 DE68 4E2C 6E87 9329 8290
		exchange key fingerprints.

Conversation

traumschule commented Aug 26, 2018 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

teor2345 left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

hiromipaw commented Sep 4, 2018

Uh oh!

traumschule commented Sep 5, 2018

Uh oh!

traumschule commented Oct 12, 2018

Uh oh!

traumschule commented Oct 24, 2018

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

traumschule commented Aug 26, 2018 •

edited

Loading