We have a number of signing keys used for signing software releases. There are a number of different keys because there are a number of different ways of signing software. This list aims to be the comprehensive list of all the release signing keys that we use.
OpenPGP
We sign all of our releases using OpenPGP detached binary signatures in a .sig file.
People signing official releases
- Hans-Christoph Steiner <hans@guardianproject.info>
5E61 C878 0F86 295C E17D 8677 9F0F E587 374B BE81 - Nathan Freitas <nathan@guardianproject.info>
BBE2 0FD6 DA48 A3DD 4CC7 DF41 A801 183E 69B3 7AA9 - Abel Luck <abel@guardianproject.info>
1893 0780 A043 3A61 B8B2 17D6 97D0 5003 DA73 1A17
Keys from the build servers
- build@halfparanoid <root@guardianproject.info>
6F57 3CDC 0E19 0E0F 4C0A B155 2A1E 2A34 308D 1650 - build@semiparanoid <root@guardianproject.info>
C85A 83E6 BE71 EA3C 8BA2 FB16 3C09 66BA 8107 9F68
Launchpad Ubuntu Package Archive (PPA)
For easy installation on Ubuntu/Mint/etc. of our official releases, as well as backported software that we use, we have an Launchpad PPA with its own signing key provided by Launchpad:
Android APK
We currently have two signing keys: a 4096-bit RSA key used for all new apps, and a 1024-bit RSA key that we use for all apps that we first released before 2014. You can download the whole public keys and verify it using the OpenPGP signature:
4096-bit RSA
- guardianproject-rsa4096-signing-certificate.pem
- guardianproject-rsa4096-signing-certificate.pem.sig
- guardianproject-rsa4096-signing-publickey.pem
- guardianproject-rsa4096-signing-publickey.pem.sig
-
You can see a survey of APKs signed by this key on Android Observatory:
https://androidobservatory.org/cert/4CB3F539F63B32ACA13B4450638D605F531D4F4A
1024-bit RSA
- guardianproject-rsa1024-signing-key.cer
- guardianproject-rsa1024-signing-key.cer.sig
-
You can see a survey of APKs signed by this key on Android Observatory:
https://androidobservatory.org/cert/9F1960C9584FEE5E166419354985A2B5FE413570
FDroid Repo
Our official releases are also posted on our own FDroid repo, which is accessible at https://guardianproject.info/fdroid/repo. The signing key for that repo is available here:
- guardianproject-rsa4096-fdroid-repo-signing-key.pem
- guardianproject-rsa4096-fdroid-repo-signing-key.pem.sig
The fingerprints for this signing key are:
Owner: EMAILADDRESS=root@guardianproject.info, CN=guardianproject.info, O=Guardian Project, OU=FDroid Repo, L=New York, ST=New York, C=US Issuer: EMAILADDRESS=root@guardianproject.info, CN=guardianproject.info, O=Guardian Project, OU=FDroid Repo, L=New York, ST=New York, C=US Serial number: a397b4da7ecda034 Valid from: Thu Jun 26 15:39:18 EDT 2014 until: Sun Nov 10 14:39:18 EST 2041 Certificate fingerprints: MD5: 8C:BE:60:6F:D7:7E:0D:2D:B8:06:B5:B9:AD:82:F5:5D SHA1: 63:9F:F1:76:2B:3E:28:EC:CE:DB:9E:01:7D:93:21:BE:90:89:CD:AD SHA256: B7:C2:EE:FD:8D:AC:78:06:AF:67:DF:CD:92:EB:18:12:6B:C0:83:12:A7:F2:D6:F3:86:2E:46:01:3C:7A:61:35 Signature algorithm name: SHA1withRSA Version: 1
The key ID in the link for Nathan’s key does not match the fingerprint shown on the page. The link retrieves info for a revoked key.
Thanks for catching that! I updated the link. The printed out fingerprint was the correct key, which I have signed with my key.
Is it just me or are all the public key links (People signing official releases and Keys from the build servers) leading to error pages (not found)? Also the only still valid keys I found on a key server (pool.sks-keyservers.net) was Hans’, both Nathan’s and Abel’s keys have been revocated. I’m searching for the public key for this signature: https://f-droid.org/repo/org.torproject.android_109.apk.asc
Sounds like you are downloading old keys of ours. Be sure that you are downloading the keys matching our key IDs. There are multiple matches for our email addresses, including some of our old, revoked keys.