Hi, I just wanted to verify this is legit as I’ve no idea how to check the PGP signature of an apk.
File: tor-browser-11.0.12-android-armv7-multi.apk
From: Tor Project | Download
SHA256: 950df58885a5e9e285869ea69861f72a7f7e0c00d35e55f61cb2cee689e58a95
MD5: b957d88dfe71338eccea4ebcab0739af
Thanks
The safest way to verify it is to compare the SHA256 checksum with the one published by the Tor Project. If the SHA256 matches exactly, that confirms the file hasn’t been altered since it was published.
For PGP verification, you’ll need the Tor Project’s signing key and a tool such as GPG. You don’t need to know anything about APKs specifically—the signature verifies the file itself.
I’d rely on the SHA256/PGP verification rather than the MD5 hash, since MD5 is no longer considered secure for this purpose.