Arch Linux User Repository

Before running makepkg, you must do this (as normal user):

$ gpg --auto-key-locate nodefault,wkd --locate-keys torbrowser@torproject.org

If you want to update tor-browser from AUR without AUR helpers you can run in a terminal:

$ tor-browser -u

==> Verifying source file signatures with gpg... tor-browser-linux64-11.0.3_en-US.tar.xz ... FAILED (unknown public key E53D989A9E2D47BF) ==> ERROR: One or more PGP signatures could not be verified! -> error making: tor-browser

$ makepkg -scf
==> Making package: tor-browser 11.0.3-1 (2021-12-22T14:46:30 CET)
==> Checking runtime dependencies...
==> Checking buildtime dependencies...
==> Retrieving sources...
  -> Found tor-browser.desktop.in
  -> Found tor-browser.in
  -> Found tor-browser.png
  -> Found tor-browser.svg
  -> Downloading tor-browser-linux64-11.0.3_en-US.tar.xz...
  % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
                                 Dload  Upload   Total   Spent    Left  Speed
100 82.2M  100 82.2M    0     0  7669k      0  0:00:10  0:00:10 --:--:-- 8467k
  -> Downloading tor-browser-linux64-11.0.3_en-US.tar.xz.asc...
  % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
                                 Dload  Upload   Total   Spent    Left  Speed
100   819  100   819    0     0   1705      0 --:--:-- --:--:-- --:--:--  1702
==> Validating source files with sha256sums...
    tor-browser.desktop.in ... Passed
    tor-browser.in ... Passed
    tor-browser.png ... Passed
    tor-browser.svg ... Passed
==> Validating source_x86_64 files with sha256sums...
    tor-browser-linux64-11.0.3_en-US.tar.xz ... Passed
    tor-browser-linux64-11.0.3_en-US.tar.xz.asc ... Skipped
==> Verifying source file signatures with gpg...
    tor-browser-linux64-11.0.3_en-US.tar.xz ... FAILED (unknown public key E53D989A9E2D47BF)
==> ERROR: One or more PGP signatures could not be verified!

but

$ gpg --auto-key-locate nodefault,wkd --locate-keys torbrowser@torproject.org
pub   rsa4096/0x4E2C6E8793298290 2014-12-15 [C] [expires: 2025-07-21]
      Key fingerprint = EF6E 286D DA85 EA2A 4BA7  DE68 4E2C 6E87 9329 8290
uid                   [  full  ] Tor Browser Developers (signing key) <torbrowser@torproject.org>

The .SRCINFO file has invalid checksums, and AUR helpers (paru in my case) complain about this:

    source_i686 = https://dist.torproject.org/torbrowser/11.0.2/tor-browser-linux32-11.0.2_en-US.tar.xz
    source_i686 = https://dist.torproject.org/torbrowser/11.0.2/tor-browser-linux32-11.0.2_en-US.tar.xz.asc
    sha256sums_i686 =
    sha256sums_i686 = SKIP
    source_x86_64 = https://dist.torproject.org/torbrowser/11.0.2/tor-browser-linux64-11.0.2_en-US.tar.xz
    source_x86_64 = https://dist.torproject.org/torbrowser/11.0.2/tor-browser-linux64-11.0.2_en-US.tar.xz.asc
    sha256sums_x86_64 =
    sha256sums_x86_64 = SKIP

An empty string is not a valid value.

Running mksrcinfo fixes this.

Lines 42 and 46 of .SRCINFO are causing issues when trying to install with paru because they have a key with no value. I'm not sure why they're there. When I run makepkg --printsrcinfo those lines aren't present. Those lines where added in the most recent commit FYI.

Can you change the desktop file from

Exec=/usr/bin/tor-browser %u

To:

Exec=tor-browser %u

This makes using wrapper scripts or things like firejail a bit smoother, but won't change anything for the usual use-case.

@aminvakil Fair point.

bash is part of base. Mentioning it explicitly in depends is unnecessary imho.

https://archlinux.org/packages/core/any/base/

~/.local/opt/tor-browser is fine by me.

It's not completely standard, but I've also seen it around, and is basically a "per-user /opt".

Using .cache is also valid IMHO, and this case is slightly outside of what any spec or standard has explicitly considered.

A downside of ~/.local/opt is that there's no way to override it, whereas .cache is actually $XDG_CACHE_HOME.

.config is a bad choice though; that's a directory that'll frequently get backed up (or even versioned by many), and dumping all of the browser's runtime in there sounds problematic.

@class101

I don’t think it was a great idea to create opt/ inside .local since it is not a standard location

This is the old debate about the ~/.local directory...

Is ~/.local/bin standard? The XDG mentions it ("User-specific executable files may be stored in $HOME/.local/bin").

What about ~/.local/lib? The XDG does not mention it, but it is the natural result of installing a library instead of a program locally via ./configure --prefix="$HOME/.local" && make && make install – the same command that would install a program under the ~/.local/bin path mentioned by the XDG.

For me this package's natural path is ~/.local/opt: it satisfies the requirements for opt (it is completely self-contained in one single directory) and it satisfies the requirements for ~/.local (it is a user installation).

But given the huge user base of this package, I would say that the debate has just started.

Application creates their folders in

.local .config .cache

Technically we do create our folder under .local.