2.4
4.17

Baixar Tails 4.17

Enquanto o arquivo baixa, recomendamos que você leia as notas de lançamento do Tails 4.17 . Elas detalham todas as mudanças nesta nova versão: novas funcionalidades, problemas que foram solucionados, e problemas conhecidos que já foram identificados.

1.2Verify your download

For your security, always verify your download.

X

With an unverified download, you might:

How does the verification work?

Your BitTorrent client will automatically verify your download when it completes.

The verification below is optional for a BitTorrent download.

You have our Tails Verification extension installed.

Since December 2020, you can do the verification directly on the page. You don't need the Tails Verification anymore and can safely remove it.

See our statement about the deprecation of the Tails Verification extension.

You seem to have JavaScript disabled. To verify your download, you can either:

You seem to be using Internet Explorer. To verify your download, please use a different browser.

Verifying $FILENAME

Verification successful! ($FILENAME)

Verification failed! ($FILENAME)

X

Most likely, the verification failed because of an error or interruption during the download.

The verification also fails if you try to verify a different download than the latest version, Tails 4.17 .

Less likely, the verification might have failed because of a malicious download from our download mirrors or due to a network attack in your country or local network.

Downloading again is usually enough to fix this problem. Otherwise, please try downloading from a different place or a different computer.

How does the verification work?

Please try to download again…

Please try to download again…

Error selecting image.

Make sure that you select a USB image that is readable by your browser.

Make sure that you select an ISO image that is readable by your browser.

Retry…

Error downloading checksum file from our website.

Make sure that your browser is connected to the Internet.

Retry…

Error reading image $FILENAME.

Make sure that $FILENAME is readable by your browser.

Retry…

1.3Continue installing upgrading installing or upgrading

Verify using OpenPGP (optional)

If you know OpenPGP, you can also verify your download using an OpenPGP signature instead of, or in addition to, our verification in the browser or BitTorrent.

Download the OpenPGP signature for the Tails 4.17 USB image OpenPGP signature for the Tails 4.17 ISO image and save it to the same folder where you saved the image.

Basic OpenPGP verification

See instructions for basic OpenPGP verification.

This section provides simplified instructions:

In Windows with Gpg4win

  1. Download the OpenPGP signature for the Tails 4.17 USB image OpenPGP signature for the Tails 4.17 ISO image and save it to the same folder where you saved the image.

  2. Download the Tails signing key and import it into Gpg4win.

    See the Gpg4win documentation on importing keys.

  3. Verify the signature of the image that you downloaded.

    See the Gpg4win documentation on verifying signatures.

    Verify that the date of the signature is at most five days earlier than the latest version: 2021-03-23.

    If the following warning appears:

        Not enough information to check the signature validity.
        Signed on ... by tails@boum.org (Key ID: 0x58ACD84F
        The validity of the signature cannot be verified.
        

    Then the image is still correct according to the signing key that you downloaded. To remove this warning you need to authenticate the signing key through the OpenPGP Web of Trust.

In macOS using GPGTools

  1. Download the OpenPGP signature for the Tails 4.17 USB image OpenPGP signature for the Tails 4.17 ISO image and save it to the same folder where you saved the image.

  2. Download the Tails signing key and import it into GPGTools.

    See the GPGTools documentation on importing keys.

  3. Open Finder and navigate to the folder where you saved the image and the signature.

  4. Control-click on the image and choose ServicesOpenPGP: Verify Signature of File.

In Tails

Tails comes with the Tails signing key already imported.

  1. Download the OpenPGP signature for the Tails 4.17 USB image OpenPGP signature for the Tails 4.17 ISO image and save it to the same folder where you saved the image.

  2. Open the file browser and navigate to the folder where you saved the image and the signature.

  3. Right-click (on Mac, click with two fingers) on the signature and choose Open With Verify Signature.

  4. The verification of the image starts automatically:

  5. After the verification finishes, you should see a notification that the signature is good:

    Verify that the date of the signature is at most five days earlier than the latest version: 2021-03-23.

    If instead, you see a notification that the signature is valid but untrusted:

    Then the image is still correct according to the signing key that you downloaded. To remove this warning you need to authenticate the signing key through the OpenPGP Web of Trust.

Using the command line

  1. Download the OpenPGP signature for the Tails 4.17 USB image OpenPGP signature for the Tails 4.17 ISO image and save it to the same folder where you saved the image.

  2. Download the Tails signing key and import it into GnuPGP.

    To import the Tails signing key into GnuPGP, open a terminal and navigate to the folder where you saved the Tails signing key.

    Execute:

    gpg --import tails-signing.key

  3. In a terminal, navigate to the folder where you saved the image and the signature.

  4. Execute:

    TZ=UTC gpg --no-options --keyid-format long --verify tails-amd64-4.17.img.sig tails-amd64-4.17.img

    TZ=UTC gpg --no-options --keyid-format long --verify tails-amd64-4.17.iso.sig tails-amd64-4.17.iso

    The output of this command should be the following:

    gpg: Signature made Mon 22 Mar 2021 09:21:01 AM UTC
    gpg:                using EDDSA key CD4D4351AFA6933F574A9AFB90B2B4BD7AED235F
    gpg: Good signature from "Tails developers (offline long-term identity key) <tails@boum.org>" [full]
    gpg:                 aka "Tails developers <tails@boum.org>" [full]

    gpg: Signature made Mon 22 Mar 2021 09:20:44 AM UTC
    gpg:                using EDDSA key CD4D4351AFA6933F574A9AFB90B2B4BD7AED235F
    gpg: Good signature from "Tails developers (offline long-term identity key) <tails@boum.org>" [full]
    gpg:                 aka "Tails developers <tails@boum.org>" [full]

    Verify that the date of the signature is at most five days earlier than the latest version: 2021-03-23.

    If the output also includes:

    gpg: WARNING: This key is not certified with a trusted signature!
    gpg: There is no indication that the signature belongs to the owner.

    Then the image is still correct according to the signing key that you downloaded. To remove this warning you need to authenticate the signing key through the OpenPGP Web of Trust.

Authenticate the signing key through the OpenPGP Web of Trust

Authenticating our signing key through the OpenPGP Web of Trust is the only way that you can be protected in case our website is compromised or if you are a victim of a man-in-the-middle attack. However, it is complicated to do and it might not be possible for everyone because it relies on trust relationships between individuals.

Read more about authenticating the Tails signing key through the OpenPGP Web of Trust.

The verification techniques that we present (verification in the browser, BitTorrent, or OpenPGP verification) all rely on some information being securely downloaded using HTTPS from our website:

  • The checksum for the verification in the browser
  • The Torrent file for BitTorrent
  • The Tails signing key for OpenPGP verification

It is possible that you could download malicious information if our website is compromised or if you are a victim of a man-in-the-middle attack.

OpenPGP verification is the only technique that protects you if our website is compromised or if you are a victim of a man-in-the-middle attack. But, for that you need to authenticate the Tails signing key through the OpenPGP Web of Trust.

If you are verifying an image from inside Tails, for example, to do a manual upgrade, then you already have the Tails signing key. You can trust this signing key as much as you already trust your Tails installation since this signing key is included in your Tails installation.

One of the inherent problems of standard HTTPS is that the trust put in a website is defined by certificate authorities: a hierarchical and closed set of companies and governmental institutions approved by your web browser vendor. This model of trust has long been criticized and proved several times to be vulnerable to attacks as explained on our warning page.

We believe that, instead, users should be given the final say when trusting a website, and that designation of trust should be done on the basis of human interactions.

The OpenPGP Web of Trust is a decentralized trust model based on OpenPGP keys that can help with solving this problem. Let's see this with an example:

  1. You are friends with Alice and you really trust her way of making sure that OpenPGP keys actually belong to their owners.
  2. Alice met Bob, a Tails developer, in a conference and certified Bob's key as actually belonging to Bob.
  3. Bob is a Tails developer who directly owns the Tails signing key. So, Bob has certified the Tails signing key as actually belonging to Tails.

In this scenario, you found, through Alice and Bob, a path to trust the Tails signing key without the need to rely on certificate authorities.

If you are on Debian, Ubuntu, or Linux Mint, you can install the debian-keyring package which contains the OpenPGP keys of all Debian developers. Some Debian developers have certified the Tails signing key and you can use these certifications to build a trust path. This technique is explained in detail in our instructions on installing Tails from Debian, Ubuntu, or Linux Mint using the command line.

Relying on the Web of Trust requires both caution and intelligent supervision by the users. The technical details are outside of the scope of this document.

Since the Web of Trust is based on actual human relationships and real-life interactions, it is best to get in touch with people knowledgeable about OpenPGP and build trust relationships in order to find your own trust path to the Tails signing key.

After you build a trust path, you can certify the Tails signing key by signing it with your own key to get rid of some warnings during the verification process.