.. _downloadbundle:

``downloadbundle``
==================

.. note::

   This command requires the optional `txsocksx
   <https://github.com/habnabit/txsocksx>`_ library to be
   installed. Simply a ``pip install txsocksx``

The ``downloadbundle`` command figures out what the latest Tor Browser
Bundle is (from check.torproject.org), downloads the package for your
operating system and (optionally) extracts it. It has bundled
certificates for torproject.org and checks that the public keys are
the same. It also checks the signature on the downloaded bundle, using
bundled keys for Tor people or (optionally) the current user's GnuPG
keychain.

To use your own keychain, use ``--system-keychain`` (``-K``). By
default, the command builds a tempdir for GnuPG and imports the
bundled keys (of Tor people who typically sign the release) there.

Use ``--beta`` (``-b``) to download the latest Beta release instead
(if available).

Use ``--extract`` (``-e``) to extract the bundle after
downloading. You additionally need ``backports.lzma`` installed for
this to work.

If you're really feeling adventurous, don't have a system Tor running,
or can't install ``txsocksx`` for some reason, you can (completely
inadvisably) use ``--use-clearnet`` to download over the plain
Internet. Of course, you still get the certificate pins and signature
checking.



Examples
--------

.. sourcecode::
   console

   $ carml downloadbundle -e
   Getting recommended versions from "https://check.torproject.org/RecommendedTBBVersions".
      3.6-Linux, 3.6-MacOS, 3.6-Windows, 3.6.1-Linux, 3.6.1-MacOS,
      3.6.1-Windows
   tor-browser-linux64-3.6.1_en-US.tar.xz.asc: already exists, so not downloading.
   tor-browser-linux64-3.6.1_en-US.tar.xz: already exists, so not downloading.
   gpg: Signature made Tue 06 May 2014 05:37:07 PM MDT using RSA key ID 63FEE659
   gpg: Good signature from "Erinn Clark <erinn@torproject.org>"
   gpg:                 aka "Erinn Clark <erinn@debian.org>"
   gpg:                 aka "Erinn Clark <erinn@double-helix.org>"
   gpg: WARNING: This key is not certified with a trusted signature!
   gpg:          There is no indication that the signature belongs to the owner.
   Primary key fingerprint: 8738 A680 B84B 3031 A630  F2DB 416F 0610 63FE E659
   Signature is good.
   Extracting "tor-browser-linux64-3.6.1_en-US.tar.xz"...
     decompressing...
      20% extracted
      40% extracted
      60% extracted
      80% extracted
     100% extracted
   Tor Browser Bundle downloaded and extracted.
   To run:
      ./tor-browser_en-US/start-tor-browser


Note that for users who have a valid trust-path to Erinn Clark, using
``--system-keychain`` would avoid the WARNING: from GnuPG.
