[Pkg-privacy-maintainers] Bug#845989: browser can't be downloaded because of invalid SSL certificate

[Mikhail Kshevetskiy]

Package: torbrowser-launcher
Version: 0.2.6-2
Severity: grave
Tags: upstream

Trying to start torbrowser for the first time produce the following message

    The SSL certificate served by https://www.torproject.org is invalid!
    You may be under attack.

After that the program terminate. Running it from terminal results in the
following console output:

Tor Browser Launcher
By Micah Lee, licensed under MIT
version 0.2.6
https://github.com/micahflee/torbrowser-launcher
Downloading over Tor
Downloading and installing Tor Browser for the first time.
Downloading https://dist.torproject.org/torbrowser/update_2/release/Linux_x86_64-gcc3/x/en-US
Download error: [<twisted.python.failure.Failure OpenSSL.SSL.Error: [('SSL routines', 'ssl3_get_server_certificate', 'certificate verify failed')]>] <class 'twisted.web._newclient.ResponseNeverReceived'>


-- System Information:
Debian Release: stretch/sid
  APT prefers testing
  APT policy: (990, 'testing'), (500, 'unstable'), (1, 'experimental')
Architecture: amd64 (x86_64)
Foreign Architectures: i386

Kernel: Linux 4.8.0-1-amd64 (SMP w/2 CPU cores)
Locale: LANG=ru_RU.UTF8, LC_CTYPE=ru_RU.UTF8 (charmap=UTF-8)
Shell: /bin/sh linked to /bin/bash
Init: systemd (via /run/systemd/system)

Versions of packages torbrowser-launcher depends on:
ii  ca-certificates  20161102
ii  gnupg            2.1.16-2
ii  python-gtk2      2.24.0-5.1
ii  python-lzma      0.5.3-3
ii  python-parsley   1.2-1
ii  python-psutil    4.3.1-1
ii  python-twisted   16.5.0-1
ii  python-txsocksx  1.15.0.2-1
pn  python:any       <none>
ii  wmctrl           1.07-7

Versions of packages torbrowser-launcher recommends:
ii  tor  0.2.8.9-1

Versions of packages torbrowser-launcher suggests:
pn  apparmor       <none>
pn  python-pygame  <none>

-- no debconf information