- tbb-commits - lists.torproject.org

[Git][tpo/applications/tor-browser][tor-browser-140.2.0esr-15.0-1] fixup! TB 41089: Add tor-browser build scripts + Makefile to tor-browser
by brizental (＠brizental) 02 Sep '25

02 Sep '25

brizental pushed to branch tor-browser-140.2.0esr-15.0-1 at The Tor Project / Applications / Tor Browser Commits: 1a52ef09 by Beatriz Rizental at 2025-09-02T10:17:09+02:00 fixup! TB 41089: Add tor-browser build scripts + Makefile to tor-browser - - - - - 1 changed file: - tools/torbrowser/fetch.sh Changes: ===================================== tools/torbrowser/fetch.sh ===================================== @@ -6,7 +6,7 @@ BINARIES_DIR="$1" # download the current downloads.json wget https://aus1.torproject.org/torbrowser/update_3/alpha/downloads.json # get url for latest alpha linux package -TOR_BROWSER_VERSION=$(grep -Eo "\"version\":\"[0-9.a]+\"" downloads.json | grep -Eo "[0-9.a]+") +TOR_BROWSER_VERSION=$(grep -Eo "\"version\"\s*:\s*\"[0-9.a]+\"" downloads.json | grep -Eo "[0-9.a]+") if [ "$(uname)" = "Darwin" ]; then TOR_BROWSER_PACKAGE="tor-browser-macos-${TOR_BROWSER_VERSION}.dmg" else View it on GitLab: https://gitlab.torproject.org/tpo/applications/tor-browser/-/commit/1a52ef0… -- View it on GitLab: https://gitlab.torproject.org/tpo/applications/tor-browser/-/commit/1a52ef0… You're receiving this email because of your account on gitlab.torproject.org.

1 0

[Git][tpo/applications/tor-browser-build][main] Bug 41522: Fix issue in tools/signing/do-all-signing
by boklm (＠boklm) 01 Sep '25

01 Sep '25

boklm pushed to branch main at The Tor Project / Applications / tor-browser-build Commits: f444b714 by Nicolas Vigier at 2025-09-01T17:58:11+02:00 Bug 41522: Fix issue in tools/signing/do-all-signing Fix issue introduced in 821c192ed9def86b92a20bc8878a7c519230996f. - - - - - 1 changed file: - tools/signing/do-all-signing Changes: ===================================== tools/signing/do-all-signing ===================================== @@ -285,6 +285,6 @@ do_step download-unsigned-sha256sums-gpg-signatures-from-people-tpo do_step sync-local-to-staticiforme do_step sync-scripts-to-staticiforme do_step staticiforme-prepare-cdn-dist-upload -[ "$SIGNING_PROJECTNAME" != 'torvpn' ] && ! is_legacy \ +[ "$SIGNING_PROJECTNAME" != 'torvpn' ] && ! is_legacy && \ do_step upload-update_responses-to-staticiforme do_step finished-signing-clean-linux-signer View it on GitLab: https://gitlab.torproject.org/tpo/applications/tor-browser-build/-/commit/f… -- View it on GitLab: https://gitlab.torproject.org/tpo/applications/tor-browser-build/-/commit/f… You're receiving this email because of your account on gitlab.torproject.org.

1 0

[Git][tpo/applications/mullvad-browser-update-responses][main] 4 commits: alpha: new version, 15.0a2 (linux-x86_64)
by ma1 (＠ma1) 01 Sep '25

01 Sep '25

ma1 pushed to branch main at The Tor Project / Applications / mullvad-browser-update-responses Commits: 5f7d18b5 by hackademix at 2025-09-01T17:57:52+02:00 alpha: new version, 15.0a2 (linux-x86_64) - - - - - a6cd7410 by hackademix at 2025-09-01T17:57:52+02:00 alpha: new version, 15.0a2 (macos) - - - - - 15bad32d by hackademix at 2025-09-01T17:57:53+02:00 alpha: new version, 15.0a2 (windows-x86_64) - - - - - 3b5a988b by hackademix at 2025-09-01T17:57:53+02:00 alpha: new version, 15.0a2 - - - - - 31 changed files: - update_1/alpha/download-linux-x86_64.json - update_1/alpha/download-macos.json - update_1/alpha/download-windows-x86_64.json - update_1/alpha/downloads.json - update_1/alpha/linux-x86_64/.htaccess - − update_1/alpha/linux-x86_64/update-14.5a4-15.0a1-linux-x86_64.xml - − update_1/alpha/linux-x86_64/update-14.5a5-15.0a1-linux-x86_64.xml - + update_1/alpha/linux-x86_64/update-14.5a5-15.0a2-linux-x86_64.xml - − update_1/alpha/linux-x86_64/update-14.5a6-15.0a1-linux-x86_64.xml - + update_1/alpha/linux-x86_64/update-14.5a6-15.0a2-linux-x86_64.xml - + update_1/alpha/linux-x86_64/update-15.0a1-15.0a2-linux-x86_64.xml - − update_1/alpha/linux-x86_64/update-15.0a1-linux-x86_64.xml - + update_1/alpha/linux-x86_64/update-15.0a2-linux-x86_64.xml - update_1/alpha/macos/.htaccess - − update_1/alpha/macos/update-14.5a4-15.0a1-macos.xml - − update_1/alpha/macos/update-14.5a5-15.0a1-macos.xml - + update_1/alpha/macos/update-14.5a5-15.0a2-macos.xml - − update_1/alpha/macos/update-14.5a6-15.0a1-macos.xml - + update_1/alpha/macos/update-14.5a6-15.0a2-macos.xml - + update_1/alpha/macos/update-15.0a1-15.0a2-macos.xml - − update_1/alpha/macos/update-15.0a1-macos.xml - + update_1/alpha/macos/update-15.0a2-macos.xml - update_1/alpha/windows-x86_64/.htaccess - − update_1/alpha/windows-x86_64/update-14.5a4-15.0a1-windows-x86_64.xml - − update_1/alpha/windows-x86_64/update-14.5a5-15.0a1-windows-x86_64.xml - + update_1/alpha/windows-x86_64/update-14.5a5-15.0a2-windows-x86_64.xml - − update_1/alpha/windows-x86_64/update-14.5a6-15.0a1-windows-x86_64.xml - + update_1/alpha/windows-x86_64/update-14.5a6-15.0a2-windows-x86_64.xml - + update_1/alpha/windows-x86_64/update-15.0a1-15.0a2-windows-x86_64.xml - − update_1/alpha/windows-x86_64/update-15.0a1-windows-x86_64.xml - + update_1/alpha/windows-x86_64/update-15.0a2-windows-x86_64.xml The diff was not included because it is too large. View it on GitLab: https://gitlab.torproject.org/tpo/applications/mullvad-browser-update-respo… -- View it on GitLab: https://gitlab.torproject.org/tpo/applications/mullvad-browser-update-respo… You're receiving this email because of your account on gitlab.torproject.org.

1 0

[Git][tpo/applications/tor-browser-update-responses][main] 6 commits: alpha: new version, 15.0a2 (linux-i686)
by ma1 (＠ma1) 01 Sep '25

01 Sep '25

ma1 pushed to branch main at The Tor Project / Applications / Tor Browser update responses Commits: dc9fa649 by hackademix at 2025-09-01T17:56:11+02:00 alpha: new version, 15.0a2 (linux-i686) - - - - - 25195a5a by hackademix at 2025-09-01T17:56:12+02:00 alpha: new version, 15.0a2 (linux-x86_64) - - - - - c7192a84 by hackademix at 2025-09-01T17:56:12+02:00 alpha: new version, 15.0a2 (macos) - - - - - 14a067ef by hackademix at 2025-09-01T17:56:13+02:00 alpha: new version, 15.0a2 (windows-i686) - - - - - 2d6691d8 by hackademix at 2025-09-01T17:56:13+02:00 alpha: new version, 15.0a2 (windows-x86_64) - - - - - 50e88572 by hackademix at 2025-09-01T17:56:14+02:00 alpha: new version, 15.0a2 - - - - - 43 changed files: - update_3/alpha/download-android-aarch64.json - update_3/alpha/download-android-armv7.json - update_3/alpha/download-android-x86.json - update_3/alpha/download-android-x86_64.json - update_3/alpha/download-linux-i686.json - update_3/alpha/download-linux-x86_64.json - update_3/alpha/download-macos.json - update_3/alpha/download-windows-i686.json - update_3/alpha/download-windows-x86_64.json - update_3/alpha/downloads.json - update_3/alpha/linux-i686/.htaccess - update_3/alpha/linux-i686/update-14.5a4-15.0a1-linux-i686.xml → update_3/alpha/linux-i686/update-14.5a5-15.0a2-linux-i686.xml - update_3/alpha/linux-i686/update-14.5a5-15.0a1-linux-i686.xml → update_3/alpha/linux-i686/update-14.5a6-15.0a2-linux-i686.xml - update_3/alpha/linux-i686/update-14.5a6-15.0a1-linux-i686.xml → update_3/alpha/linux-i686/update-15.0a1-15.0a2-linux-i686.xml - update_3/alpha/linux-i686/update-15.0a1-linux-i686.xml → update_3/alpha/linux-i686/update-15.0a2-linux-i686.xml - update_3/alpha/linux-x86_64/.htaccess - update_3/alpha/linux-x86_64/update-14.5a4-15.0a1-linux-x86_64.xml → update_3/alpha/linux-x86_64/update-14.5a5-15.0a2-linux-x86_64.xml - update_3/alpha/linux-x86_64/update-14.5a5-15.0a1-linux-x86_64.xml → update_3/alpha/linux-x86_64/update-14.5a6-15.0a2-linux-x86_64.xml - update_3/alpha/linux-x86_64/update-14.5a6-15.0a1-linux-x86_64.xml → update_3/alpha/linux-x86_64/update-15.0a1-15.0a2-linux-x86_64.xml - update_3/alpha/linux-x86_64/update-15.0a1-linux-x86_64.xml → update_3/alpha/linux-x86_64/update-15.0a2-linux-x86_64.xml - update_3/alpha/macos/.htaccess - update_3/alpha/macos/update-14.5a6-15.0a1-macos.xml → update_3/alpha/macos/update-14.5a5-15.0a2-macos.xml - update_3/alpha/macos/update-14.5a4-15.0a1-macos.xml → update_3/alpha/macos/update-14.5a6-15.0a2-macos.xml - update_3/alpha/macos/update-14.5a5-15.0a1-macos.xml → update_3/alpha/macos/update-15.0a1-15.0a2-macos.xml - update_3/alpha/macos/update-15.0a1-macos.xml → update_3/alpha/macos/update-15.0a2-macos.xml - update_3/alpha/windows-i686/.htaccess - − update_3/alpha/windows-i686/update-14.5a4-15.0a1-windows-i686.xml - − update_3/alpha/windows-i686/update-14.5a5-15.0a1-windows-i686.xml - + update_3/alpha/windows-i686/update-14.5a5-15.0a2-windows-i686.xml - − update_3/alpha/windows-i686/update-14.5a6-15.0a1-windows-i686.xml - + update_3/alpha/windows-i686/update-14.5a6-15.0a2-windows-i686.xml - + update_3/alpha/windows-i686/update-15.0a1-15.0a2-windows-i686.xml - − update_3/alpha/windows-i686/update-15.0a1-windows-i686.xml - + update_3/alpha/windows-i686/update-15.0a2-windows-i686.xml - update_3/alpha/windows-x86_64/.htaccess - − update_3/alpha/windows-x86_64/update-14.5a4-15.0a1-windows-x86_64.xml - − update_3/alpha/windows-x86_64/update-14.5a5-15.0a1-windows-x86_64.xml - + update_3/alpha/windows-x86_64/update-14.5a5-15.0a2-windows-x86_64.xml - − update_3/alpha/windows-x86_64/update-14.5a6-15.0a1-windows-x86_64.xml - + update_3/alpha/windows-x86_64/update-14.5a6-15.0a2-windows-x86_64.xml - + update_3/alpha/windows-x86_64/update-15.0a1-15.0a2-windows-x86_64.xml - − update_3/alpha/windows-x86_64/update-15.0a1-windows-x86_64.xml - + update_3/alpha/windows-x86_64/update-15.0a2-windows-x86_64.xml The diff was not included because it is too large. View it on GitLab: https://gitlab.torproject.org/tpo/applications/tor-browser-update-responses… -- View it on GitLab: https://gitlab.torproject.org/tpo/applications/tor-browser-update-responses… You're receiving this email because of your account on gitlab.torproject.org.

1 0

[Git][tpo/applications/tor-browser-build][main] 2 commits: Bug 41064: Update tools/signing/README
by morgan (＠morgan) 01 Sep '25

01 Sep '25

morgan pushed to branch main at The Tor Project / Applications / tor-browser-build Commits: 7d122642 by Nicolas Vigier at 2025-09-01T16:53:45+02:00 Bug 41064: Update tools/signing/README - - - - - 7b232a13 by Nicolas Vigier at 2025-09-01T17:22:25+02:00 Bug 41064: Add tools/signing/machines-setup/README.md - - - - - 2 changed files: - tools/signing/README - + tools/signing/machines-setup/README.md Changes: ===================================== tools/signing/README ===================================== @@ -1,10 +1,11 @@ -The files in this directory are a large part of what we use when signing -releases. The scripts are meant to be templates, though, at the moment -omitting specific paths and credential information. +This directory contains the scripts used to sign Tor Browser, Mullvad +Browser and Tor VPN. -Additionally, when starting to use them for your own signing setup don't forget -to adapt the locale list if needed. The entitlement files, however, are kept -up-to-date. +For information about using those scripts, see the `Release Prep` gitlab +issue templates in the `.gitlab/issue_templates` directory. + +The scripts in the machines-setup/ directory are used to setup the +signing machines (see README.md file in that directory for more details). The scripts in the nightly/ directory are used to sign and publish the nightly updates. ===================================== tools/signing/machines-setup/README.md ===================================== @@ -0,0 +1,37 @@ +This directory contains the scripts used to setup the signing machines. + +It handles everything in the setup, except installation of the signing +keys, which is done manually. + +# Deploying changes on the signing machines + +To deploy changes on the signing machines you need: +* access to the `root` account (either running `su -` and entering the + `root` password, or having your ssh key in `~root/.ssh/authorized_keys`) +* access to the `setup` account via ssh (the `setup-signing-machine` + script should be updated to add your key there) + +Deploying changes to the signing machines is done with the following two scripts: +* upload-tbb-to-signing-machine +* setup-signing-machine + +## upload-tbb-to-signing-machine + +This script should be run from your local machine (from which you access +the signing machine). It will create a tarball of tor-browser-build from +the `HEAD` commit, upload it to the signing machine and extract it in +the `/signing` directory. In addition it will download and upload to +the signing machine the tools used in the signing process. + +Before running the script you may edit the line +`signing_machine='linux-signer'` to change the hostname of the signing +machine. + +## setup-signing-machine + +This script should be run on the signing machine as root. It will install +required packages, create user accounts and setup signing tools. + +After running `upload-tbb-to-signing-machine`, open a root shell on the +signing machine and run +`/signing/tor-browser-build/tools/signing/machines-setup/setup-signing-machine`. View it on GitLab: https://gitlab.torproject.org/tpo/applications/tor-browser-build/-/compare/… -- View it on GitLab: https://gitlab.torproject.org/tpo/applications/tor-browser-build/-/compare/… You're receiving this email because of your account on gitlab.torproject.org.

1 0

[Git][tpo/applications/tor-browser][tor-browser-140.2.0esr-15.0-1] 2 commits: fixup! TB 31286: Implementation of bridge, proxy, and firewall settings in...
by morgan (＠morgan) 01 Sep '25

01 Sep '25

morgan pushed to branch tor-browser-140.2.0esr-15.0-1 at The Tor Project / Applications / Tor Browser Commits: d6e3fcfd by Henry Wilkes at 2025-09-01T16:30:49+01:00 fixup! TB 31286: Implementation of bridge, proxy, and firewall settings in about:preferences#connection TB 44145: Use --icon-color and --icon-color-critical for the connection status icons. - - - - - cf3594e3 by Henry Wilkes at 2025-09-01T16:32:22+01:00 fixup! TB 27476: Implement about:torconnect captive portal within Tor Browser TB 44145: Use --icon-color and --icon-color-critical for the connection status icons. - - - - - 2 changed files: - browser/components/torpreferences/content/torPreferences.css - toolkit/components/torconnect/content/torConnectTitlebarStatus.css Changes: ===================================== browser/components/torpreferences/content/torPreferences.css ===================================== @@ -57,8 +57,8 @@ button.spoof-button-disabled { height: 18px; margin-inline-end: 8px; -moz-context-properties: fill, stroke; - fill: currentColor; - stroke: currentColor; + fill: var(--icon-color); + stroke: var(--icon-color); } #network-status-internet-area .network-status-icon { @@ -79,13 +79,7 @@ button.spoof-button-disabled { #network-status-tor-area.status-blocked .network-status-icon { /* Same as .tor-connect-status-potentially-blocked. */ - stroke: #c50042; -} - -@media (prefers-color-scheme: dark) { - #network-status-tor-area.status-blocked .network-status-icon { - stroke: #ff9aa2; - } + stroke: var(--icon-color-critical); } .network-status-label { ===================================== toolkit/components/torconnect/content/torConnectTitlebarStatus.css ===================================== @@ -12,8 +12,8 @@ #tor-connect-titlebar-status img { -moz-context-properties: fill, stroke; - fill: currentColor; - stroke: currentColor; + fill: var(--icon-color); + stroke: var(--icon-color); width: 16px; height: 16px; object-fit: none; @@ -30,21 +30,23 @@ * we assign the potentially-blocked class, we do *not* expect to be connected * at the same time, so we only expect this first frame to be visible in this * state. */ - stroke: #c50042; -} - -@media (prefers-color-scheme: dark) { - #tor-connect-titlebar-status.tor-connect-status-potentially-blocked img { - stroke: #ff9aa2; - } + stroke: var(--icon-color-critical); } #tor-connect-titlebar-status.tor-connect-status-connected img { object-position: var(--tor-connected-offset); } -#tor-connect-titlebar-status.tor-connect-status-connected { - color: var(--tor-text-color); +@media not ((prefers-contrast) or (forced-colors)) { + /* Make the connected text and icon purple. */ + #tor-connect-titlebar-status.tor-connect-status-connected { + color: var(--tor-text-color); + } + + #tor-connect-titlebar-status.tor-connect-status-connected img { + fill: var(--tor-text-color); + stroke: var(--tor-text-color); + } } @keyframes onion-not-connected-to-connected { @@ -63,6 +65,7 @@ } #tor-connect-titlebar-status.tor-connect-status-connected.tor-connect-status-animate-transition img { + transition: fill 1000ms, stroke 1000ms; animation-name: onion-not-connected-to-connected; animation-delay: 200ms; animation-fill-mode: both; View it on GitLab: https://gitlab.torproject.org/tpo/applications/tor-browser/-/compare/3cf311… -- View it on GitLab: https://gitlab.torproject.org/tpo/applications/tor-browser/-/compare/3cf311… You're receiving this email because of your account on gitlab.torproject.org.

1 0

[Git][tpo/applications/tor-browser-build][main] Bug 41517: Fix use of authorized_keys in setup-signing-machine
by morgan (＠morgan) 01 Sep '25

01 Sep '25

morgan pushed to branch main at The Tor Project / Applications / tor-browser-build Commits: 1679268e by Nicolas Vigier at 2025-09-01T16:35:11+02:00 Bug 41517: Fix use of authorized_keys in setup-signing-machine Fixing a regression from ca3c988042b00424f53a0c9bb85ee4d2cc172282: all keys added to the setup account should be set with a single call to the `authorized_keys` function. - - - - - 1 changed file: - tools/signing/machines-setup/setup-signing-machine Changes: ===================================== tools/signing/machines-setup/setup-signing-machine ===================================== @@ -69,8 +69,7 @@ install_packages build-essential rsync unzip install_packages sudo vim tmux gnupg create_user setup -authorized_keys setup boklm-yk1.pub -authorized_keys setup morgan.pub +authorized_keys setup boklm-yk1.pub morgan.pub mkdir -p /signing chmod 0755 /signing chown setup /signing View it on GitLab: https://gitlab.torproject.org/tpo/applications/tor-browser-build/-/commit/1… -- View it on GitLab: https://gitlab.torproject.org/tpo/applications/tor-browser-build/-/commit/1… You're receiving this email because of your account on gitlab.torproject.org.

1 0

[Git][tpo/applications/tor-browser][tor-browser-140.2.0esr-15.0-1] 3 commits: fixup! TB 31286: Implementation of bridge, proxy, and firewall settings in...
by morgan (＠morgan) 01 Sep '25

01 Sep '25

morgan pushed to branch tor-browser-140.2.0esr-15.0-1 at The Tor Project / Applications / Tor Browser Commits: 398f7ef4 by Henry Wilkes at 2025-09-01T15:08:11+00:00 fixup! TB 31286: Implementation of bridge, proxy, and firewall settings in about:preferences#connection TB 42025: Use new purple colours. - - - - - ad2c3e94 by Henry Wilkes at 2025-09-01T15:08:11+00:00 fixup! TB 27476: Implement about:torconnect captive portal within Tor Browser TB 42025: Use new purple colours. - - - - - 3cf3111e by Henry Wilkes at 2025-09-01T15:08:11+00:00 fixup! TB 41817: tor-browser semantic colors. TB 42025: Use new purple colours. - - - - - 3 changed files: - browser/components/torpreferences/content/torPreferences.css - toolkit/components/torconnect/content/torConnectTitlebarStatus.css - toolkit/themes/shared/tor-colors.css Changes: ===================================== browser/components/torpreferences/content/torPreferences.css ===================================== @@ -20,7 +20,10 @@ button.spoof-button-disabled { width: 16px; height: 16px; -moz-context-properties: fill; - fill: var(--tor-accent-color); + /* Use --tor-text-color. This will have good contrast for this small icon + * against the background. And it will match the surrounding text for high + * contrast and forced colour themes. */ + fill: var(--tor-text-color); content: url("chrome://global/skin/icons/loading.svg"); } @@ -168,7 +171,7 @@ button.spoof-button-disabled { * using it for text colors, so we only enable these rules when not using a * high contrast theme or forced colors. */ .bridge-status-badge.bridge-status-connected { - color: var(--tor-accent-color); + color: var(--tor-text-color); } .bridge-status-badge.bridge-status-current-built-in { ===================================== toolkit/components/torconnect/content/torConnectTitlebarStatus.css ===================================== @@ -44,7 +44,7 @@ } #tor-connect-titlebar-status.tor-connect-status-connected { - color: var(--tor-accent-color); + color: var(--tor-text-color); } @keyframes onion-not-connected-to-connected { ===================================== toolkit/themes/shared/tor-colors.css ===================================== @@ -1,21 +1,13 @@ @namespace xul "http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul"; :root { - /* Photon colors not available in Firefox. */ - --purple-30: #c069ff; - --purple-40: #ad3bff; - --purple-50: #9400ff; - --purple-60: #8000d7; - --purple-70: #6200a4; - --purple-80: #440071; - --purple-90: #25003e; - /* On light backgrounds. */ - --tor-accent-color-light: var(--purple-60); - --tor-accent-color-hover-light: var(--purple-70); - --tor-accent-color-active-light: var(--purple-80); - - /* Acorn color grey light 05. */ + --tor-accent-color-light: var(--color-purple-60); + --tor-accent-color-hover-light: var(--color-purple-70); + --tor-accent-color-active-light: var(--color-purple-80); + /* Color for text on --background-color-canvas. */ + --tor-text-color-light: var(--color-purple-60); + /* Buttons. */ --tor-button-text-color-light: var(--color-gray-05); --tor-button-text-color-hover-light: var(--color-gray-05); --tor-button-text-color-active-light: var(--color-gray-05); @@ -23,26 +15,27 @@ --tor-button-background-color-hover-light: var(--tor-accent-color-hover-light); --tor-button-background-color-active-light: var(--tor-accent-color-active-light); --tor-focus-outline-color-light: var(--tor-accent-color-light); + /* Links. */ --tor-link-color-light: var(--tor-accent-color-light); --tor-link-color-hover-light: var(--tor-accent-color-hover-light); --tor-link-color-active-light: var(--tor-accent-color-active-light); /* On dark backgrounds. */ - /* TODO: Need a dark theme purple color that gets *lighter* with hover and - * active states, see tor-browser#42025 */ - --tor-accent-color-dark: var(--purple-30); - --tor-accent-color-hover-dark: var(--purple-40); - --tor-accent-color-active-dark: var(--purple-50); - - /* TODO: Use a dark text color for dark theme. tor-browser#41787. */ - --tor-button-text-color-dark: var(--color-gray-05); - --tor-button-text-color-hover-dark: var(--color-gray-05); - --tor-button-text-color-active-dark: var(--color-gray-05); + --tor-accent-color-dark: var(--color-purple-30); + --tor-accent-color-hover-dark: var(--color-purple-20); + --tor-accent-color-active-dark: var(--color-purple-10); + /* Color for text on --background-color-canvas. */ + --tor-text-color-dark: var(--color-purple-20); + /* Buttons. */ + --tor-button-text-color-dark: var(--color-gray-100); + --tor-button-text-color-hover-dark: var(--color-gray-100); + --tor-button-text-color-active-dark: var(--color-gray-100); --tor-button-background-color-dark: var(--tor-accent-color-dark); --tor-button-background-color-hover-dark: var(--tor-accent-color-hover-dark); --tor-button-background-color-active-dark: var(--tor-accent-color-active-dark); --tor-focus-outline-color-dark: var(--tor-accent-color-dark); + /* Links. */ --tor-link-color-dark: var(--tor-accent-color-dark); --tor-link-color-hover-dark: var(--tor-accent-color-hover-dark); --tor-link-color-active-dark: var(--tor-accent-color-active-dark); @@ -61,6 +54,10 @@ var(--tor-accent-color-active-light), var(--tor-accent-color-active-dark) ); + --tor-text-color: light-dark( + var(--tor-text-color-light), + var(--tor-text-color-dark) + ); --tor-button-text-color: light-dark( var(--tor-button-text-color-light), var(--tor-button-text-color-dark) @@ -110,6 +107,9 @@ --tor-accent-color-hover: var(--color-accent-primary-hover); --tor-accent-color-active: var(--color-accent-primary-active); + /* Match surrounding text. */ + --tor-text-color: currentColor; + /* Use Firefox design system primary button colors. */ --tor-button-text-color: var(--button-text-color-primary); --tor-button-text-color-hover: var(--button-text-color-primary-hover); View it on GitLab: https://gitlab.torproject.org/tpo/applications/tor-browser/-/compare/2e79fc… -- View it on GitLab: https://gitlab.torproject.org/tpo/applications/tor-browser/-/compare/2e79fc… You're receiving this email because of your account on gitlab.torproject.org.

1 0

[Git][tpo/applications/tor-browser-build][main] Bug 41522: Fix issue in tools/signing/wrappers/sign-apk
by boklm (＠boklm) 01 Sep '25

01 Sep '25

boklm pushed to branch main at The Tor Project / Applications / tor-browser-build Commits: d7536498 by Nicolas Vigier at 2025-09-01T15:03:50+02:00 Bug 41522: Fix issue in tools/signing/wrappers/sign-apk Fix issue introduced in 821c192ed9def86b92a20bc8878a7c519230996f. - - - - - 1 changed file: - tools/signing/wrappers/sign-apk Changes: ===================================== tools/signing/wrappers/sign-apk ===================================== @@ -23,7 +23,7 @@ case "$SIGNING_PROJECTNAME" in esac android_signing_key_dir=/home/signing-apk/keys -android_signing_key_path="$android_signing_key_dir/$pname_$tbb_version_type.p12" +android_signing_key_path="$android_signing_key_dir/tba_$tbb_version_type.p12" test -n "$SIGNING_PROJECTNAME" && test "$SIGNING_PROJECTNAME" = 'torvpn' && \ android_signing_key_path="$android_signing_key_dir/torvpn.p12" test -f "$android_signing_key_path" || exit_error "$android_signing_key_path is missing" View it on GitLab: https://gitlab.torproject.org/tpo/applications/tor-browser-build/-/commit/d… -- View it on GitLab: https://gitlab.torproject.org/tpo/applications/tor-browser-build/-/commit/d… You're receiving this email because of your account on gitlab.torproject.org.

1 0

[Git][tpo/applications/tor-browser-build] Pushed new tag mb-15.0a2-build1
by ma1 (＠ma1) 29 Aug '25

29 Aug '25

ma1 pushed new tag mb-15.0a2-build1 at The Tor Project / Applications / tor-browser-build -- View it on GitLab: https://gitlab.torproject.org/tpo/applications/tor-browser-build/-/tree/mb-… You're receiving this email because of your account on gitlab.torproject.org.

1 0

[Git][tpo/applications/tor-browser-build] Pushed new tag tbb-15.0a2-build1
by ma1 (＠ma1) 29 Aug '25

29 Aug '25

ma1 pushed new tag tbb-15.0a2-build1 at The Tor Project / Applications / tor-browser-build -- View it on GitLab: https://gitlab.torproject.org/tpo/applications/tor-browser-build/-/tree/tbb… You're receiving this email because of your account on gitlab.torproject.org.

1 0

[Git][tpo/applications/tor-browser-build][main] Bug 41525,41526: Release Prep Tor,Mullvad Browser 15.0a2
by ma1 (＠ma1) 29 Aug '25

29 Aug '25

ma1 pushed to branch main at The Tor Project / Applications / tor-browser-build Commits: f04ab8cd by hackademix at 2025-08-29T17:41:20+02:00 Bug 41525,41526: Release Prep Tor,Mullvad Browser 15.0a2 - - - - - 11 changed files: - projects/application-services/config - projects/browser/Bundle-Data/Docs-MB/ChangeLog.txt - projects/browser/Bundle-Data/Docs-TBB/ChangeLog.txt - projects/browser/config - projects/firefox/config - projects/geckoview/config - projects/go/config - projects/manual/config - projects/openssl/config - projects/translation/config - rbm.conf Changes: ===================================== projects/application-services/config ===================================== @@ -16,7 +16,7 @@ container: use_container: 1 var: - build_number: 4 + build_number: 5 # This should be updated when the list of gradle dependencies is changed. gradle_dependencies_version: 12 gradle_version: 8.13 ===================================== projects/browser/Bundle-Data/Docs-MB/ChangeLog.txt ===================================== @@ -1,3 +1,48 @@ +Mullvad Browser 15.0a2 - August 29 2025 + * All Platforms + * Updated Firefox to 140.2.0esr + * Updated NoScript to 13.0.9 + * Bug 451: The restart to apply button doesn't work [mullvad-browser] + * Bug 460: Rebase Mullvad Browser alpha onto 140.2.0esr [mullvad-browser] + * Bug 43111: Delete our webextensions for search engines when Bug 1885953 is fixed upstream [tor-browser] + * Bug 43728: Update search engine icon sizes [tor-browser] + * Bug 43795: Restore the URL classifier XPCOM components. [tor-browser] + * Bug 43844: Security level shield icon should be flipped for RTL locales [tor-browser] + * Bug 43864: Remove features from the unified search button [tor-browser] + * Bug 43874: Incorporate our unified extension button hiding logic into mozilla's changes for ESR 140 [tor-browser] + * Bug 43902: Hide Sidebar buttons [tor-browser] + * Bug 43903: Report broken site is disabled rather than hidden [tor-browser] + * Bug 44030: Security Level selector does not get confirmation before restarting [tor-browser] + * Bug 44034: Update string used for checkbox on New Identity confirmation dialog [tor-browser] + * Bug 44040: Modify nsIPrompt and the commonDialog code to allow destructive buttons [tor-browser] + * Bug 44041: Letterboxing causes greyed out alert background to be mis-aligned [tor-browser] + * Bug 44045: Drop AI and machine learning components [tor-browser] + * Bug 44048: Backport Bug 1979608 [tor-browser] + * Bug 44090: Several of our XUL pages cause a crash because of missing CSP [tor-browser] + * Bug 44100: Backport Security Fixes from Firefox 142 [tor-browser] + * Bug 44106: Make sure background tasks are not used for shutdown cleanup [tor-browser] + * Bug 44125: Do not offer to save signatures by default in Private Browsing Mode [tor-browser] + * Bug 44140: Align PDF changes to 140esr [tor-browser] + * Windows + * Bug 44046: Replace BASE_BROWSER_UPDATE with BASE_BROWSER_VERSION in the font visibility list [tor-browser] + * Bug 44062: Force touch enabled on Windows and Android [tor-browser] + * Build System + * All Platforms + * Bug 44067: Move --enable-geckodriver only to Linux-only mozconfigs [tor-browser] + * Bug 44103: git's export-subst is a reproducibility problem [tor-browser] + * Bug 44104: Don't run linter when there are no overall changes [tor-browser] + * Bug 26408: Make MAR signature checks clearer when creating incremental MAR files [tor-browser-build] + * Bug 40697: Delete repackage_browser.sh [tor-browser-build] + * Bug 40698: Update locale in tbb_version.json [tor-browser-build] + * Bug 41517: Add morgan's key to the setup account on the signing machine [tor-browser-build] + * Bug 41529: Automate publishing browser release branch and tags to Mullvad repository [tor-browser-build] + * Bug 41534: Copy geckodriver only for Linux x86-64 [tor-browser-build] + * Bug 41539: Update Ubuntu version used to run mmdebstrap to 24.04.3 [tor-browser-build] + * Bug 40087: Downloaded files getting stricter permissions than expected [rbm] + * macOS + * Bug 41527: Update libdmg-hfsplus and enable LZMA compression on dmgs [tor-browser-build] + * Bug 41538: Bump macOS SDK to 15.5 [tor-browser-build] + Mullvad Browser 15.0a1 - July 29 2025 * All Platforms * Updated Firefox to 140.1.0esr ===================================== projects/browser/Bundle-Data/Docs-TBB/ChangeLog.txt ===================================== @@ -1,3 +1,87 @@ +Tor Browser 15.0a2 - August 29 2025 + * All Platforms + * Updated NoScript to 13.0.9 + * Updated OpenSSL to 3.5.2 + * Bug 43727: Update moz-toggle customisation for ESR 140 [tor-browser] + * Bug 43832: Drop eslint-env [tor-browser] + * Bug 43864: Remove features from the unified search button [tor-browser] + * Bug 44045: Drop AI and machine learning components [tor-browser] + * Bug 44048: Backport Bug 1979608 [tor-browser] + * Bug 44069: Update `meek-azure` related strings to `meek` [tor-browser] + * Bug 44094: Rebase Tor Browser alpha onto 140.2.0esr [tor-browser] + * Bug 44100: Backport Security Fixes from Firefox 142 [tor-browser] + * Bug 44140: Align PDF changes to 140esr [tor-browser] + * Bug 41442: Update our audit CSVs to use the new Audit template [tor-browser-build] + * Windows + macOS + Linux + * Updated Firefox to 140.2.0esr + * Bug 43111: Delete our webextensions for search engines when Bug 1885953 is fixed upstream [tor-browser] + * Bug 43519: Replace tor-loading.png with SVG [tor-browser] + * Bug 43525: Check if our search engine customization still works after ESR 140 transition [tor-browser] + * Bug 43728: Update search engine icon sizes [tor-browser] + * Bug 43795: Restore the URL classifier XPCOM components. [tor-browser] + * Bug 43817: Write e2e test for verifying if the browser is connected to the Tor network [tor-browser] + * Bug 43844: Security level shield icon should be flipped for RTL locales [tor-browser] + * Bug 43874: Incorporate our unified extension button hiding logic into mozilla's changes for ESR 140 [tor-browser] + * Bug 43901: Modify about:license for Tor Browser and drop about:rights [tor-browser] + * Bug 43902: Hide Sidebar buttons [tor-browser] + * Bug 43903: Report broken site is disabled rather than hidden [tor-browser] + * Bug 44030: Security Level selector does not get confirmation before restarting [tor-browser] + * Bug 44034: Update string used for checkbox on New Identity confirmation dialog [tor-browser] + * Bug 44040: Modify nsIPrompt and the commonDialog code to allow destructive buttons [tor-browser] + * Bug 44041: Letterboxing causes greyed out alert background to be mis-aligned [tor-browser] + * Bug 44090: Several of our XUL pages cause a crash because of missing CSP [tor-browser] + * Bug 44095: Rename connectionPane.xhtml and remove it from the jar [tor-browser] + * Bug 44106: Make sure background tasks are not used for shutdown cleanup [tor-browser] + * Bug 44115: Make remove all bridges dialog use a destructive red button [tor-browser] + * Bug 44125: Do not offer to save signatures by default in Private Browsing Mode [tor-browser] + * Windows + Android + * Bug 44062: Force touch enabled on Windows and Android [tor-browser] + * Windows + * Bug 44046: Replace BASE_BROWSER_UPDATE with BASE_BROWSER_VERSION in the font visibility list [tor-browser] + * macOS + * Bug 44127: Do not show macOS Privacy hint on network error pages [tor-browser] + * Android + * Updated GeckoView to 140.2.0esr + * Bug 43179: Make persistent 'private tabs' notification distinct from Firefox's [tor-browser] + * Bug 43346: Remove the "[android] Stop PrivateNotificationService" patch [tor-browser] + * Bug 43645: Swiping away doesn't always disconnect from tor [tor-browser] + * Bug 43699: Dummy "about:" pages are not cleared from recently closed tabs (and possibly elsewhere) because they are normal tabs, not private tabs. [tor-browser] + * Bug 43826: Review Mozilla 1960122: Use `MOZ_BUILD_DATE` in Fenix build configuration [tor-browser] + * Bug 44021: Android settings page colors are sometimes messed up (seems to be on the first launch) [tor-browser] + * Bug 44042: Debug crash when opening settings too quickly after launching app [tor-browser] + * Bug 44047: Tor Browser's home doesn't have the background at the first load on Android [tor-browser] + * Bug 44080: Further remove "Analytics data collection and usage" [tor-browser] + * Bug 44081: Swiping away the "private tabs" notification requires rebootstrapping. [tor-browser] + * Bug 44083: "snowflake" is lower case on Android [tor-browser] + * Bug 44098: Bookmarks offer a way to go to sync in 15.0a1 [tor-browser] + * Bug 44139: Restore the (inactive) YouTube and Reddit search plugins on Android [tor-browser] + * Build System + * All Platforms + * Bug 44061: "Contributing" link is broken [tor-browser] + * Bug 44067: Move --enable-geckodriver only to Linux-only mozconfigs [tor-browser] + * Bug 44103: git's export-subst is a reproducibility problem [tor-browser] + * Bug 44104: Don't run linter when there are no overall changes [tor-browser] + * Bug 26408: Make MAR signature checks clearer when creating incremental MAR files [tor-browser-build] + * Bug 40551: Drop go reproducibility patches [tor-browser-build] + * Bug 40697: Delete repackage_browser.sh [tor-browser-build] + * Bug 40698: Update locale in tbb_version.json [tor-browser-build] + * Bug 41517: Add morgan's key to the setup account on the signing machine [tor-browser-build] + * Bug 41522: Adapt our signing scripts to be able to sign the VPN app [tor-browser-build] + * Bug 41534: Copy geckodriver only for Linux x86-64 [tor-browser-build] + * Bug 41537: Add script to count mar downloads from web logs [tor-browser-build] + * Bug 41539: Update Ubuntu version used to run mmdebstrap to 24.04.3 [tor-browser-build] + * Bug 40087: Downloaded files getting stricter permissions than expected [rbm] + * Windows + Linux + Android + * Updated Go to 1.24.6 + * macOS + * Bug 41527: Update libdmg-hfsplus and enable LZMA compression on dmgs [tor-browser-build] + * Bug 41538: Bump macOS SDK to 15.5 [tor-browser-build] + * Android + * Bug 44078: Modify ./autopublish-settings.gradle for building a-s and glean with uniffi-bindgen no-op [tor-browser] + * Bug 41523: Use custom built Glean package on Android [tor-browser-build] + * Bug 41531: Update relprep.py script to handle application-services updates [tor-browser-build] + * Bug 41548: Hide tor's symbols on Android and add other linker options to save space [tor-browser-build] + Tor Browser 15.0a1 - July 29 2025 * All Platforms * Updated NoScript to 13.0.8 ===================================== projects/browser/config ===================================== @@ -113,9 +113,9 @@ input_files: enable: '[% ! c("var/android") %]' - filename: dmg-root enable: '[% ! c("var/android") %]' - - URL: https://addons.mozilla.org/firefox/downloads/file/4497468/noscript-13.0.8.x… + - URL: https://addons.mozilla.org/firefox/downloads/file/4551629/noscript-13.0.9.x… name: noscript - sha256sum: 9d978cfe083cb9cce120b5ee41e8933d752d7ab4680bf517c5ec4b29c4cfd2dc + sha256sum: 525ab61aff21f67d10c3e20965a86ed479631549908a658f54692adc47d771f5 - URL: https://addons.mozilla.org/firefox/downloads/file/4531307/ublock_origin-1.6… name: ublock-origin sha256sum: 3e73c96a29a933866065f0756fe032984bf5b254af8dd1afd7a7f7e0668a33cf ===================================== projects/firefox/config ===================================== @@ -21,7 +21,7 @@ var: browser_series: '15.0' browser_rebase: 1 browser_branch: '[% c("var/browser_series") %]-[% c("var/browser_rebase") %]' - browser_build: 1 + browser_build: 3 copyright_year: '[% exec("git show -s --format=%ci " _ c("git_hash") _ "^{commit}", { exec_noco => 1 }).remove("-.*") %]' nightly_updates_publish_dir: '[% c("var/nightly_updates_publish_dir_prefix") %]nightly-[% c("var/osname") %]' gitlab_project: https://gitlab.torproject.org/tpo/applications/tor-browser ===================================== projects/geckoview/config ===================================== @@ -23,7 +23,7 @@ var: browser_series: '15.0' browser_rebase: 1 browser_branch: '[% c("var/browser_series") %]-[% c("var/browser_rebase") %]' - browser_build: 1 + browser_build: 3 gitlab_project: https://gitlab.torproject.org/tpo/applications/tor-browser git_commit: '[% exec("git rev-parse " _ c("git_hash") _ "^{commit}", { exec_noco => 1 }) %]' deps: ===================================== projects/go/config ===================================== @@ -1,11 +1,11 @@ # vim: filetype=yaml sw=2 -version: '1.23.11' +version: '1.24.6' filename: '[% project %]-[% c("version") %]-[% c("var/osname") %]-[% c("var/build_id") %].tar.[% c("compress_tar") %]' container: use_container: 1 var: - source_sha256: 296381607a483a8a8667d7695331752f94a1f231c204e2527d2f22e1e3d1247d + source_sha256: e1cb5582aab588668bc04c07de18688070f6b8c9b2aaf361f821e19bd47cfdbd no_crosscompile: 1 setup: | mkdir -p /var/tmp/dist ===================================== projects/manual/config ===================================== @@ -1,7 +1,7 @@ # vim: filetype=yaml sw=2 # To update, see doc/how-to-update-the-manual.txt # Remember to update also the package's hash, with the version! -version: 295391 +version: 309462 filename: 'manual-[% c("version") %]-[% c("var/build_id") %].tar.[% c("compress_tar") %]' container: use_container: 1 @@ -23,6 +23,6 @@ input_files: - project: container-image - URL: 'https://build-sources.tbb.torproject.org/manual_[% c("version") %].zip' name: manual - sha256sum: feff63a5611438ae31c8237c9ce5cb463ec96cab07bd71f51a80ac5020d4e465 + sha256sum: 602b930213509b829192969f01082b227abb92cf1cc3ff3309970ffd2a5f4fba - filename: packagemanual.py name: package_script ===================================== projects/openssl/config ===================================== @@ -1,5 +1,5 @@ # vim: filetype=yaml sw=2 -version: 3.5.1 +version: 3.5.2 filename: '[% project %]-[% c("version") %]-[% c("var/osname") %]-[% c("var/build_id") %].tar.[% c("compress_tar") %]' container: use_container: 1 @@ -33,5 +33,5 @@ input_files: - name: '[% c("var/compiler") %]' project: '[% c("var/compiler") %]' - URL: 'https://github.com/openssl/openssl/releases/download/openssl-[% c("version") %]/openssl-[% c("version") %].tar.gz' - sha256sum: 529043b15cffa5f36077a4d0af83f3de399807181d607441d734196d889b641f + sha256sum: c53a47e5e441c930c3928cf7bf6fb00e5d129b630e0aa873b08258656e7345ec name: openssl ===================================== projects/translation/config ===================================== @@ -12,13 +12,13 @@ compress_tar: 'gz' steps: base-browser: base-browser: '[% INCLUDE build %]' - git_hash: 96a559c7c1f7b9231db2b5cece7ecae980ae835d + git_hash: 948fad2286cb59fe168a949009b67d986fd9c153 targets: nightly: git_hash: 'base-browser' tor-browser: tor-browser: '[% INCLUDE build %]' - git_hash: 3becb908fbf68aa77accc1f2e03e2c29f4fe40e2 + git_hash: ec17987af29cb2614d114789996a3b4a09cbc3e7 targets: nightly: git_hash: 'tor-browser' @@ -32,7 +32,7 @@ steps: fenix: '[% INCLUDE build %]' # We need to bump the commit before releasing but just pointing to a branch # might cause too much rebuidling of the Firefox part. - git_hash: 674a3f4d2d75b9688a54e5f1a0139feb617339d3 + git_hash: 0beea4b4b7b964d8e6624a04f3e9ec24c5be28b8 compress_tar: 'zst' targets: nightly: ===================================== rbm.conf ===================================== @@ -74,11 +74,11 @@ buildconf: git_signtag_opt: '-s' var: - torbrowser_version: '15.0a1' + torbrowser_version: '15.0a2' torbrowser_build: 'build1' # This should be the date of when the build is started. For the build # to be reproducible, browser_release_date should always be in the past. - browser_release_date: '2025/07/29 10:33:44' + browser_release_date: '2025/08/29 13:09:47' browser_release_date_timestamp: '[% USE date; date.format(c("var/browser_release_date"), "%s") %]' browser_default_channel: alpha browser_platforms: @@ -128,9 +128,9 @@ var: updater_enabled: 1 build_mar: 1 torbrowser_incremental_from: + - 15.0a1 - 14.5a6 - 14.5a5 - - 14.5a4 mar_channel_id: '[% c("var/projectname") %]-torproject-[% c("var/channel") %]' # By default, we sort the list of installed packages. This allows sharing View it on GitLab: https://gitlab.torproject.org/tpo/applications/tor-browser-build/-/commit/f… -- View it on GitLab: https://gitlab.torproject.org/tpo/applications/tor-browser-build/-/commit/f… You're receiving this email because of your account on gitlab.torproject.org.

1 0

[Git][tpo/applications/mullvad-browser] Pushed new tag mullvad-browser-140.2.0esr-15.0-1-build3
by ma1 (＠ma1) 29 Aug '25

29 Aug '25

ma1 pushed new tag mullvad-browser-140.2.0esr-15.0-1-build3 at The Tor Project / Applications / Mullvad Browser -- View it on GitLab: https://gitlab.torproject.org/tpo/applications/mullvad-browser/-/tree/mullv… You're receiving this email because of your account on gitlab.torproject.org.

1 0

[Git][tpo/applications/tor-browser-build][main] Bug 41522: Remove incorrect comment in linux-signer-sign-android-aab
by boklm (＠boklm) 29 Aug '25

29 Aug '25

boklm pushed to branch main at The Tor Project / Applications / tor-browser-build Commits: 9bdc0d94 by Nicolas Vigier at 2025-08-29T13:04:30+02:00 Bug 41522: Remove incorrect comment in linux-signer-sign-android-aab This is a comment I initialy added to linux-signer-sign-android-apks, then mistakenly copied to linux-signer-sign-android-aab (which doesn't exist in the maint-14.5 branch). - - - - - 1 changed file: - tools/signing/linux-signer-sign-android-aab Changes: ===================================== tools/signing/linux-signer-sign-android-aab ===================================== @@ -11,8 +11,6 @@ projname=$(project-name) # tbb_version_type, tbb_version and SIGNING_PROJECTNAME are used in # wrappers/sign-apk, so we export them export tbb_version tbb_version_type SIGNING_PROJECTNAME -# (note: we should also export SIGNING_PROJECTNAME and tbb_version in -# the maint-14.5 branch) check_installed_packages() { local packages='unzip openjdk-11-jdk-headless openjdk-11-jre-headless' View it on GitLab: https://gitlab.torproject.org/tpo/applications/tor-browser-build/-/commit/9… -- View it on GitLab: https://gitlab.torproject.org/tpo/applications/tor-browser-build/-/commit/9… You're receiving this email because of your account on gitlab.torproject.org.

1 0

[Git][tpo/applications/mullvad-browser][mullvad-browser-140.2.0esr-15.0-1] fixup! BB 42220: Allow for more file types to be forced-inline.
by ma1 (＠ma1) 29 Aug '25

29 Aug '25

ma1 pushed to branch mullvad-browser-140.2.0esr-15.0-1 at The Tor Project / Applications / Mullvad Browser Commits: a295032e by hackademix at 2025-08-29T13:13:03+02:00 fixup! BB 42220: Allow for more file types to be forced-inline. BB 44140: Align PDF changes to 140esr Firefox allows to open some files in the browser without any confirmation, but this will result in a disk leak, because the file will be downloaded to the temporary directory first (and not deleted, in some cases). A preference allows PDFs to be opened without being downloaded to disk. So, we introduce a similar one to do the same for all the files that are set to be opened automatically in the browser, except svg and html files to prevent XSS hazards (see BB 43211). - - - - - 1 changed file: - uriloader/base/nsURILoader.cpp Changes: ===================================== uriloader/base/nsURILoader.cpp ===================================== @@ -320,7 +320,11 @@ NS_IMETHODIMP nsDocumentOpenInfo::OnStopRequest(nsIRequest* request, return NS_OK; } -static bool IsContentPDF(nsIChannel* aChannel, const nsACString& aContentType) { +static bool IsContentPDF( + nsIChannel* aChannel, const nsACString& aContentType, + nsAutoCString* aOutExt = + nullptr // best-guess file extension, useful for non-PDFs +) { bool isPDF = aContentType.LowerCaseEqualsASCII(APPLICATION_PDF); if (!isPDF && (aContentType.LowerCaseEqualsASCII(APPLICATION_OCTET_STREAM) || aContentType.IsEmpty())) { @@ -328,14 +332,25 @@ static bool IsContentPDF(nsIChannel* aChannel, const nsACString& aContentType) { aChannel->GetContentDispositionFilename(flname); isPDF = StringEndsWith(flname, u".pdf"_ns); if (!isPDF) { + nsAutoCString ext; nsCOMPtr<nsIURI> uri; aChannel->GetURI(getter_AddRefs(uri)); nsCOMPtr<nsIURL> url(do_QueryInterface(uri)); if (url) { - nsAutoCString ext; url->GetFileExtension(ext); isPDF = ext.EqualsLiteral("pdf"); } + if (aOutExt) { + // Fill the extension out param if required + if (!(isPDF || flname.IsEmpty())) { + // For non PDFs, fallback to filename from content disposition + int32_t extStart = flname.RFindChar(u'.'); + if (extStart != kNotFound) { + CopyUTF16toUTF8(Substring(flname, extStart + 1), ext); + } + } + *aOutExt = ext; + } } } @@ -343,7 +358,7 @@ static bool IsContentPDF(nsIChannel* aChannel, const nsACString& aContentType) { } static mozilla::Result<bool, nsresult> ShouldHandleExternally( - const nsACString& aMimeType) { + const nsACString& aMimeType, const nsACString& aExtension) { // For a PDF, check if the preference is set that forces attachments to be // opened inline. If so, treat it as a non-attachment by clearing // 'forceExternalHandling' again. This allows it open a PDF directly @@ -356,7 +371,7 @@ static mozilla::Result<bool, nsresult> ShouldHandleExternally( return mozilla::Err(NS_ERROR_FAILURE); } - mimeSvc->GetFromTypeAndExtension(aMimeType, EmptyCString(), + mimeSvc->GetFromTypeAndExtension(aMimeType, aExtension, getter_AddRefs(mimeInfo)); if (mimeInfo) { @@ -430,31 +445,43 @@ nsresult nsDocumentOpenInfo::DispatchContent(nsIRequest* request) { forceExternalHandling = false; } + nsAutoCString ext; + bool isPDF = + forceExternalHandling && IsContentPDF(aChannel, mContentType, &ext); + bool maybeForceInternalHandling = - forceExternalHandling && - (mozilla::StaticPrefs::browser_download_open_pdf_attachments_inline() || - mozilla::StaticPrefs::browser_download_ignore_content_disposition()); + (isPDF && + mozilla::StaticPrefs::browser_download_open_pdf_attachments_inline()) || + ( + forceExternalHandling && + mozilla::StaticPrefs::browser_download_ignore_content_disposition() && + // we want to exclude html and svg files, which could execute + // scripts (tor-browser#43211) + kNotFound == mContentType.LowerCaseFindASCII("html") && + kNotFound == ext.LowerCaseFindASCII("htm") && + kNotFound == mContentType.LowerCaseFindASCII("/svg+") && + !ext.EqualsIgnoreCase("svg")); // Check if this is a PDF which should be opened internally. We also handle // octet-streams that look like they might be PDFs based on their extension. + // Additionally, we try to avoid downloading also non-PDF attachments + // when the general Content-Disposition override preference is set to true. if (maybeForceInternalHandling) { - // For a PDF, check if the preference is set that forces attachments to be - // opened inline. If so, treat it as a non-attachment by clearing + // Preferences are set to open attachments inline by clearing // 'forceExternalHandling' again. This allows it open a PDF directly // instead of downloading it first. It may still end up being handled by // a helper app depending anyway on the later checks. - nsCString mimeType = IsContentPDF(aChannel, mContentType) - ? nsLiteralCString(APPLICATION_PDF) - : mContentType; - auto result = ShouldHandleExternally(mimeType); + // This may apply to other file types if an internal handler exists. + auto result = ShouldHandleExternally( + isPDF ? nsLiteralCString(APPLICATION_PDF) : mContentType, ext); if (result.isErr()) { return result.unwrapErr(); } forceExternalHandling = result.unwrap(); - // If we're not opening the PDF externally we block it if it's sandboxed. + // If we're not opening the file externally and it's sandboxed we block it. if (IsSandboxed(aChannel) && !forceExternalHandling) { - LOG(("Blocked sandboxed PDF")); + LOG(("Blocked sandboxed file")); nsCOMPtr<nsIHttpChannel> httpChannel = do_QueryInterface(aChannel); if (httpChannel) { nsContentSecurityUtils::LogMessageToConsole( View it on GitLab: https://gitlab.torproject.org/tpo/applications/mullvad-browser/-/commit/a29… -- View it on GitLab: https://gitlab.torproject.org/tpo/applications/mullvad-browser/-/commit/a29… You're receiving this email because of your account on gitlab.torproject.org.

1 0

[Git][tpo/applications/tor-browser-build][maint-14.5] Bug 41554: Export SIGNING_PROJECTNAME and tbb_version in linux-signer-sign-android-apks
by boklm (＠boklm) 29 Aug '25

29 Aug '25

boklm pushed to branch maint-14.5 at The Tor Project / Applications / tor-browser-build Commits: 7bbac89c by Nicolas Vigier at 2025-08-29T12:59:32+02:00 Bug 41554: Export SIGNING_PROJECTNAME and tbb_version in linux-signer-sign-android-apks Following the changes from 821c192ed9def86b92a20bc8878a7c519230996f, wrappers/sign-apk is now using those variables. - - - - - 1 changed file: - tools/signing/linux-signer-sign-android-apks Changes: ===================================== tools/signing/linux-signer-sign-android-apks ===================================== @@ -8,8 +8,9 @@ source "$script_dir/functions" topdir="$script_dir/../.." ARCHS="armv7 aarch64 x86 x86_64" projname=$(project-name) -# tbb_version_type is used in wrappers/sign-apk, so we export it -export tbb_version_type +# tbb_version_type, tbb_version and SIGNING_PROJECTNAME are used in +# wrappers/sign-apk, so we export them +export tbb_version tbb_version_type SIGNING_PROJECTNAME check_installed_packages() { local packages='unzip openjdk-11-jdk-headless openjdk-11-jre-headless' View it on GitLab: https://gitlab.torproject.org/tpo/applications/tor-browser-build/-/commit/7… -- View it on GitLab: https://gitlab.torproject.org/tpo/applications/tor-browser-build/-/commit/7… You're receiving this email because of your account on gitlab.torproject.org.

1 0

[Git][tpo/applications/tor-browser][base-browser-140.2.0esr-15.0-1] fixup! BB 42220: Allow for more file types to be forced-inline.
by ma1 (＠ma1) 29 Aug '25

29 Aug '25

ma1 pushed to branch base-browser-140.2.0esr-15.0-1 at The Tor Project / Applications / Tor Browser Commits: 181f221a by hackademix at 2025-08-29T12:55:38+02:00 fixup! BB 42220: Allow for more file types to be forced-inline. BB 44140: Align PDF changes to 140esr Firefox allows to open some files in the browser without any confirmation, but this will result in a disk leak, because the file will be downloaded to the temporary directory first (and not deleted, in some cases). A preference allows PDFs to be opened without being downloaded to disk. So, we introduce a similar one to do the same for all the files that are set to be opened automatically in the browser, except svg and html files to prevent XSS hazards (see BB 43211). - - - - - 1 changed file: - uriloader/base/nsURILoader.cpp Changes: ===================================== uriloader/base/nsURILoader.cpp ===================================== @@ -320,7 +320,11 @@ NS_IMETHODIMP nsDocumentOpenInfo::OnStopRequest(nsIRequest* request, return NS_OK; } -static bool IsContentPDF(nsIChannel* aChannel, const nsACString& aContentType) { +static bool IsContentPDF( + nsIChannel* aChannel, const nsACString& aContentType, + nsAutoCString* aOutExt = + nullptr // best-guess file extension, useful for non-PDFs +) { bool isPDF = aContentType.LowerCaseEqualsASCII(APPLICATION_PDF); if (!isPDF && (aContentType.LowerCaseEqualsASCII(APPLICATION_OCTET_STREAM) || aContentType.IsEmpty())) { @@ -328,14 +332,25 @@ static bool IsContentPDF(nsIChannel* aChannel, const nsACString& aContentType) { aChannel->GetContentDispositionFilename(flname); isPDF = StringEndsWith(flname, u".pdf"_ns); if (!isPDF) { + nsAutoCString ext; nsCOMPtr<nsIURI> uri; aChannel->GetURI(getter_AddRefs(uri)); nsCOMPtr<nsIURL> url(do_QueryInterface(uri)); if (url) { - nsAutoCString ext; url->GetFileExtension(ext); isPDF = ext.EqualsLiteral("pdf"); } + if (aOutExt) { + // Fill the extension out param if required + if (!(isPDF || flname.IsEmpty())) { + // For non PDFs, fallback to filename from content disposition + int32_t extStart = flname.RFindChar(u'.'); + if (extStart != kNotFound) { + CopyUTF16toUTF8(Substring(flname, extStart + 1), ext); + } + } + *aOutExt = ext; + } } } @@ -343,7 +358,7 @@ static bool IsContentPDF(nsIChannel* aChannel, const nsACString& aContentType) { } static mozilla::Result<bool, nsresult> ShouldHandleExternally( - const nsACString& aMimeType) { + const nsACString& aMimeType, const nsACString& aExtension) { // For a PDF, check if the preference is set that forces attachments to be // opened inline. If so, treat it as a non-attachment by clearing // 'forceExternalHandling' again. This allows it open a PDF directly @@ -356,7 +371,7 @@ static mozilla::Result<bool, nsresult> ShouldHandleExternally( return mozilla::Err(NS_ERROR_FAILURE); } - mimeSvc->GetFromTypeAndExtension(aMimeType, EmptyCString(), + mimeSvc->GetFromTypeAndExtension(aMimeType, aExtension, getter_AddRefs(mimeInfo)); if (mimeInfo) { @@ -430,31 +445,43 @@ nsresult nsDocumentOpenInfo::DispatchContent(nsIRequest* request) { forceExternalHandling = false; } + nsAutoCString ext; + bool isPDF = + forceExternalHandling && IsContentPDF(aChannel, mContentType, &ext); + bool maybeForceInternalHandling = - forceExternalHandling && - (mozilla::StaticPrefs::browser_download_open_pdf_attachments_inline() || - mozilla::StaticPrefs::browser_download_ignore_content_disposition()); + (isPDF && + mozilla::StaticPrefs::browser_download_open_pdf_attachments_inline()) || + ( + forceExternalHandling && + mozilla::StaticPrefs::browser_download_ignore_content_disposition() && + // we want to exclude html and svg files, which could execute + // scripts (tor-browser#43211) + kNotFound == mContentType.LowerCaseFindASCII("html") && + kNotFound == ext.LowerCaseFindASCII("htm") && + kNotFound == mContentType.LowerCaseFindASCII("/svg+") && + !ext.EqualsIgnoreCase("svg")); // Check if this is a PDF which should be opened internally. We also handle // octet-streams that look like they might be PDFs based on their extension. + // Additionally, we try to avoid downloading also non-PDF attachments + // when the general Content-Disposition override preference is set to true. if (maybeForceInternalHandling) { - // For a PDF, check if the preference is set that forces attachments to be - // opened inline. If so, treat it as a non-attachment by clearing + // Preferences are set to open attachments inline by clearing // 'forceExternalHandling' again. This allows it open a PDF directly // instead of downloading it first. It may still end up being handled by // a helper app depending anyway on the later checks. - nsCString mimeType = IsContentPDF(aChannel, mContentType) - ? nsLiteralCString(APPLICATION_PDF) - : mContentType; - auto result = ShouldHandleExternally(mimeType); + // This may apply to other file types if an internal handler exists. + auto result = ShouldHandleExternally( + isPDF ? nsLiteralCString(APPLICATION_PDF) : mContentType, ext); if (result.isErr()) { return result.unwrapErr(); } forceExternalHandling = result.unwrap(); - // If we're not opening the PDF externally we block it if it's sandboxed. + // If we're not opening the file externally and it's sandboxed we block it. if (IsSandboxed(aChannel) && !forceExternalHandling) { - LOG(("Blocked sandboxed PDF")); + LOG(("Blocked sandboxed file")); nsCOMPtr<nsIHttpChannel> httpChannel = do_QueryInterface(aChannel); if (httpChannel) { nsContentSecurityUtils::LogMessageToConsole( View it on GitLab: https://gitlab.torproject.org/tpo/applications/tor-browser/-/commit/181f221… -- View it on GitLab: https://gitlab.torproject.org/tpo/applications/tor-browser/-/commit/181f221… You're receiving this email because of your account on gitlab.torproject.org.

1 0

[Git][tpo/applications/tor-browser-build][main] Bug 41522: Adapt signing scripts for tor-vpn
by boklm (＠boklm) 29 Aug '25

29 Aug '25

boklm pushed to branch main at The Tor Project / Applications / tor-browser-build Commits: 821c192e by Nicolas Vigier at 2025-08-29T12:16:22+02:00 Bug 41522: Adapt signing scripts for tor-vpn - - - - - 30 changed files: - rbm.conf - tools/signing/do-all-signing - + tools/signing/do-all-signing.torvpn - tools/signing/functions - + tools/signing/linux-signer-gpg-sign.torvpn - + tools/signing/linux-signer-sign-android-aab - + tools/signing/linux-signer-sign-android-aab.torvpn - tools/signing/linux-signer-sign-android-apks - + tools/signing/linux-signer-sign-android-apks.torvpn - tools/signing/machines-setup/setup-signing-machine - + tools/signing/machines-setup/sudoers.d/sign-aab - tools/signing/machines-setup/sudoers.d/sign-apk - tools/signing/set-config - + tools/signing/staticiforme-prepare-cdn-dist-upload.torvpn - + tools/signing/sync-builder-to-local.torvpn - + tools/signing/sync-builder-to-local.torvpn.dry-run - + tools/signing/sync-builder-unsigned-to-local-signed.torvpn - + tools/signing/sync-builder-unsigned-to-local-signed.torvpn.dry-run - + tools/signing/sync-linux-signer-to-local.torvpn - + tools/signing/sync-linux-signer-to-local.torvpn.dry-run - + tools/signing/sync-local-to-builder.torvpn - + tools/signing/sync-local-to-builder.torvpn.dry-run - + tools/signing/sync-local-to-linux-signer.torvpn - + tools/signing/sync-local-to-linux-signer.torvpn.dry-run - + tools/signing/sync-local-to-staticiforme.torvpn - + tools/signing/sync-local-to-staticiforme.torvpn.dry-run - + tools/signing/sync-scripts-to-linux-signer.torvpn - + tools/signing/sync-scripts-to-linux-signer.torvpn.dry-run - + tools/signing/wrappers/sign-aab - tools/signing/wrappers/sign-apk Changes: ===================================== rbm.conf ===================================== @@ -97,8 +97,8 @@ var: # enable/disable all android or desktop platforms. If you want to # check whether a release includes some android or desktop platforms # see signing_android and signing_desktop below. - is_android_release: '[% c("var/tor-browser") %]' - is_desktop_release: '1' + is_android_release: '[% c("var/tor-browser") || c("var/tor-vpn") %]' + is_desktop_release: '[% ! c("var/tor-vpn") %]' # signing_android is used in signing scripts to check if at least # one android platform is being signed/published @@ -328,6 +328,18 @@ targets: max_torbrowser_incremental_from: 2 build_infos_json: 1 + torvpn: + var: + tor-vpn: 1 + torbrowser_version: '1.0.0Beta' + torbrowser_build: 'build1' + browser_release_date: '2025/08/28 15:33:44' + project-name: tor-vpn + projectname: torvpn + Project_Name: 'Tor VPN' + ProjectName: TorVPN + project_initials: tv + torbrowser: var: tor-browser: 1 ===================================== tools/signing/do-all-signing ===================================== @@ -67,7 +67,7 @@ echo echo [ -z "$platform_android" ] || \ - [ -f "$steps_dir/linux-signer-sign-android-apks.done" ] || \ + [ -f "$steps_dir/sync-after-sign-android-apks.done" ] || \ [ -n "$KSPASS" ] || \ read -sp "Enter android apk signing password ($tbb_version_type): " KSPASS echo @@ -155,6 +155,14 @@ EOF unset KSPASS } +function linux-signer-sign-android-aab { + ssh "$ssh_host_linux_signer" 'bash -s' << EOF + export KSPASS=$KSPASS + ~/signing-$SIGNING_PROJECTNAME-$tbb_version_type/linux-signer-sign-android-aab.$SIGNING_PROJECTNAME +EOF + unset KSPASS +} + function sync-after-sign-android-apks { "$script_dir/sync-linux-signer-to-local" } @@ -257,6 +265,8 @@ do_step sync-before-linux-signer-signmars do_step sync-after-signmars [ -n "$platform_android" ] && \ do_step linux-signer-sign-android-apks +[ "$SIGNING_PROJECTNAME" = 'torvpn' ] && [ -n "$platform_android" ] && \ + do_step linux-signer-sign-android-aab [ -n "$platform_android" ] && \ do_step sync-after-sign-android-apks [ -n "$platform_windows" ] && \ @@ -275,6 +285,6 @@ do_step download-unsigned-sha256sums-gpg-signatures-from-people-tpo do_step sync-local-to-staticiforme do_step sync-scripts-to-staticiforme do_step staticiforme-prepare-cdn-dist-upload -! is_legacy && \ +[ "$SIGNING_PROJECTNAME" != 'torvpn' ] && ! is_legacy \ do_step upload-update_responses-to-staticiforme do_step finished-signing-clean-linux-signer ===================================== tools/signing/do-all-signing.torvpn ===================================== @@ -0,0 +1 @@ +do-all-signing \ No newline at end of file ===================================== tools/signing/functions ===================================== @@ -14,6 +14,7 @@ function var_is_defined { } function check_update_responses_repository_dir { + test "$SIGNING_PROJECTNAME" = 'torvpn' && return 0 if test -z "$update_responses_repository_dir" || ! test -d "$update_responses_repository_dir" then cat << 'EOF' > /dev/stderr ===================================== tools/signing/linux-signer-gpg-sign.torvpn ===================================== @@ -0,0 +1 @@ +linux-signer-gpg-sign \ No newline at end of file ===================================== tools/signing/linux-signer-sign-android-aab ===================================== @@ -0,0 +1,46 @@ +#!/bin/bash + +set -e +no_generate_config=1 +script_dir=$( cd -- "$( dirname -- "${BASH_SOURCE[0]}" )" &> /dev/null && pwd ) +source "$script_dir/functions" + +topdir="$script_dir/../.." +test "$SIGNING_PROJECTNAME" = 'torvpn' +projname=$(project-name) +# tbb_version_type, tbb_version and SIGNING_PROJECTNAME are used in +# wrappers/sign-apk, so we export them +export tbb_version tbb_version_type SIGNING_PROJECTNAME +# (note: we should also export SIGNING_PROJECTNAME and tbb_version in +# the maint-14.5 branch) + +check_installed_packages() { + local packages='unzip openjdk-11-jdk-headless openjdk-11-jre-headless' + for package in $packages + do + dpkg -s "$package" | grep -q '^Status: install ok installed$' || \ + exit_error "package $package is missing" + done +} + +sign_aab() { + sudo -u signing-apk -- /signing/tor-browser-build/tools/signing/wrappers/sign-aab +} + +check_installed_packages + +if [ -z "$KSPASS" ]; then + echo "Enter keystore passphrase" + stty -echo; read KSPASS; stty echo + export KSPASS +fi + +cp -af ~/"$SIGNING_PROJECTNAME-$tbb_version"/$projname-$tbb_version.aab \ + /home/signing-apk/unsigned-files/"$SIGNING_PROJECTNAME-$tbb_version_type.aab" + +sign_aab + +cp /home/signing-apk/signed-files/"$SIGNING_PROJECTNAME-$tbb_version_type.aab" \ + ~/"$SIGNING_PROJECTNAME-$tbb_version"/$projname-$tbb_version.aab +rm /home/signing-apk/signed-files/"$SIGNING_PROJECTNAME-$tbb_version_type.aab" +rm /home/signing-apk/unsigned-files/"$SIGNING_PROJECTNAME-$tbb_version_type.aab" ===================================== tools/signing/linux-signer-sign-android-aab.torvpn ===================================== @@ -0,0 +1 @@ +linux-signer-sign-android-aab \ No newline at end of file ===================================== tools/signing/linux-signer-sign-android-apks ===================================== @@ -7,9 +7,11 @@ source "$script_dir/functions" topdir="$script_dir/../.." ARCHS="armv7 aarch64 x86 x86_64" +test "$SIGNING_PROJECTNAME" = 'torvpn' && ARCHS='multiarch' projname=$(project-name) -# tbb_version_type is used in wrappers/sign-apk, so we export it -export tbb_version_type +# tbb_version_type, tbb_version and SIGNING_PROJECTNAME are used in +# wrappers/sign-apk, so we export them +export tbb_version tbb_version_type SIGNING_PROJECTNAME check_installed_packages() { local packages='unzip openjdk-11-jdk-headless openjdk-11-jre-headless' @@ -21,10 +23,11 @@ check_installed_packages() { } setup_build_tools() { + abt_version=16 build_tools_dir=/signing/android-build-tools - test -f "$build_tools_dir"/android-12/apksigner || \ - exit_error "$build_tools_dir/android-12/apksigner is missing" - export PATH="$build_tools_dir/android-12:${PATH}" + test -f "$build_tools_dir"/android-$abt_version/apksigner || \ + exit_error "$build_tools_dir/android-$abt_version/apksigner is missing" + export PATH="$build_tools_dir/android-$abt_version:${PATH}" } sign_apk() { @@ -36,7 +39,6 @@ verify_apk() { scheme_v1="Verified using v1 scheme (JAR signing): true" scheme_v2="Verified using v2 scheme (APK Signature Scheme v2): true" - # Verify the expected signing key was used, Alpha verses Release based on the filename. if test "$tbb_version_type" = "alpha"; then cert_digest="Signer #1 certificate SHA-256 digest: 15f760b41acbe4783e667102c9f67119be2af62fab07763f9d57f01e5e1074e1" pubkey_digest="Signer #1 public key SHA-256 digest: 4e617e6516f81123ca58e718d617a704ac8365c575bd9e7a731ba5dd0476869d" @@ -44,7 +46,14 @@ verify_apk() { cert_digest="Signer #1 certificate SHA-256 digest: 20061f045e737c67375c17794cfedb436a03cec6bacb7cb9f96642205ca2cec8" pubkey_digest="Signer #1 public key SHA-256 digest: 343ca8a2e5452670bdc335a181a4baed909f868937d68c4653e44ef84de8dfc6" fi + if test "$SIGNING_PROJECTNAME" = "torvpn"; then + # No v1 scheme signature on torvpn apk + scheme_v1='' + cert_digest="Signer #1 certificate SHA-256 digest: c2f6ffa30e56a7c53a226248ef908612ee539df2f52bede5a55037425b83331d" + pubkey_digest="Signer #1 public key SHA-256 digest: fddc5f93ae0bc971e951481b0b5e6b62e47040fe979ff535cf75daade2f13f3d" + fi for digest in "${scheme_v1}" "${scheme_v2}" "${cert_digest}" "${pubkey_digest}"; do + test -z "$digest" && continue if ! echo "${verified}" | grep -q "${digest}"; then echo "Expected digest not found:" echo ${digest} @@ -69,8 +78,10 @@ mkdir -p ~/"$SIGNING_PROJECTNAME-$tbb_version-apks" chgrp signing ~/"$SIGNING_PROJECTNAME-$tbb_version-apks" chmod g+w ~/"$SIGNING_PROJECTNAME-$tbb_version-apks" cp -af ~/"$SIGNING_PROJECTNAME-$tbb_version"/*.apk \ - ~/"$SIGNING_PROJECTNAME-$tbb_version"/*.bspatch \ ~/"$SIGNING_PROJECTNAME-$tbb_version-apks" +test "$SIGNING_PROJECTNAME" != 'torvpn' && \ + cp -af ~/"$SIGNING_PROJECTNAME-$tbb_version"/*.bspatch \ + ~/"$SIGNING_PROJECTNAME-$tbb_version-apks" cd ~/"$SIGNING_PROJECTNAME-$tbb_version-apks" # Sign all packages @@ -79,7 +90,8 @@ for arch in ${ARCHS}; do unsigned_apk=${projname}-qa-unsigned-android-${arch}-${tbb_version}.apk unsigned_apk_bspatch=${projname}-qa-unsign-android-${arch}-${tbb_version}.bspatch signed_apk=${projname}-android-${arch}-${tbb_version}.apk - bspatch "$qa_apk" "$unsigned_apk" "$unsigned_apk_bspatch" + test -f "$unsigned_apk" || \ + bspatch "$qa_apk" "$unsigned_apk" "$unsigned_apk_bspatch" sign_apk "$unsigned_apk" "$signed_apk" verify_apk "$signed_apk" cp -f "$signed_apk" ~/"$SIGNING_PROJECTNAME-$tbb_version" ===================================== tools/signing/linux-signer-sign-android-apks.torvpn ===================================== @@ -0,0 +1 @@ +linux-signer-sign-android-apks \ No newline at end of file ===================================== tools/signing/machines-setup/setup-signing-machine ===================================== @@ -91,6 +91,7 @@ sudoers_file sign-gpg sudoers_file sign-mar sudoers_file sign-exe sudoers_file sign-apk +sudoers_file sign-aab sudoers_file sign-rcodesign sudoers_file sign-rcodesign-128 sudoers_file set-date @@ -105,6 +106,10 @@ authorized_keys ma1 ma1.pub create_user pierov signing authorized_keys pierov pierov.pub +mkdir -p /home/signing-apk/unsigned-files /home/signing-apk/signed-files +chgrp signing /home/signing-apk/unsigned-files /home/signing-apk/signed-files +chmod g+rwx /home/signing-apk/unsigned-files /home/signing-apk/signed-files + # Install rbm deps install_packages libyaml-libyaml-perl libtemplate-perl libdatetime-perl \ libio-handle-util-perl libio-all-perl \ ===================================== tools/signing/machines-setup/sudoers.d/sign-aab ===================================== @@ -0,0 +1,2 @@ +Defaults>signing-apk env_keep += "SIGNING_PROJECTNAME tbb_version tbb_version_type KSPASS" +%signing ALL = (signing-apk) NOPASSWD: /signing/tor-browser-build/tools/signing/wrappers/sign-aab ===================================== tools/signing/machines-setup/sudoers.d/sign-apk ===================================== @@ -1,2 +1,2 @@ -Defaults>signing-apk env_keep += "SIGNING_PROJECTNAME tbb_version_type KSPASS" +Defaults>signing-apk env_keep += "SIGNING_PROJECTNAME tbb_version tbb_version_type KSPASS" %signing ALL = (signing-apk) NOPASSWD: /signing/tor-browser-build/tools/signing/wrappers/sign-apk ===================================== tools/signing/set-config ===================================== @@ -16,6 +16,7 @@ test -n "${SIGNING_PROJECTNAME+x}" \ test "$SIGNING_PROJECTNAME" = 'torbrowser' \ || test "$SIGNING_PROJECTNAME" = 'basebrowser' \ || test "$SIGNING_PROJECTNAME" = 'mullvadbrowser' \ + || test "$SIGNING_PROJECTNAME" = 'torvpn' \ || exit_error "Unknown SIGNING_PROJECTNAME $SIGNING_PROJECTNAME" export SIGNING_PROJECTNAME ===================================== tools/signing/staticiforme-prepare-cdn-dist-upload.torvpn ===================================== @@ -0,0 +1 @@ +staticiforme-prepare-cdn-dist-upload \ No newline at end of file ===================================== tools/signing/sync-builder-to-local.torvpn ===================================== @@ -0,0 +1 @@ +sync-builder-to-local \ No newline at end of file ===================================== tools/signing/sync-builder-to-local.torvpn.dry-run ===================================== @@ -0,0 +1 @@ +sync-builder-to-local \ No newline at end of file ===================================== tools/signing/sync-builder-unsigned-to-local-signed.torvpn ===================================== @@ -0,0 +1 @@ +sync-builder-unsigned-to-local-signed \ No newline at end of file ===================================== tools/signing/sync-builder-unsigned-to-local-signed.torvpn.dry-run ===================================== @@ -0,0 +1 @@ +sync-builder-unsigned-to-local-signed \ No newline at end of file ===================================== tools/signing/sync-linux-signer-to-local.torvpn ===================================== @@ -0,0 +1 @@ +sync-linux-signer-to-local \ No newline at end of file ===================================== tools/signing/sync-linux-signer-to-local.torvpn.dry-run ===================================== @@ -0,0 +1 @@ +sync-linux-signer-to-local \ No newline at end of file ===================================== tools/signing/sync-local-to-builder.torvpn ===================================== @@ -0,0 +1 @@ +sync-local-to-builder \ No newline at end of file ===================================== tools/signing/sync-local-to-builder.torvpn.dry-run ===================================== @@ -0,0 +1 @@ +sync-local-to-builder \ No newline at end of file ===================================== tools/signing/sync-local-to-linux-signer.torvpn ===================================== @@ -0,0 +1 @@ +sync-local-to-linux-signer \ No newline at end of file ===================================== tools/signing/sync-local-to-linux-signer.torvpn.dry-run ===================================== @@ -0,0 +1 @@ +sync-local-to-linux-signer \ No newline at end of file ===================================== tools/signing/sync-local-to-staticiforme.torvpn ===================================== @@ -0,0 +1 @@ +sync-local-to-staticiforme \ No newline at end of file ===================================== tools/signing/sync-local-to-staticiforme.torvpn.dry-run ===================================== @@ -0,0 +1 @@ +sync-local-to-staticiforme \ No newline at end of file ===================================== tools/signing/sync-scripts-to-linux-signer.torvpn ===================================== @@ -0,0 +1 @@ +sync-scripts-to-linux-signer \ No newline at end of file ===================================== tools/signing/sync-scripts-to-linux-signer.torvpn.dry-run ===================================== @@ -0,0 +1 @@ +sync-scripts-to-linux-signer \ No newline at end of file ===================================== tools/signing/wrappers/sign-aab ===================================== @@ -0,0 +1,41 @@ +#!/bin/bash +set -e + +function exit_error { + for msg in "$@" + do + echo "$msg" >&2 + done + exit 1 +} + +case "$SIGNING_PROJECTNAME" in + torbrowser | mullvadbrowser | torvpn) + ;; + *) + exit_error "Unexpected value for SIGNING_PROJECTNAME: $SIGNING_PROJECTNAME" + ;; +esac + +case "$tbb_version_type" in + release | alpha) + ;; + *) + exit_error "Unexpected value for tbb_version_type: $tbb_version_type" + ;; +esac + +android_signing_key_dir=/home/signing-apk/keys +android_signing_key_path="$android_signing_key_dir/torvpn.p12" +test -f "$android_signing_key_path" || exit_error "$android_signing_key_path is missing" + +tmpdir=$(mktemp -d) +cd "$tmpdir" + +jarsigner -keystore "${android_signing_key_path}" -storepass:env KSPASS \ + -signedjar /home/signing-apk/signed-files/"$SIGNING_PROJECTNAME-$tbb_version_type.aab" \ + -verbose /home/signing-apk/unsigned-files/"$SIGNING_PROJECTNAME-$tbb_version_type.aab" \ + tor-vpn + +cd - +rm -Rf "$tmpdir" ===================================== tools/signing/wrappers/sign-apk ===================================== @@ -14,15 +14,30 @@ if test "$tbb_version_type" != 'release' \ exit_error "Unexpected value for tbb_version_type: $tbb_version_type" fi +case "$SIGNING_PROJECTNAME" in + torbrowser | mullvadbrowser | torvpn) + ;; + *) + exit_error "Unexpected value for SIGNING_PROJECTNAME: $SIGNING_PROJECTNAME" + ;; +esac + android_signing_key_dir=/home/signing-apk/keys -android_signing_key_path="$android_signing_key_dir/tba_$tbb_version_type.p12" +android_signing_key_path="$android_signing_key_dir/$pname_$tbb_version_type.p12" +test -n "$SIGNING_PROJECTNAME" && test "$SIGNING_PROJECTNAME" = 'torvpn' && \ + android_signing_key_path="$android_signing_key_dir/torvpn.p12" test -f "$android_signing_key_path" || exit_error "$android_signing_key_path is missing" setup_build_tools() { + abt_version=16 + # If signing 14.5, keep using android-12 build tools + # (we can remove this when 15.0 is the stable release) + ( test -z "$tbb_version" || echo "$tbb_version" | grep -q '^14\.5' ) && \ + abt_version=12 build_tools_dir=/signing/android-build-tools - test -f "$build_tools_dir"/android-12/apksigner || \ - exit_error "$build_tools_dir/android-12/apksigner is missing" - export PATH="$build_tools_dir/android-12:${PATH}" + test -f "$build_tools_dir"/android-$abt_version/apksigner || \ + exit_error "$build_tools_dir/android-$abt_version/apksigner is missing" + export PATH="$build_tools_dir/android-$abt_version:${PATH}" } # Sign individual apk View it on GitLab: https://gitlab.torproject.org/tpo/applications/tor-browser-build/-/commit/8… -- View it on GitLab: https://gitlab.torproject.org/tpo/applications/tor-browser-build/-/commit/8… You're receiving this email because of your account on gitlab.torproject.org.

1 0

[Git][tpo/applications/tor-browser] Pushed new tag tor-browser-140.2.0esr-15.0-1-build3
by ma1 (＠ma1) 29 Aug '25

29 Aug '25

ma1 pushed new tag tor-browser-140.2.0esr-15.0-1-build3 at The Tor Project / Applications / Tor Browser -- View it on GitLab: https://gitlab.torproject.org/tpo/applications/tor-browser/-/tree/tor-brows… You're receiving this email because of your account on gitlab.torproject.org.

1 0

[Git][tpo/applications/tor-browser][tor-browser-140.2.0esr-15.0-1] 2 commits: Revert "BB 42220: Allow for more file types to be forced-inline."
by ma1 (＠ma1) 29 Aug '25

29 Aug '25

ma1 pushed to branch tor-browser-140.2.0esr-15.0-1 at The Tor Project / Applications / Tor Browser Commits: 0539d9c3 by hackademix at 2025-08-29T12:21:36+02:00 Revert "BB 42220: Allow for more file types to be forced-inline." This reverts commit 90dbc9451a30f7d68384e26fe38517534bf7e302. - - - - - 2e79fc22 by Pier Angelo Vendrame at 2025-08-29T12:21:38+02:00 BB 42220: Allow for more file types to be forced-inline. Firefox allows to open some files in the browser without any confirmation, but this will result in a disk leak, because the file will be downloaded to the temporary directory first (and not deleted, in some cases). A preference allows PDFs to be opened without being downloaded to disk. So, we introduce a similar one to do the same for all the files that are set to be opened automatically in the browser, except svg and html files to prevent XSS hazards (see BB 43211). - - - - - 1 changed file: - uriloader/base/nsURILoader.cpp Changes: ===================================== uriloader/base/nsURILoader.cpp ===================================== @@ -320,7 +320,11 @@ NS_IMETHODIMP nsDocumentOpenInfo::OnStopRequest(nsIRequest* request, return NS_OK; } -static bool IsContentPDF(nsIChannel* aChannel, const nsACString& aContentType) { +static bool IsContentPDF( + nsIChannel* aChannel, const nsACString& aContentType, + nsAutoCString* aOutExt = + nullptr // best-guess file extension, useful for non-PDFs +) { bool isPDF = aContentType.LowerCaseEqualsASCII(APPLICATION_PDF); if (!isPDF && (aContentType.LowerCaseEqualsASCII(APPLICATION_OCTET_STREAM) || aContentType.IsEmpty())) { @@ -328,14 +332,25 @@ static bool IsContentPDF(nsIChannel* aChannel, const nsACString& aContentType) { aChannel->GetContentDispositionFilename(flname); isPDF = StringEndsWith(flname, u".pdf"_ns); if (!isPDF) { + nsAutoCString ext; nsCOMPtr<nsIURI> uri; aChannel->GetURI(getter_AddRefs(uri)); nsCOMPtr<nsIURL> url(do_QueryInterface(uri)); if (url) { - nsAutoCString ext; url->GetFileExtension(ext); isPDF = ext.EqualsLiteral("pdf"); } + if (aOutExt) { + // Fill the extension out param if required + if (!(isPDF || flname.IsEmpty())) { + // For non PDFs, fallback to filename from content disposition + int32_t extStart = flname.RFindChar(u'.'); + if (extStart != kNotFound) { + CopyUTF16toUTF8(Substring(flname, extStart + 1), ext); + } + } + *aOutExt = ext; + } } } @@ -343,7 +358,7 @@ static bool IsContentPDF(nsIChannel* aChannel, const nsACString& aContentType) { } static mozilla::Result<bool, nsresult> ShouldHandleExternally( - const nsACString& aMimeType) { + const nsACString& aMimeType, const nsACString& aExtension) { // For a PDF, check if the preference is set that forces attachments to be // opened inline. If so, treat it as a non-attachment by clearing // 'forceExternalHandling' again. This allows it open a PDF directly @@ -356,7 +371,7 @@ static mozilla::Result<bool, nsresult> ShouldHandleExternally( return mozilla::Err(NS_ERROR_FAILURE); } - mimeSvc->GetFromTypeAndExtension(aMimeType, EmptyCString(), + mimeSvc->GetFromTypeAndExtension(aMimeType, aExtension, getter_AddRefs(mimeInfo)); if (mimeInfo) { @@ -430,31 +445,43 @@ nsresult nsDocumentOpenInfo::DispatchContent(nsIRequest* request) { forceExternalHandling = false; } + nsAutoCString ext; + bool isPDF = + forceExternalHandling && IsContentPDF(aChannel, mContentType, &ext); + bool maybeForceInternalHandling = - forceExternalHandling && - (mozilla::StaticPrefs::browser_download_open_pdf_attachments_inline() || - mozilla::StaticPrefs::browser_download_ignore_content_disposition()); + (isPDF && + mozilla::StaticPrefs::browser_download_open_pdf_attachments_inline()) || + ( + forceExternalHandling && + mozilla::StaticPrefs::browser_download_ignore_content_disposition() && + // we want to exclude html and svg files, which could execute + // scripts (tor-browser#43211) + kNotFound == mContentType.LowerCaseFindASCII("html") && + kNotFound == ext.LowerCaseFindASCII("htm") && + kNotFound == mContentType.LowerCaseFindASCII("/svg+") && + !ext.EqualsIgnoreCase("svg")); // Check if this is a PDF which should be opened internally. We also handle // octet-streams that look like they might be PDFs based on their extension. + // Additionally, we try to avoid downloading also non-PDF attachments + // when the general Content-Disposition override preference is set to true. if (maybeForceInternalHandling) { - // For a PDF, check if the preference is set that forces attachments to be - // opened inline. If so, treat it as a non-attachment by clearing + // Preferences are set to open attachments inline by clearing // 'forceExternalHandling' again. This allows it open a PDF directly // instead of downloading it first. It may still end up being handled by // a helper app depending anyway on the later checks. - nsCString mimeType = IsContentPDF(aChannel, mContentType) - ? nsLiteralCString(APPLICATION_PDF) - : mContentType; - auto result = ShouldHandleExternally(mimeType); + // This may apply to other file types if an internal handler exists. + auto result = ShouldHandleExternally( + isPDF ? nsLiteralCString(APPLICATION_PDF) : mContentType, ext); if (result.isErr()) { return result.unwrapErr(); } forceExternalHandling = result.unwrap(); - // If we're not opening the PDF externally we block it if it's sandboxed. + // If we're not opening the file externally and it's sandboxed we block it. if (IsSandboxed(aChannel) && !forceExternalHandling) { - LOG(("Blocked sandboxed PDF")); + LOG(("Blocked sandboxed file")); nsCOMPtr<nsIHttpChannel> httpChannel = do_QueryInterface(aChannel); if (httpChannel) { nsContentSecurityUtils::LogMessageToConsole( View it on GitLab: https://gitlab.torproject.org/tpo/applications/tor-browser/-/compare/893598… -- View it on GitLab: https://gitlab.torproject.org/tpo/applications/tor-browser/-/compare/893598… You're receiving this email because of your account on gitlab.torproject.org.

1 0

[Git][tpo/applications/tor-browser][tor-browser-140.2.0esr-15.0-1] fixup! TB 40041 [android]: Implement Tor Network Settings
by clairehurst (＠clairehurst) 28 Aug '25

28 Aug '25

clairehurst pushed to branch tor-browser-140.2.0esr-15.0-1 at The Tor Project / Applications / Tor Browser Commits: 89359823 by clairehurst at 2025-08-28T11:03:40-07:00 fixup! TB 40041 [android]: Implement Tor Network Settings Better fix for #44036 Crash on opening "Search Settings" on android - - - - - 1 changed file: - mobile/android/fenix/app/src/main/java/org/mozilla/fenix/settings/SettingsFragment.kt Changes: ===================================== mobile/android/fenix/app/src/main/java/org/mozilla/fenix/settings/SettingsFragment.kt ===================================== @@ -12,6 +12,7 @@ import android.os.Build import android.os.Bundle import android.os.Handler import android.os.Looper +import android.os.StrictMode import android.util.Log import android.view.LayoutInflater import android.view.View @@ -37,7 +38,6 @@ import kotlinx.coroutines.CoroutineScope import kotlinx.coroutines.Dispatchers import kotlinx.coroutines.delay import kotlinx.coroutines.launch -import kotlinx.coroutines.runBlocking import mozilla.components.browser.state.state.selectedOrDefaultSearchEngine import mozilla.components.concept.engine.Engine import mozilla.components.concept.sync.AccountObserver @@ -191,7 +191,7 @@ class SettingsFragment : PreferenceFragmentCompat(), UserInteractionHandler { } override fun onCreatePreferences(savedInstanceState: Bundle?, rootKey: String?) { - runBlocking(context = Dispatchers.IO) { + requireContext().components.strictMode.resetAfter(StrictMode.allowThreadDiskReads()) { setPreferencesFromResource(R.xml.preferences, rootKey) } } View it on GitLab: https://gitlab.torproject.org/tpo/applications/tor-browser/-/commit/8935982… -- View it on GitLab: https://gitlab.torproject.org/tpo/applications/tor-browser/-/commit/8935982… You're receiving this email because of your account on gitlab.torproject.org.

1 0

[Git][tpo/applications/tor-browser][tor-browser-140.2.0esr-15.0-1] fixup! TB 42891: Set the bundled search engine for Tor Browser.
by Pier Angelo Vendrame (＠pierov) 28 Aug '25

28 Aug '25

Pier Angelo Vendrame pushed to branch tor-browser-140.2.0esr-15.0-1 at The Tor Project / Applications / Tor Browser Commits: 55e239b2 by Pier Angelo Vendrame at 2025-08-28T18:17:11+02:00 fixup! TB 42891: Set the bundled search engine for Tor Browser. TB 43525: Move search engine customization to SearchEngineSelector. - - - - - 3 changed files: - toolkit/components/search/SearchEngineSelector.sys.mjs - toolkit/components/search/SearchService.sys.mjs - toolkit/components/search/content/torBrowserSearchEngines.json Changes: ===================================== toolkit/components/search/SearchEngineSelector.sys.mjs ===================================== @@ -2,6 +2,8 @@ * License, v. 2.0. If a copy of the MPL was not distributed with this * file, You can obtain one at http://mozilla.org/MPL/2.0/. */ +import { AppConstants } from "resource://gre/modules/AppConstants.sys.mjs"; + /** * @typedef {import("../uniffi-bindgen-gecko-js/components/generated/RustSearch.sys.mjs").SearchEngineSelector} RustSearchEngineSelector * We use "Rust" above to avoid conflict with the class name for the JavaScript wrapper. @@ -92,30 +94,13 @@ export class SearchEngineSelector { return this._getConfigurationPromise; } - this._getConfigurationPromise = Promise.all([ - this._getConfiguration(), - this._getConfigurationOverrides(), - ]); - let remoteSettingsData = await this._getConfigurationPromise; - this._configuration = remoteSettingsData[0]; - this._configurationOverrides = remoteSettingsData[1]; - delete this._getConfigurationPromise; - - if (!this._configuration?.length) { - throw Components.Exception( - "Failed to get engine data from Remote Settings", - Cr.NS_ERROR_UNEXPECTED - ); - } - - if (!this._listenerAdded) { - this._remoteConfig.on("sync", this._onConfigurationUpdated); - this._remoteConfigOverrides.on( - "sync", - this._onConfigurationOverridesUpdated - ); - this._listenerAdded = true; - } + let { promise, resolve } = Promise.withResolvers(); + this._getConfigurationPromise = promise; + this._configuration = await ( + await fetch("chrome://global/content/search/torBrowserSearchEngines.json") + ).json(); + this._configurationOverrides = []; + resolve(this._configuration); if (lazy.SearchUtils.rustSelectorFeatureGate) { this.#selector.setSearchConfig( @@ -242,6 +227,12 @@ export class SearchEngineSelector { * The new configuration object */ _onConfigurationUpdated({ data: { current } }) { + // tor-browser#43525: Even though RemoteSettings are a no-op for us, we do + // not want them to interfere in any way. + if (AppConstants.BASE_BROWSER_VERSION) { + return; + } + this._configuration = current; if (lazy.SearchUtils.rustSelectorFeatureGate) { @@ -268,6 +259,12 @@ export class SearchEngineSelector { * The new configuration object */ _onConfigurationOverridesUpdated({ data: { current } }) { + // tor-browser#43525: Even though RemoteSettings are a no-op for us, we do + // not want them to interfere in any way. + if (AppConstants.BASE_BROWSER_VERSION) { + return; + } + this._configurationOverrides = current; if (lazy.SearchUtils.rustSelectorFeatureGate) { ===================================== toolkit/components/search/SearchService.sys.mjs ===================================== @@ -2628,11 +2628,21 @@ export class SearchService { // This is prefixed with _ rather than # because it is // called in test_remove_engine_notification_box.js async _fetchEngineSelectorEngines() { - // tor-browser#43525: Check this still works. - const engines = await ( - await fetch("chrome://global/content/search/torBrowserSearchEngines.json") - ).json(); - return { engines, privateDefault: undefined }; + let searchEngineSelectorProperties = { + locale: "en-US", + region: lazy.Region.home || "unknown", + channel: lazy.SearchUtils.MODIFIED_APP_CHANNEL, + experiment: this._experimentPrefValue, + distroID: lazy.SearchUtils.distroID ?? "", + }; + + for (let [key, value] of Object.entries(searchEngineSelectorProperties)) { + this._settings.setMetaDataAttribute(key, value); + } + + return this.#engineSelector.fetchEngineConfiguration( + searchEngineSelectorProperties + ); } #setDefaultFromSelector(refinedConfig) { ===================================== toolkit/components/search/content/torBrowserSearchEngines.json ===================================== @@ -1,78 +1,127 @@ [ { - "aliases": ["duckduckgo", "ddg"], - "name": "DuckDuckGo", - "urls": { - "search": { - "base": "https://duckduckgo.com/", - "params": [], - "searchTermParamName": "q" + "base": { + "aliases": ["duckduckgo", "ddg"], + "classification": "general", + "name": "DuckDuckGo", + "urls": { + "search": { + "base": "https://duckduckgo.com/", + "params": [], + "searchTermParamName": "q" + } } }, "id": "04e99a38-13ee-47d8-8aa4-64482b3dea99", "identifier": "ddg", "recordType": "engine", - "variants": [] + "variants": [ + { + "environment": { + "allRegionsAndLocales": true + } + } + ] }, { - "aliases": ["ddgonion"], - "name": "DuckDuckGo (.onion)", - "urls": { - "search": { - "base": "https://duckduckgogg42xjoc72x3sjasowoarfbgcmvfimaftt6twagswzczad.onion/", - "params": [], - "searchTermParamName": "q" + "base": { + "aliases": ["ddgonion"], + "classification": "general", + "name": "DuckDuckGo (.onion)", + "urls": { + "search": { + "base": "https://duckduckgogg42xjoc72x3sjasowoarfbgcmvfimaftt6twagswzczad.onion/", + "params": [], + "searchTermParamName": "q" + } } }, "id": "1e431da4-a60c-4411-9251-a95a841d451f", "identifier": "ddg-onion", "recordType": "engine", - "variants": [] + "variants": [ + { + "environment": { + "allRegionsAndLocales": true + } + } + ] }, { - "aliases": ["startpage"], - "name": "Startpage", - "urls": { - "search": { - "base": "https://www.startpage.com/sp/search", - "params": [], - "searchTermParamName": "q" + "base": { + "aliases": ["startpage"], + "classification": "general", + "name": "Startpage", + "urls": { + "search": { + "base": "https://www.startpage.com/sp/search", + "params": [], + "searchTermParamName": "q" + } } }, "id": "927bbd9f-b2f3-48b4-8974-1c1148028f4d", "identifier": "startpage", "recordType": "engine", - "variants": [] + "variants": [ + { + "environment": { + "allRegionsAndLocales": true + } + } + ] }, { - "aliases": ["startpage-onion"], - "name": "Startpage (.onion)", - "urls": { - "search": { - "base": "http://startpagel6srwcjlue4zgq3zevrujfaow726kjytqbbjyrswwmjzcqd.onion/sp/se…", - "params": [], - "searchTermParamName": "q" + "base": { + "aliases": ["startpage-onion"], + "classification": "general", + "name": "Startpage (.onion)", + "urls": { + "search": { + "base": "http://startpagel6srwcjlue4zgq3zevrujfaow726kjytqbbjyrswwmjzcqd.onion/sp/se…", + "params": [], + "searchTermParamName": "q" + } } }, "id": "e7eaba8d-6b9e-43fb-a799-b01b096c03ff", "identifier": "startpage-onion", "recordType": "engine", - "variants": [] + "variants": [ + { + "environment": { + "allRegionsAndLocales": true + } + } + ] }, { - "aliases": ["wikipedia"], - "classification": "unknown", - "name": "Wikipedia (en)", - "urls": { - "search": { - "base": "https://en.wikipedia.org/wiki/Special:Search", - "params": [], - "searchTermParamName": "search" + "base": { + "aliases": ["wikipedia"], + "classification": "unknown", + "name": "Wikipedia (en)", + "urls": { + "search": { + "base": "https://en.wikipedia.org/wiki/Special:Search", + "params": [], + "searchTermParamName": "search" + } } }, "id": "7f6d23c2-191e-483e-af3a-ce6451e3a8dd", "identifier": "wikipedia", "recordType": "engine", - "variants": [] + "variants": [ + { + "environment": { + "allRegionsAndLocales": true + } + } + ] + }, + { + "recordType": "defaultEngines", + "globalDefault": "ddg", + "globalDefaultPrivate": "ddg" } ] View it on GitLab: https://gitlab.torproject.org/tpo/applications/tor-browser/-/commit/55e239b… -- View it on GitLab: https://gitlab.torproject.org/tpo/applications/tor-browser/-/commit/55e239b… You're receiving this email because of your account on gitlab.torproject.org.

1 0

[Git][tpo/applications/tor-browser][tor-browser-140.2.0esr-15.0-1] fixup! [android] Disable features and functionality
by brizental (＠brizental) 28 Aug '25

28 Aug '25

brizental pushed to branch tor-browser-140.2.0esr-15.0-1 at The Tor Project / Applications / Tor Browser Commits: 7c85c4fd by Beatriz Rizental at 2025-08-28T09:34:49-06:00 fixup! [android] Disable features and functionality - - - - - 1 changed file: - mobile/android/fenix/app/src/main/java/org/mozilla/fenix/HomeActivity.kt Changes: ===================================== mobile/android/fenix/app/src/main/java/org/mozilla/fenix/HomeActivity.kt ===================================== @@ -378,35 +378,8 @@ open class HomeActivity : LocaleAwareAppCompatActivity(), NavHostActivity, TorAn } } - SplashScreenManager( - splashScreenOperation = if (FxNimbus.features.splashScreen.value().offTrainOnboarding) { - ApplyExperimentsOperation( - storage = DefaultExperimentsOperationStorage(components.settings), - nimbus = components.nimbus.sdk, - ) - } else { - FetchExperimentsOperation( - storage = DefaultExperimentsOperationStorage(components.settings), - nimbus = components.nimbus.sdk, - ) - }, - scope = lifecycleScope, - splashScreenTimeout = FxNimbus.features.splashScreen.value().maximumDurationMs.toLong(), - isDeviceSupported = { Build.VERSION.SDK_INT > Build.VERSION_CODES.M }, - storage = DefaultSplashScreenStorage(components.settings), - showSplashScreen = { installSplashScreen().setKeepOnScreenCondition(it) }, - onSplashScreenFinished = { result -> - if (result.sendTelemetry) { - SplashScreen.firstLaunchExtended.record( - SplashScreen.FirstLaunchExtendedExtra(dataFetched = result.wasDataFetched), - ) - } - - if (savedInstanceState == null && shouldShowOnboarding) { - navHost.navController.navigate(NavGraphDirections.actionGlobalOnboarding()) - } - }, - ).showSplashScreen() + // tor-browser#43730: Do not delay splash screen + // to fetch or apply Nimbus experiments. lifecycleScope.launch { val debugSettingsRepository = DefaultDebugSettingsRepository( View it on GitLab: https://gitlab.torproject.org/tpo/applications/tor-browser/-/commit/7c85c4f… -- View it on GitLab: https://gitlab.torproject.org/tpo/applications/tor-browser/-/commit/7c85c4f… You're receiving this email because of your account on gitlab.torproject.org.

1 0

[Git][tpo/applications/tor-browser][tor-browser-140.2.0esr-15.0-1] 2 commits: fixup! BB 41803: Add some developer tools for working on tor-browser.
by brizental (＠brizental) 28 Aug '25

28 Aug '25

brizental pushed to branch tor-browser-140.2.0esr-15.0-1 at The Tor Project / Applications / Tor Browser Commits: 36c2b42c by Beatriz Rizental at 2025-08-28T13:39:19+02:00 fixup! BB 41803: Add some developer tools for working on tor-browser. - - - - - cf409afb by Beatriz Rizental at 2025-08-28T13:40:28+02:00 fixup! Add CI for Base Browser - - - - - 19 changed files: - .gitlab-ci.yml - .gitlab/ci/jobs/lint/helpers.py → .gitlab/ci/jobs/helpers.py - .gitlab/ci/jobs/lint/lint.yml - + .gitlab/ci/jobs/test/python-test.yml - .gitlab/ci/jobs/update-translations.yml - − tools/base-browser/l10n/combine/tests/README - tools/base-browser/git-rebase-fixup-preprocessor → tools/base_browser/git-rebase-fixup-preprocessor - tools/base-browser/l10n/combine-translation-versions.py → tools/base_browser/l10n/combine-translation-versions.py - tools/base-browser/l10n/combine/__init__.py → tools/base_browser/l10n/combine/__init__.py - tools/base-browser/l10n/combine/combine.py → tools/base_browser/l10n/combine/combine.py - tools/base-browser/l10n/combine/tests/__init__.py → tools/base_browser/l10n/combine/tests/__init__.py - + tools/base_browser/l10n/combine/tests/python.toml - tools/base-browser/l10n/combine/tests/test_android.py → tools/base_browser/l10n/combine/tests/test_android.py - tools/base-browser/l10n/combine/tests/test_dtd.py → tools/base_browser/l10n/combine/tests/test_dtd.py - tools/base-browser/l10n/combine/tests/test_fluent.py → tools/base_browser/l10n/combine/tests/test_fluent.py - tools/base-browser/l10n/combine/tests/test_properties.py → tools/base_browser/l10n/combine/tests/test_properties.py - tools/base-browser/missing-css-variables.py → tools/base_browser/missing-css-variables.py - tools/base-browser/tb-dev → tools/base_browser/tb-dev - tools/moz.build Changes: ===================================== .gitlab-ci.yml ===================================== @@ -1,6 +1,7 @@ stages: - update-container-images - lint + - test - startup-test - update-translations @@ -11,6 +12,7 @@ variables: include: - local: '.gitlab/ci/mixins.yml' - local: '.gitlab/ci/jobs/lint/lint.yml' + - local: '.gitlab/ci/jobs/test/python-test.yml' - local: '.gitlab/ci/jobs/startup-test/startup-test.yml' - local: '.gitlab/ci/jobs/update-containers.yml' - local: '.gitlab/ci/jobs/update-translations.yml' ===================================== .gitlab/ci/jobs/lint/helpers.py → .gitlab/ci/jobs/helpers.py ===================================== @@ -112,7 +112,7 @@ if __name__ == "__main__": parser.add_argument( "--get-changed-files", help="Get list of changed files." - "When running from a merge request get sthe list of changed files since the merge-base of the current branch." + "When running from a merge request gets the list of changed files since the merge-base of the current branch." "When running from a protected branch i.e. any branch that starts with <something>-browser-, gets the list of files changed since the FIREFOX_ tag.", action="store_true", ) ===================================== .gitlab/ci/jobs/lint/lint.yml ===================================== @@ -18,7 +18,7 @@ lint-all: - firefox script: - ./mach configure --with-base-browser-version=0.0.0 - - .gitlab/ci/jobs/lint/helpers.py --get-changed-files | xargs -0 --no-run-if-empty ./mach lint -v + - .gitlab/ci/jobs/helpers.py --get-changed-files | xargs -0 --no-run-if-empty ./mach lint -v rules: - if: $CI_PIPELINE_SOURCE == 'merge_request_event' # Run job whenever a commit is merged to a protected branch ===================================== .gitlab/ci/jobs/test/python-test.yml ===================================== @@ -0,0 +1,24 @@ +python-test: + extends: .with-local-repo-bash + stage: test + image: $IMAGE_PATH + interruptible: true + variables: + MOZBUILD_STATE_PATH: "/var/tmp/mozbuild" + cache: + paths: + - node_modules + # Store the cache regardless on job outcome + when: 'always' + # Share the cache throughout all pipelines running for a given branch + key: $CI_COMMIT_REF_SLUG + tags: + # Run these jobs in the browser dedicated runners. + - firefox + script: + - ./mach configure --with-base-browser-version=0.0.0 + - .gitlab/ci/jobs/helpers.py --get-changed-files | xargs -0 --no-run-if-empty ./mach python-test -v + rules: + - if: $CI_PIPELINE_SOURCE == 'merge_request_event' || ($CI_COMMIT_BRANCH && $CI_COMMIT_REF_PROTECTED == 'true' && $CI_PIPELINE_SOURCE == 'push') + changes: + - "**/test_*.py" ===================================== .gitlab/ci/jobs/update-translations.yml ===================================== @@ -102,7 +102,7 @@ combine-en-US-translations: # push-en-US-translations job. - echo 'COMBINE_TRANSLATIONS_JOB_ID='"$CI_JOB_ID" >job_id.env - pip install compare_locales - - python ./tools/base-browser/l10n/combine-translation-versions.py "$CI_COMMIT_BRANCH" "$TRANSLATION_FILES" "$COMBINED_FILES_JSON" + - python ./tools/base_browser/l10n/combine-translation-versions.py "$CI_COMMIT_BRANCH" "$TRANSLATION_FILES" "$COMBINED_FILES_JSON" push-en-US-translations: extends: .update-translation-base ===================================== tools/base-browser/l10n/combine/tests/README deleted ===================================== @@ -1,2 +0,0 @@ -python tests to be run with pytest. -Requires the compare-locales package. ===================================== tools/base-browser/git-rebase-fixup-preprocessor → tools/base_browser/git-rebase-fixup-preprocessor ===================================== ===================================== tools/base-browser/l10n/combine-translation-versions.py → tools/base_browser/l10n/combine-translation-versions.py ===================================== ===================================== tools/base-browser/l10n/combine/__init__.py → tools/base_browser/l10n/combine/__init__.py ===================================== ===================================== tools/base-browser/l10n/combine/combine.py → tools/base_browser/l10n/combine/combine.py ===================================== ===================================== tools/base-browser/l10n/combine/tests/__init__.py → tools/base_browser/l10n/combine/tests/__init__.py ===================================== ===================================== tools/base_browser/l10n/combine/tests/python.toml ===================================== @@ -0,0 +1,10 @@ +[DEFAULT] +subsuite = "base-browser" + +["test_android.py"] + +["test_dtd.py"] + +["test_fluent.py"] + +["test_properties.py"] ===================================== tools/base-browser/l10n/combine/tests/test_android.py → tools/base_browser/l10n/combine/tests/test_android.py ===================================== @@ -1,6 +1,7 @@ import textwrap -from combine import combine_files +import mozunit +from base_browser.l10n.combine import combine_files def wrap_in_xml(content): @@ -413,3 +414,7 @@ def test_alternatives(): <string name="string_4_alt">Other string</string> """, ) + + +if __name__ == "__main__": + mozunit.main() ===================================== tools/base-browser/l10n/combine/tests/test_dtd.py → tools/base_browser/l10n/combine/tests/test_dtd.py ===================================== @@ -1,6 +1,7 @@ import textwrap -from combine import combine_files +import mozunit +from base_browser.l10n.combine import combine_files def assert_result(new_content, old_content, expect): @@ -411,3 +412,7 @@ def test_alternatives(): <!ENTITY string.4.alt "Other string"> """, ) + + +if __name__ == "__main__": + mozunit.main() ===================================== tools/base-browser/l10n/combine/tests/test_fluent.py → tools/base_browser/l10n/combine/tests/test_fluent.py ===================================== @@ -1,6 +1,7 @@ import textwrap -from combine import combine_files +import mozunit +from base_browser.l10n.combine import combine_files def assert_result(new_content, old_content, expect): @@ -475,3 +476,7 @@ def test_alternatives(): -string-4-alt = Other string """, ) + + +if __name__ == "__main__": + mozunit.main() ===================================== tools/base-browser/l10n/combine/tests/test_properties.py → tools/base_browser/l10n/combine/tests/test_properties.py ===================================== @@ -1,6 +1,7 @@ import textwrap -from combine import combine_files +import mozunit +from base_browser.l10n.combine import combine_files def assert_result(new_content, old_content, expect): @@ -408,3 +409,7 @@ def test_alternatives(): string.4.alt = Other string """, ) + + +if __name__ == "__main__": + mozunit.main() ===================================== tools/base-browser/missing-css-variables.py → tools/base_browser/missing-css-variables.py ===================================== ===================================== tools/base-browser/tb-dev → tools/base_browser/tb-dev ===================================== ===================================== tools/moz.build ===================================== @@ -71,6 +71,7 @@ with Files("tryselect/docs/**"): SCHEDULES.exclusive = ["docs"] PYTHON_UNITTEST_MANIFESTS += [ + "base_browser/l10n/combine/tests/python.toml", "fuzzing/smoke/python.toml", "lint/test/python.toml", "tryselect/test/python.toml", View it on GitLab: https://gitlab.torproject.org/tpo/applications/tor-browser/-/compare/acb604… -- View it on GitLab: https://gitlab.torproject.org/tpo/applications/tor-browser/-/compare/acb604… You're receiving this email because of your account on gitlab.torproject.org.

1 0

[Git][tpo/applications/tor-browser] Pushed new branch tor-browser-143.0a1-16.0-1
by brizental (＠brizental) 28 Aug '25

28 Aug '25

brizental pushed new branch tor-browser-143.0a1-16.0-1 at The Tor Project / Applications / Tor Browser -- View it on GitLab: https://gitlab.torproject.org/tpo/applications/tor-browser/-/tree/tor-brows… You're receiving this email because of your account on gitlab.torproject.org.

1 0