- tbb-commits - lists.torproject.org

[Git][tpo/applications/tor-browser-build][main] Bug 41844: Add script to backup and deploy signing keys
by morgan (＠morgan) 13 Aug '26

13 Aug '26

morgan pushed to branch main at The Tor Project / Applications / tor-browser-build Commits: 7fb9dced by Nicolas Vigier at 2026-08-12T11:49:32+02:00 Bug 41844: Add script to backup and deploy signing keys - - - - - 4 changed files: - + tools/signing/machines-setup/.gitignore - tools/signing/machines-setup/README.md - + tools/signing/machines-setup/backup-signing-keys - + tools/signing/machines-setup/deploy-signing-keys Changes: ===================================== tools/signing/machines-setup/.gitignore ===================================== @@ -0,0 +1 @@ +signing-keys ===================================== tools/signing/machines-setup/README.md ===================================== @@ -1,7 +1,8 @@ This directory contains the scripts used to setup the signing machines. -It handles everything in the setup, except installation of the signing -keys, which is done manually. +It handles everything in the setup. Installation (and backup) of the +signing keys, is handled separately, using the `deploy-signing-keys` / +`backup-signing-keys` script. # Deploying changes on the signing machines @@ -35,3 +36,20 @@ required packages, create user accounts and setup signing tools. After running `upload-tbb-to-signing-machine`, open a root shell on the signing machine and run `/signing/tor-browser-build/tools/signing/machines-setup/setup-signing-machine`. + +## backup-signing-keys & deploy-signing-keys + +Those two scripts takes as argument the ssh hostname of the signing +machine you want to backup keys from, or deploy keys on. You need to be +able to connect as root the the signing machine with ssh. + +When doing backup of the signing keys it will store the signing keys in +directory local directory `signing-keys` (relative to the script). + +When deploying signing keys, it will take the keys from directory +`signing-keys`. If deploying a new machine, you should have run +`setup-signing-machine` on it before deploying keys. + +Both scripts can take the `--dry-run` argument to run rsync with +`--dry-run` to show the files that would be transfered without storing +the changes. ===================================== tools/signing/machines-setup/backup-signing-keys ===================================== @@ -0,0 +1 @@ +deploy-signing-keys \ No newline at end of file ===================================== tools/signing/machines-setup/deploy-signing-keys ===================================== @@ -0,0 +1,200 @@ +#!/bin/perl -w + +# This script is used to backup and deploy signing keys from/to a signing machine. +# +# The script takes as argument the ssh hostname of the signing machine. +# +# Use `--dry-run` to show what would be done without applying the changes. +# +# See README.md for more details. + +use strict; +use English; +use FindBin; +use File::Basename; +use File::Path qw(make_path); +use Getopt::Long; +use Capture::Tiny qw/tee/; + +my %signing_keys = ( + + gpg => { + 'private-keys-v1.d' => { + path => '/home/signing-gpg/.gnupg/private-keys-v1.d', + owner => 'signing-gpg', + }, + pubring => { + path => '/home/signing-gpg/.gnupg/pubring.kbx', + owner => 'signing-gpg', + }, + }, + + win => { + tpo_cert => { + path => '/home/signing-win/keys/key-1/the_tor_project_inc.crt', + owner => 'signing-win', + }, + tpo_key => { + path => '/home/signing-win/keys/key-1/private.pem', + owner => 'signing-win', + }, + }, + + mar => { + torbrowser_nssdb7 => { + path => '/home/signing-mar/nssdb/torbrowser-nssdb7', + owner => 'signing-mar', + }, + mullvadbrowser_nssdb_1 => { + path => '/home/signing-mar/nssdb/mullvadbrowser-nssdb-1', + owner => 'signing-mar', + }, + }, + + macos => { + key_1 => { + path => '/home/signing-macos/keys/key-1.p12', + owner => 'signing-macos', + }, + }, + + aab => { + torvpn => { + path => '/home/signing-apk/keys/torvpn.p12', + owner => 'signing-apk', + }, + }, + + apk => { + tba_release => { + path => '/home/signing-apk/keys/tba_release.p12', + owner => 'signing-apk', + }, + tba_alpha => { + path => '/home/signing-apk/keys/tba_alpha.p12', + owner => 'signing-apk', + }, + torvpn => { + path => '/home/signing-apk/keys/torvpn.p12', + owner => 'signing-apk', + }, + }, + +); + +my $backup_dir = "$FindBin::Bin/signing-keys"; +my $signing_machine; +my $dry_run; + +sub exit_error { + print STDERR "Error: ", $_[0], "\n"; + chdir '/'; + exit (exists $_[1] ? $_[1] : 1); +} + +my @errors; +sub set_error { + my $error = join("\n", @_); + print STDERR $error, "\n"; + push @errors, $error; +} + +sub print_errors { + return unless @errors; + my $nb_errors = @errors; + print STDERR "There was $nb_errors errors:\n"; + my $i = 1; + for my $error (@errors) { + print STDERR "*** Error $i:\n$error\n"; + $i += 1; + } + print STDERR "\n"; +} + +sub run_cmd { + my (@cmd) = @_; + my $txt_cmd = join(' ', @cmd); + print "Running $txt_cmd\n"; + my $exit_code; + my ($stdout, $stderr) = tee { + $exit_code = system(@cmd); + }; + return if $exit_code == 0; + set_error("Error running $txt_cmd:\n$stderr"); +} + +sub backup_key { + my ($dir, $keyname) = @_; + print "Backing up $signing_keys{$dir}{$keyname}{path}\n"; + make_path("$backup_dir/$dir") unless -d "$backup_dir/$dir"; + my @cmd = ('rsync', '-avi', '--chmod=F0600,D0700', $dry_run ? ($dry_run) : (), + "root\@$signing_machine:$signing_keys{$dir}{$keyname}{path}", + "$backup_dir/$dir/$keyname"); + run_cmd(@cmd); +} + +sub backup_signing_keys { + foreach my $dir (keys %signing_keys) { + foreach my $keyname (keys %{$signing_keys{$dir}}) { + backup_key($dir, $keyname); + } + } +} + +sub deploy_key { + my ($dir, $keyname) = @_; + print "Deploying $signing_keys{$dir}{$keyname}{path}\n"; + my @cmd = ('rsync', '-avi', '--no-owner', '--no-group', $dry_run ? ($dry_run) : (), + '--chmod=F0600,D0700', "--chown=$signing_keys{$dir}{$keyname}{owner}", + "$backup_dir/$dir/$keyname", "root\@$signing_machine:$signing_keys{$dir}{$keyname}{path}"); + if (!-e "$backup_dir/$dir/$keyname") { + set_error("Missing file or directory $backup_dir/$dir/$keyname", + "Cannot deploy $signing_keys{$dir}{$keyname}{path}"); + return; + } + run_cmd(@cmd); +} + +sub confirm_deploy { + return if $dry_run; + print "Are you sure you want to deploy keys to $signing_machine?\n"; + print "This will overwrite existing files.\n"; + print "You can check the changes before applying them with '--dry-run'\n"; + print "Enter 'yes' to validate.\n"; + my $word = <STDIN>; + chomp $word; + return if lc($word) eq 'yes'; + print STDERR "Not doing anything.\n"; + exit 1; +} + +sub deploy_signing_keys { + confirm_deploy; + foreach my $dir (keys %signing_keys) { + foreach my $keyname (keys %{$signing_keys{$dir}}) { + deploy_key($dir, $keyname); + } + } +} + +sub set_options { + my @options = qw(dry-run); + my %val; + Getopt::Long::GetOptionsFromArray(\@_, \%val, @options) || exit 1; + $dry_run = '--dry-run' if $val{'dry-run'}; + exit_error "Usage: $PROGRAM_NAME [--dry-run] <signing-machine>" unless @_ == 1; + $signing_machine = $_[0]; +} + +my %actions = ( + 'deploy-signing-keys' => \&deploy_signing_keys, + 'backup-signing-keys' => \&backup_signing_keys, +); + +set_options(@ARGV); + +my $action = fileparse($PROGRAM_NAME); +exit_error "Unknown action $action" unless $actions{$action}; +$actions{$action}->($signing_machine); + +print_errors; View it on GitLab: https://gitlab.torproject.org/tpo/applications/tor-browser-build/-/commit/7… -- View it on GitLab: https://gitlab.torproject.org/tpo/applications/tor-browser-build/-/commit/7… You're receiving this email because of your account on gitlab.torproject.org. Manage all notifications: https://gitlab.torproject.org/-/profile/notifications | Help: https://gitlab.torproject.org/help

1 0

[Git][tpo/applications/tor-browser] Pushed new branch tor-browser-154.0a1-17.0-2
by Pier Angelo Vendrame (＠pierov) 12 Aug '26

12 Aug '26

Pier Angelo Vendrame pushed new branch tor-browser-154.0a1-17.0-2 at The Tor Project / Applications / Tor Browser -- View it on GitLab: https://gitlab.torproject.org/tpo/applications/tor-browser/-/tree/tor-brows… You're receiving this email because of your account on gitlab.torproject.org. Manage all notifications: https://gitlab.torproject.org/-/profile/notifications | Help: https://gitlab.torproject.org/help

1 0

[Git][tpo/applications/tor-browser] Pushed new branch tor-browser-140.14.0esr-15.0-1
by Pier Angelo Vendrame (＠pierov) 12 Aug '26

12 Aug '26

Pier Angelo Vendrame pushed new branch tor-browser-140.14.0esr-15.0-1 at The Tor Project / Applications / Tor Browser -- View it on GitLab: https://gitlab.torproject.org/tpo/applications/tor-browser/-/tree/tor-brows… You're receiving this email because of your account on gitlab.torproject.org. Manage all notifications: https://gitlab.torproject.org/-/profile/notifications | Help: https://gitlab.torproject.org/help

1 0

[Git][tpo/applications/tor-browser] Pushed new branch tor-browser-153.1.0esr-16.0-1
by Pier Angelo Vendrame (＠pierov) 12 Aug '26

12 Aug '26

Pier Angelo Vendrame pushed new branch tor-browser-153.1.0esr-16.0-1 at The Tor Project / Applications / Tor Browser -- View it on GitLab: https://gitlab.torproject.org/tpo/applications/tor-browser/-/tree/tor-brows… You're receiving this email because of your account on gitlab.torproject.org. Manage all notifications: https://gitlab.torproject.org/-/profile/notifications | Help: https://gitlab.torproject.org/help

1 0

[Git][tpo/applications/tor-browser][tor-browser-153.0esr-16.0-1] 3 commits: fixup! BB 42027: Base Browser migration procedures.
by Pier Angelo Vendrame (＠pierov) 12 Aug '26

12 Aug '26

Pier Angelo Vendrame pushed to branch tor-browser-153.0esr-16.0-1 at The Tor Project / Applications / Tor Browser Commits: de436cdf by Henry Wilkes at 2026-08-11T15:56:46+01:00 fixup! BB 42027: Base Browser migration procedures. BB 45197: Clear password settings for hidden controls. - - - - - bf6247a4 by Henry Wilkes at 2026-08-11T15:56:47+01:00 fixup! BB 44711: Hide unwanted setting controls in Base Browser. BB 45197: Hide the password controls if there is no password database. - - - - - 873a7d2e by Henry Wilkes at 2026-08-11T15:57:37+01:00 fixup! Base Browser strings BB 45197: Password manager unavailable banner string. - - - - - 3 changed files: - browser/components/ProfileDataUpgrader.sys.mjs - browser/components/preferences/config/passwords-autofill.mjs - toolkit/locales/en-US/toolkit/global/base-browser.ftl Changes: ===================================== browser/components/ProfileDataUpgrader.sys.mjs ===================================== @@ -1051,6 +1051,8 @@ export let ProfileDataUpgrader = { // Version 7: 16.0a10: Reset safe browsing preferences. tor-browser#44802. // Also reset delete downloads preferences. // tor-browser#45187. + // Also reset password manager preferences. + // tor-browser#45197. const MIGRATION_VERSION = 7; const MIGRATION_PREF = "basebrowser.migration.version"; @@ -1167,9 +1169,24 @@ export let ProfileDataUpgrader = { // re-offer this feature again in the future. tor-browser#45187. "browser.download.deletePrivate", "browser.download.deletePrivate.chosen", + // Clear the password breach alert preference since it does not work. + // tor-browser#45197. + "signon.management.page.breach-alerts.enabled", ]) { Services.prefs.clearUserPref(prefName); } + if (Services.prefs.getBoolPref("security.nocertdb", true)) { + // Password manager does not read or write passwords from the database. + // We want to clear the preferences that no longer have any visible + // controls in the settings UI. tor-browser#45197. + for (const prefName of [ + "signon.rememberSignons", + "signon.autofillForms", + "signon.generation.enabled", + ]) { + Services.prefs.clearUserPref(prefName); + } + } } Services.prefs.setIntPref(MIGRATION_PREF, MIGRATION_VERSION); }, ===================================== browser/components/preferences/config/passwords-autofill.mjs ===================================== @@ -257,6 +257,7 @@ Preferences.addAll([ { id: "signon.autofillForms", type: "bool" }, { id: "signon.management.page.breach-alerts.enabled", type: "bool" }, { id: "signon.firefoxRelay.feature", type: "string" }, + { id: "security.nocertdb", type: "bool" }, ]); Preferences.addSetting({ @@ -522,15 +523,50 @@ Preferences.addSetting( } ); +Preferences.addSetting({ + id: "canSavePasswords", + pref: "security.nocertdb", + get: pref => { + return !pref; + }, +}); + Preferences.addSetting({ id: "savePasswords", pref: "signon.rememberSignons", + deps: ["canSavePasswords"], + visible: ({ canSavePasswords }, savePasswords) => { + // Only show this option if the user has explicitly disabled "nocertdb", or + // they have somehow switched this option on. tor-browser#45197. + return canSavePasswords.value || savePasswords.value; + }, controllingExtensionInfo: { storeId: "services.passwordSavingEnabled", l10nId: "extension-controlling-password-saving", }, }); +Preferences.addSetting({ + id: "showPasswordControls", + deps: ["canSavePasswords", "savePasswords"], + get: (_pref, { canSavePasswords, savePasswords }) => { + // Only show other password controls if the user has explicitly disabled + // "nocertdb", or they have somehow switched on save passwords. + // tor-browser#45197. + return canSavePasswords.value || savePasswords.value; + }, +}); + +Preferences.addSetting({ + id: "passwordsUnsupportedBanner", + deps: ["canSavePasswords"], + visible: ({ canSavePasswords }) => { + // NOTE: We show the banner even if disabling the password controls are + // visible because "savePasswords" is true. + return !canSavePasswords.value; + }, +}); + Preferences.addSetting({ id: "managePasswordExceptions", onUserClick: () => { @@ -551,7 +587,10 @@ Preferences.addSetting({ Preferences.addSetting({ id: "requireOSAuthForPasswords", - visible: () => lazy.OSKeyStore.canReauth(), + deps: ["showPasswordControls"], + visible: ({ showPasswordControls }) => { + return showPasswordControls.value && lazy.OSKeyStore.canReauth(); + }, get: () => lazy.LoginHelper.getOSAuthEnabled(), async set(checked) { const [messageText, captionText] = await Promise.all([ @@ -585,10 +624,14 @@ Preferences.addSetting({ Preferences.addSetting({ id: "manageSavedPasswords", + deps: ["showPasswordControls"], onUserClick: () => { PasswordSettingHelpers.showPasswords(); }, - visible: () => { + visible: ({ showPasswordControls }) => { + if (!showPasswordControls.value) { + return false; + } let policy = Services.policies.getActivePolicies(); return policy?.PasswordManagerEnabled !== false; }, @@ -596,6 +639,10 @@ Preferences.addSetting({ Preferences.addSetting({ id: "additionalProtectionsGroup", + deps: ["showPasswordControls"], + visible: ({ showPasswordControls }) => { + return showPasswordControls.value; + }, }); Preferences.addSetting({ @@ -668,6 +715,10 @@ Preferences.addSetting({ Preferences.addSetting({ id: "breachAlerts", pref: "signon.management.page.breach-alerts.enabled", + // Even for users who force passwords to be enabled, we hide this because + // login breach requires "fxmonitor-breaches" remote settings, which has no + // local JSON dumps in Base Browser. tor-browser#45197. + visible: () => false, }); Preferences.addSetting({ @@ -687,6 +738,16 @@ SettingGroupManager.registerGroups({ l10nId: "forms-passwords-header", headingLevel: 2, items: [ + // Add a banner to explain that passwords are unsupported. + // tor-browser#45197. + { + id: "passwordsUnsupportedBanner", + l10nId: "passwords-settings-unsupported-banner", + control: "moz-message-bar", + controlAttr: { + role: "status", + }, + }, { id: "savePasswords", l10nId: "forms-ask-to-save-passwords", ===================================== toolkit/locales/en-US/toolkit/global/base-browser.ftl ===================================== @@ -114,6 +114,13 @@ browser-layout-show-sidebar-limited = search-suggestions-warning-banner = .message = Turning this on reduces your privacy by sharing your queries with the search engine as you type. +## Preferences - Passwords. + +# "{ -brand-short-name }" will be replaced with the localized name of the browser, e.g. "Tor Browser". +passwords-settings-unsupported-banner = + .heading = Built-in password manager isn’t supported. + .message = { -brand-short-name }’s built-in password manager is disabled by default. This prevents your anonymous browsing from being linked to your regular identity. + ## Preferences - Contrast Control. preferences-contrast-control-fixed-color2 = View it on GitLab: https://gitlab.torproject.org/tpo/applications/tor-browser/-/compare/43fea1… -- View it on GitLab: https://gitlab.torproject.org/tpo/applications/tor-browser/-/compare/43fea1… You're receiving this email because of your account on gitlab.torproject.org. Manage all notifications: https://gitlab.torproject.org/-/profile/notifications | Help: https://gitlab.torproject.org/help

1 0

[Git][tpo/applications/tor-browser] Pushed new tag FIREFOX_153_1_0esr_BUILD1
by Pier Angelo Vendrame (＠pierov) 12 Aug '26

12 Aug '26

Pier Angelo Vendrame pushed new tag FIREFOX_153_1_0esr_BUILD1 at The Tor Project / Applications / Tor Browser -- View it on GitLab: https://gitlab.torproject.org/tpo/applications/tor-browser/-/tree/FIREFOX_1… You're receiving this email because of your account on gitlab.torproject.org. Manage all notifications: https://gitlab.torproject.org/-/profile/notifications | Help: https://gitlab.torproject.org/help

1 0

[Git][tpo/applications/tor-browser] Pushed new tag FIREFOX_140_14_0esr_BUILD1
by Pier Angelo Vendrame (＠pierov) 12 Aug '26

12 Aug '26

Pier Angelo Vendrame pushed new tag FIREFOX_140_14_0esr_BUILD1 at The Tor Project / Applications / Tor Browser -- View it on GitLab: https://gitlab.torproject.org/tpo/applications/tor-browser/-/tree/FIREFOX_1… You're receiving this email because of your account on gitlab.torproject.org. Manage all notifications: https://gitlab.torproject.org/-/profile/notifications | Help: https://gitlab.torproject.org/help

1 0

[Git][tpo/applications/tor-browser-build][maint-15.0] Bug 41850: Update keyring/torbrowser.gpg for new subkey
by boklm (＠boklm) 12 Aug '26

12 Aug '26

boklm pushed to branch maint-15.0 at The Tor Project / Applications / tor-browser-build Commits: f01c77f9 by Nicolas Vigier at 2026-08-12T09:45:13+02:00 Bug 41850: Update keyring/torbrowser.gpg for new subkey Also update expiration date of the main key. - - - - - 1 changed file: - keyring/torbrowser.gpg Changes: ===================================== keyring/torbrowser.gpg ===================================== Binary files a/keyring/torbrowser.gpg and b/keyring/torbrowser.gpg differ View it on GitLab: https://gitlab.torproject.org/tpo/applications/tor-browser-build/-/commit/f… -- View it on GitLab: https://gitlab.torproject.org/tpo/applications/tor-browser-build/-/commit/f… You're receiving this email because of your account on gitlab.torproject.org. Manage all notifications: https://gitlab.torproject.org/-/profile/notifications | Help: https://gitlab.torproject.org/help

1 0

[Git][tpo/applications/tor-browser-build][main] Bug 41850: Update keyring/torbrowser.gpg for new subkey
by boklm (＠boklm) 12 Aug '26

12 Aug '26

boklm pushed to branch main at The Tor Project / Applications / tor-browser-build Commits: 7e6cd044 by Nicolas Vigier at 2026-08-11T20:10:01+02:00 Bug 41850: Update keyring/torbrowser.gpg for new subkey Also update expiration date of the main key. - - - - - 1 changed file: - keyring/torbrowser.gpg Changes: ===================================== keyring/torbrowser.gpg ===================================== Binary files a/keyring/torbrowser.gpg and b/keyring/torbrowser.gpg differ View it on GitLab: https://gitlab.torproject.org/tpo/applications/tor-browser-build/-/commit/7… -- View it on GitLab: https://gitlab.torproject.org/tpo/applications/tor-browser-build/-/commit/7… You're receiving this email because of your account on gitlab.torproject.org. Manage all notifications: https://gitlab.torproject.org/-/profile/notifications | Help: https://gitlab.torproject.org/help

1 0

[Git][tpo/applications/tor-browser-build][maint-15.0] Bug 41831: Update libevent to 2.1.13.
by Pier Angelo Vendrame (＠pierov) 12 Aug '26

12 Aug '26

Pier Angelo Vendrame pushed to branch maint-15.0 at The Tor Project / Applications / tor-browser-build Commits: a2e88ca9 by Pier Angelo Vendrame at 2026-08-11T17:31:47+02:00 Bug 41831: Update libevent to 2.1.13. Also, add nickm's key to keyrings/libevent.gpg. - - - - - 2 changed files: - keyring/libevent.gpg - projects/libevent/config Changes: ===================================== keyring/libevent.gpg ===================================== Binary files a/keyring/libevent.gpg and b/keyring/libevent.gpg differ ===================================== projects/libevent/config ===================================== @@ -1,5 +1,5 @@ # vim: filetype=yaml sw=2 -version: 2.1.12 +version: 2.1.13 git_url: https://github.com/libevent/libevent.git git_hash: 'release-[% c("version") %]-stable' tag_gpg_id: 1 View it on GitLab: https://gitlab.torproject.org/tpo/applications/tor-browser-build/-/commit/a… -- View it on GitLab: https://gitlab.torproject.org/tpo/applications/tor-browser-build/-/commit/a… You're receiving this email because of your account on gitlab.torproject.org. Manage all notifications: https://gitlab.torproject.org/-/profile/notifications | Help: https://gitlab.torproject.org/help

1 0