- tbb-commits - lists.torproject.org

[builders/tor-browser-build] branch main updated: Bug 40614: Update release templates with feedback from ma1
by gitolite role 30 Aug '22

30 Aug '22

This is an automated email from the git hooks/post-receive script. richard pushed a commit to branch main in repository builders/tor-browser-build. The following commit(s) were added to refs/heads/main by this push: new cc37607 Bug 40614: Update release templates with feedback from ma1 cc37607 is described below commit cc3760710715c4bdb49b4a10e2112103ebd6e59b Author: Richard Pospesel <richard(a)torproject.org> AuthorDate: Tue Aug 30 01:03:59 2022 +0000 Bug 40614: Update release templates with feedback from ma1 --- .gitlab/issue_templates/Release Prep - Alpha.md | 37 +++++++++----- .gitlab/issue_templates/Release Prep - Stable.md | 61 ++++++++++++++++-------- 2 files changed, 65 insertions(+), 33 deletions(-) diff --git a/.gitlab/issue_templates/Release Prep - Alpha.md b/.gitlab/issue_templates/Release Prep - Alpha.md index f6352a5..10432e1 100644 --- a/.gitlab/issue_templates/Release Prep - Alpha.md +++ b/.gitlab/issue_templates/Release Prep - Alpha.md @@ -59,11 +59,11 @@ ### **tba-translation** : https://git.torproject.org/translation.git - [ ] Fetch latest and identify new `HEAD` of `fenix-torbrowserstringsxml` branch - - [ ] `origin/fenix-torbrowserstringsxml` : `<INSERT_COMMIT_HASH_HERE>` + - [ ] `origin/fenix-torbrowserstringsxml` : `<INSERT COMMIT HASH HERE>` ### **tor-android-service** ***(Optional)***: https://git.torproject.org/tor-android-service.git - [ ] Fetch latest and identify new `HEAD` of `main` branch - - [ ] `origin/main` : `<INSERT_COMMIT_HASH_HERE>` + - [ ] `origin/main` : `<INSERT COMMIT HASH HERE>` ### ***Security Vulnerabilities Backport*** : https://www.mozilla.org/en-US/security/advisories/ - [ ] Go through any `Security Vulnerabilities fixed in Firefox $(RR_VERSION)` (or similar) and create list of CVEs which affect Android that need to be a backported @@ -114,8 +114,13 @@ - Message : `Hg tag $(ESR_TAG)` - [ ] Push new branch and tag to origin - [ ] Rebase `tor-browser` patches - - [ ] Perform rangediff to ensure nothing weird happened resolving conflicts - - `git range-diff $(ESR_TAG_PREV)..$(TOR_BROWSER_BRANCH_PREV) $(ESR_TAG)..$(TOR_BROWSER_BRANCH)` + - [ ] Compare patch-sets (ensure nothing *weird* happened during rebase): + - [ ] rangediff: `git range-diff $(ESR_TAG_PREV)..$(TOR_BROWSER_BRANCH_PREV) $(ESR_TAG)..$(TOR_BROWSER_BRANCH)` + - [ ] diff of diffs: + - Do the diff between `current_patchset.diff` and `rebased_patchset.diff` with your preferred `$(DIFF_TOOL)` and look at differences on lines that starts with + or - + - [ ] `git diff $(ESR_TAG_PREV)..$(TOR_BROWSER_BRANCH_PREV) > current_patchset.diff` + - [ ] `git diff $(ESR_TAG)..$(TOR_BROWSER_BRANCH) > rebased_patchset.diff` + - [ ] `$(DIFF_TOOL) current_patchset.dif rebased_patchset.deff` - [ ] Open MR for the rebase - [ ] Sign/Tag `base-browser` commit: - **NOTE** : Currently we are using the `Bug 27511: Add new identity button to toolbar` commit as the dividing line between `base-browser` and `tor-browser` @@ -139,8 +144,8 @@ Tor Browser Alpha (and Nightly) are on the `main` branch, while Stable lives in - [ ] Update `rbm.conf` - [ ] `var/torbrowser_version` : update to next version - [ ] `var/torbrowser_build` : update to `$(TOR_BROWSER_BUILD_N)` -- [ ] `var/torbrowser_incremental_from` : update to previous version - - [ ] **IMPORTANT**: Really *actually* make sure this is the previous Desktop version or else the `make incrementals-*` step will fail + - [ ] ***(Desktop Only)*** `var/torbrowser_incremental_from` : update to previous Desktop version + - [ ] **IMPORTANT**: Really *actually* make sure this is the previous Desktop version or else the `make incrementals-*` step will fail - [ ] Update `projects/firefox/config` - [ ] `git_hash` : update the `$(BUILD_N)` section to match `tor-browser` tag - [ ] ***(Optional)*** `var/firefox_platform_version` : update to latest `$(ESR_VERSION)` if rebased @@ -154,13 +159,15 @@ Tor Browser Alpha (and Nightly) are on the `main` branch, while Stable lives in - [ ] Update `projects/tor-android-service/config` - [ ] `git_hash` : update with `HEAD` commit of project's `main` branch - [ ] Update `projects/application-services/config`: - - [ ] `git_hash` : update the `$(BUILD_N)` section to match alpha `application-services` tag + **NOTE** we don't have any of our own patches for this project + - [ ] `git_hash` : update to appropriate git commit associated with $(ESR_VERSION) - [ ] Update `projects/android-components/config`: - [ ] `git_hash` : update the `$(BUILD_N)` section to match alpha `android-components` tag - [ ] Update `projects/fenix/config` - [ ] `git_hash` : update the `$(BUILD_N)` section to match `fenix` tag - [ ] ***(Optional)*** `var/fenix_version` : update to latest `$(ESR_VERSION)` if rebased -- [ ] Update allowed_addons.json by running (from `tor-browser-build` root) `./tools/fetch_allowed_addons.py > projects/tor-browser/allowed_addons.json` +- [ ] Update allowed_addons.json by running (from `tor-browser-build` root): + - `./tools/fetch_allowed_addons.py > projects/tor-browser/allowed_addons.json` - [ ] Check for NoScript updates here : https://addons.mozilla.org/en-US/firefox/addon/noscript - [ ] ***(Optional)*** If new version available, update `noscript` section of `input_files` in `projects/browser/config` - [ ] `URL` @@ -259,15 +266,17 @@ Tor Browser Alpha (and Nightly) are on the `main` branch, while Stable lives in - **NOTE**: at this point the signed binaries should have been copied to `staticiforme` - [ ] Update `staticiforme.torproject.org`: - From `screen` session on `staticiforme.torproject.org`: + - [ ] Remove old release data from following places: + - **NOTE** : Skip this step if the current release is Android or Desktop *only* + - [ ] `/srv/cdn-master.torproject.org/htdocs/aus1/torbrowser` + - [ ] `/srv/dist-master.torproject.org/htdocs/torbrowser` - [ ] Static update components : `static-update-component cdn.torproject.org && static-update-component dist.torproject.org` - [ ] Enable update responses : - [ ] alpha: `./deploy_update_responses-alpha.sh` - [ ] release: `./deploy_update_responses-release.sh` - [ ] Publish APKs to Google Play: - [ ] Log into https://play.google.com/apps/publish - - Select correct app: - - [ ] Tor Browser - - [ ] Tor Browser Alpha + - [ ] Select `Tor Browser (Alpha)` app - [ ] Navigate to `Release > Production` and click `Create new release` button - [ ] Upload the `*.multi.apk` APKs - [ ] If necessary, update the 'Release Name' (should be automatically populated) @@ -277,8 +286,12 @@ Tor Browser Alpha (and Nightly) are on the `main` branch, while Stable lives in - [ ] Save, review, and configure rollout percentage - [ ] 25% rollout when publishing a scheduled update - [ ] 100% rollout when publishing a security-driven release - - [ ] Update rollout percentage to 100% after confirmed no major issues + - [ ] Update rollout percentage to 100% after confirmed no major issues + +### tor-announce mailing list +- [ ] Send an email to tor-announce(a)lists.torproject.org, using the same content as the blog post and subject "Tor Browser $version is released". </details> /label ~"Release Prep" + diff --git a/.gitlab/issue_templates/Release Prep - Stable.md b/.gitlab/issue_templates/Release Prep - Stable.md index ec9234c..a93f472 100644 --- a/.gitlab/issue_templates/Release Prep - Stable.md +++ b/.gitlab/issue_templates/Release Prep - Stable.md @@ -41,15 +41,16 @@ ### **torbutton** ***(Optional)***: https://git.torproject.org/torbutton.git - [ ] ***(Optional)*** Update translations : - - **NOTE** : mandatory if we have added new string dependencies - - [ ] `./import-translations.sh` - - [ ] Commit with message `Translation updates` - - **NOTE** : only add files which are already being tracked + - **NOTE** We only update strings in stable if a backported feature depends on new strings + - [ ] `./import-translations.sh` + - **NOTE** : if there are no new strings imported then we are done here + - [ ] Commit with message `Translation updates` + - **NOTE** : only add files which are already being tracked - [ ] fixup! `tor-browser`'s `Bug 10760 : Integrate TorButton to TorBrowser core` issue to point to updated `torbutton` commit ### **tor-launcher** ***(Optional)***: https://git.torproject.org/tor-launcher.git - [ ] ***(Optional)*** Update translations: - - **NOTE** : mandatory if we have added new string dependencies + - **NOTE** We only update strings in stable if a backported feature depends on new strings - [ ] ./localization/import-translations.sh - [ ] Commit with message `Translation updates` - [ ] Update `install.rdf` file with new version @@ -78,7 +79,7 @@ - [ ] `git diff $(ESR_TAG)..$(TOR_BROWSER_BRANCH) > rebased_patchset.diff` - [ ] `$(DIFF_TOOL) current_patchset.dif rebased_patchset.deff` - [ ] Open MR for the rebase -- [ ] ***(Optional)*** Backport any required patches to Stable +- [ ] ***(Optional)*** Backport any required Alpha patches to Stable - [ ] cherry-pick patches on top of rebased branch (issues to backport should have `Backport` label and be linked to the associated `Release Prep` issue) - [ ] Close associated `Backport` issues - [ ] Open MR for the backport commits @@ -123,12 +124,22 @@ - [ ] Push tag to `origin` ### **tba-translation** ***(Optional)***: https://git.torproject.org/translation.git +- **NOTE** We only update strings in stable if a backported feature depends on new strings - [ ] Fetch latest and identify new `HEAD` of `fenix-torbrowserstringsxml` branch - - [ ] `origin/fenix-torbrowserstringsxml` :`<INSERT COMMIT HASH HERE>` + - [ ] `origin/fenix-torbrowserstringsxml` : `<INSERT COMMIT HASH HERE>` +### **tor-android-service** ***(Optional)***: https://git.torproject.org/tor-android-service.git +- [ ] Fetch latest and identify new `HEAD` of `main` branch + - [ ] `origin/main` : `<INSERT COMMIT HASH HERE>` + +### **application-services** : *TODO: we need to setup a gitlab copy of this repo that we can apply security backports to* +- [ ] ***(Optional)*** Backport any Android-specific security fixes from Firefox rapid-release +- [ ] Sign/Tag commit: + - Tag : `application-services-$(ESR_VERSION)-$(TOR_BROWSER_MAJOR).$(TOR_BROWSER_MINOR)-1-$(BUILD_N)` + - Message: `Tagging $(BUILD_N) for $(ESR_VERSION)-based (alpha|stable)` +- [ ] Push tag to `origin` ### **android-components** ***(Optional)***: https://gitlab.torproject.org/tpo/applications/android-components.git - [ ] ***(Optional)*** Rebase to `$(RR_VERSION)` - - Upstream git repo : https://github.com/mozilla-mobile/android-components.git - [ ] Identify the `mozilla-mobile` git tag to start from by first updating `fenix` and then checking which `android-components` tag is used in `buildSrc/src/main/java/AndroidComponents.kt` - Alternatively search for commit message like `Update Android-Components` - [ ] Create new branch from tag named `android-components-$(RR_VERSION)-$(TOR_BROWSER_MAJOR).$(TOR_BROWSER_MINOR)-1` @@ -137,19 +148,15 @@ - [ ] Perform rangediff to ensure nothing weird happened resolving conflicts - [ ] Open MR for the rebase - [ ] Merge + Push - - [ ] ***(Optional)*** Backport any required patches to Stable +- [ ] ***(Optional)*** Backport any required patches to Stable - [ ] cherry-pick patches on top of rebased branch (issues to backport should have `Backport` label and be linked to the associated `Release Prep` issue) - [ ] Close associated `Backport` issues - [ ] Open MR for the backport commits - [ ] Merge + Push -- [ ] Sign/Tag commit: + [ ] Sign/Tag commit: - Tag : `android-components-$(RR_VERSION)-$(TOR_BROWSER_MAJOR).$(TOR_BROWSER_MINOR)-1-$(BUILD_N)` - Message: `Tagging $(BUILD_N) for $(RR_VERSION)-based (alpha|stable)` -- [ ] Push tag to origin - -### **tor-android-service** ***(Optional)***: https://git.torproject.org/tor-android-service.git -- [ ] Fetch latest and identify new `HEAD` of `main` branch - - [ ] `origin/main` : `<INSERT COMMIT HASH HERE>` + - [ ] Push tag to origin ### **fenix** ***(Optional)***: https://gitlab.torproject.org/tpo/applications/fenix.git - [ ] ***(Optional)*** Rebase to `$(RR_VERSION)` @@ -184,9 +191,9 @@ Tor Browser Alpha (and Nightly) are on the `main` branch, while Stable lives in - [ ] Update `rbm.conf` - [ ] `var/torbrowser_version` : update to next version - [ ] `var/torbrowser_build` : update to `$(TOR_BROWSER_BUILD_N)` - - [ ] `var/torbrowser_incremental_from` : update to previous version + - [ ] ***(Desktop Only)*** `var/torbrowser_incremental_from` : update to previous Desktop version - [ ] **IMPORTANT**: Really *actually* make sure this is the previous Desktop version or else the `make incrementals-*` step will fail -- [ ] Update `projects/firefox/config` +- [ ] ***(Desktop Only)*** Update `projects/firefox/config` - [ ] `git_hash` : update the `$(BUILD_N)` section to match `tor-browser` tag - [ ] ***(Optional)*** `var/firefox_platform_version` : update to latest `$(ESR_VERSION)` if rebased - [ ] ***(Android Only)*** Update `projects/geckoview/config` @@ -196,10 +203,17 @@ Tor Browser Alpha (and Nightly) are on the `main` branch, while Stable lives in - [ ] `git_hash` : update with `HEAD` commit of project's `fenix-torbrowserstringsxml` branch - [ ] ***(Android Only, Optional)*** Update `projects/tor-android-service/config` - [ ] `git_hash` : update with `HEAD` commit of project's `main` branch +- [ ] ***(Android Only, Optional)*** Update `projects/application-services/config`: + **NOTE** we don't have any of our own patches for this project + - [ ] `git_hash` : update to appropriate git commit associated with $(RR_VERSION) +- [ ] ***(Android Only, Optional)*** Update `projects/android-components/config` + - [ ] `git_hash` : update the `$(BUILD_N)` section to match `android-components` tag + - [ ] ***(Optional)*** `var/android_components_version` : update to latest `$(RR_VERSION)` if rebased - [ ] ***(Android Only, Optional)*** Update `projects/fenix/config` - [ ] `git_hash` : update the `$(BUILD_N)` section to match `fenix` tag - [ ] ***(Optional)*** `var/fenix_version` : update to latest `$(RR_VERSION)` if rebased -- [ ] ***(Android Only)*** Update allowed_addons.json by running (from `tor-browser-build` root)`./tools/fetch_allowed_addons.py > projects/tor-browser/allowed_addons.json` +- [ ] ***(Android Only)*** Update allowed_addons.json by running (from `tor-browser-build` root): + - `./tools/fetch_allowed_addons.py > projects/tor-browser/allowed_addons.json` - [ ] Check for NoScript updates here : https://addons.mozilla.org/en-US/firefox/addon/noscript - [ ] ***(Optional)*** If new version available, update `noscript` section of `input_files` in `projects/tor-browser/config` - [ ] `URL` @@ -298,15 +312,17 @@ Tor Browser Alpha (and Nightly) are on the `main` branch, while Stable lives in - **NOTE**: at this point the signed binaries should have been copied to `staticiforme` - [ ] Update `staticiforme.torproject.org`: - From `screen` session on `staticiforme.torproject.org`: + - [ ] Remove old release data from following places: + - **NOTE** : Skip this step if the current release is Android or Desktop *only* + - [ ] `/srv/cdn-master.torproject.org/htdocs/aus1/torbrowser` + - [ ] `/srv/dist-master.torproject.org/htdocs/torbrowser` - [ ] Static update components : `static-update-component cdn.torproject.org && static-update-component dist.torproject.org` - [ ] Enable update responses : - [ ] alpha: `./deploy_update_responses-alpha.sh` - [ ] release: `./deploy_update_responses-release.sh` - [ ] ***(Android Only)*** : Publish APKs to Google Play: - [ ] Log into https://play.google.com/apps/publish - - Select correct app: - - [ ] Tor Browser - - [ ] Tor Browser Alpha + - [ ] Select `Tor Browser` app - [ ] Navigate to `Release > Production` and click `Create new release` button - [ ] Upload the `*.multi.apk` APKs - [ ] If necessary, update the 'Release Name' (should be automatically populated) @@ -322,3 +338,6 @@ Tor Browser Alpha (and Nightly) are on the `main` branch, while Stable lives in - [ ] Send an email to tor-announce(a)lists.torproject.org, using the same content as the blog post and subject "Tor Browser $version is released". </details> + +/label ~"Release Prep" + -- To stop receiving notification emails like this one, please contact the administrator of this repository.

1 0

[builders/tor-browser-build] branch main updated: Bug 40574: Improve tools/signing/android-signing
by gitolite role 26 Aug '22

26 Aug '22

This is an automated email from the git hooks/post-receive script. richard pushed a commit to branch main in repository builders/tor-browser-build. The following commit(s) were added to refs/heads/main by this push: new 751756c Bug 40574: Improve tools/signing/android-signing 751756c is described below commit 751756c2e7d7239df0636bf5ac8cc22d4781cbc6 Author: Nicolas Vigier <boklm(a)torproject.org> AuthorDate: Tue Jul 12 16:48:51 2022 +0200 Bug 40574: Improve tools/signing/android-signing * use projects/android-toolchain/config to download android build-tools * download unsigned apk files for pkgstage and upload them to pkgstage when signed * use set-config.android-signing --- projects/android-toolchain/config | 21 +++++++- tools/signing/android-signing | 93 +++++++++++++++++++++++--------- tools/signing/set-config.android-signing | 7 +++ 3 files changed, 93 insertions(+), 28 deletions(-) diff --git a/projects/android-toolchain/config b/projects/android-toolchain/config index 57c38c1..a2f34ae 100644 --- a/projects/android-toolchain/config +++ b/projects/android-toolchain/config @@ -47,11 +47,13 @@ var: sdk_tools_version: 4333796 commandlinetools_version: 7583922 commandlinetools_version_string: 5.0 + build_tools_filename: build-tools_r31-linux.zip + build_tools_sha256sum: f90c22f5562638a2e00762e1711eebd55e7f0a05232b65200d387307d057bfe8 input_files: - project: container-image - - URL: '[% c("var/google_repo") %]/build-tools_r31-linux.zip' + - URL: '[% c("var/google_repo") %]/[% c("var/build_tools_filename") %]' name: build_tools - sha256sum: f90c22f5562638a2e00762e1711eebd55e7f0a05232b65200d387307d057bfe8 + sha256sum: '[% c("var/build_tools_sha256sum") %]' - URL: '[% c("var/google_repo") %]/build-tools_r[% c("var/version_30") %]-linux.zip' name: build_tools_30 sha256sum: 565af786dc0cc1941002174fb945122eabd080b222cd4c7c3d9a2ae0fabf5dc4 @@ -85,3 +87,18 @@ input_files: - URL: '[% c("var/google_repo") %]/android-ndk-r[% c("var/android_ndk_version") %][% c("var/android_ndk_revision") %]-linux-x86_64.zip' name: android_ndk_compiler sha256sum: dd6dc090b6e2580206c64bcee499bc16509a5d017c6952dcd2bed9072af67cbd +steps: + # The get_build_tools step is used by tools/signing/android-signing + get_build_tools: + filename: 'android-[% c("var/build_tools_filename") %]' + get_build_tools: | + #!/bin/bash + set -e + mv -v [% c("input_files_by_name/build_tools") %] [% dest_dir _ '/' _ c('filename') %] + var: + container: + use_container: 0 + input_files: + - URL: '[% c("var/google_repo") %]/[% c("var/build_tools_filename") %]' + name: build_tools + sha256sum: '[% c("var/build_tools_sha256sum") %]' diff --git a/tools/signing/android-signing b/tools/signing/android-signing index 7c2ee50..16610e7 100755 --- a/tools/signing/android-signing +++ b/tools/signing/android-signing @@ -1,23 +1,64 @@ #!/bin/bash # Sign apk for each target architecture. -# This script requires two command line arguments. -# Usage: android-signing <version> <path/to/signing/key> +# This script does not require command line argument, but it needs +# some configuration options to be set in set-config.android-signing: +# - ssh_host_pkgstage is the host which you use for staging packages +# during signing. The script will download the unsigned .apk files +# from this host, and upload the signed .apk there +# - pkgstage_tor_browser_build_dir: this is the path to tor-browser-build +# on pkgstage +# - android_signing_key_dir: the local path where the android signing +# keys are located. That directory should contains files tba_alpha.p12 +# and tba_release.p12 for alpha and release signing keys. +# The Tor Browser version is taken from set-config.tbb-version -# In addition, hard-coding the path to an Android SDK build-tools version, as -# BUILD_TOOLS, is required. - -set -x set -e +script_dir=$( cd -- "$( dirname -- "${BASH_SOURCE[0]}" )" &> /dev/null && pwd ) +source "$script_dir/functions" +source "$script_dir/set-config.android-signing" -VERSION=$1 -SIGNING_KEY_PATH=$2 +topdir="$script_dir/../.." +ARCHS="armv7 aarch64 x86 x86_64" -# TODO set correctly. -BUILD_TOOLS=/path/to/build-tools/version -export PATH="${BUILD_TOOLS}:${PATH}" +android_signing_key_path="$android_signing_key_dir/tba_$tbb_version_type.p12" +test -f "$android_signing_key_path" || exit_error "$android_signing_key_path is missing" -ARCHS="armv7 aarch64 x86 x86_64" +check_installed_packages() { + local packages='unzip openjdk-11-jdk-headless openjdk-11-jre-headless' + for package in $packages + do + dpkg -s "$package" | grep -q '^Status: install ok installed$' || \ + exit_error "package $package is missing" + done +} + +setup_build_tools() { + local rbm="$topdir/rbm/rbm" + local build_tools_zipfile="$topdir/out/android-toolchain/$("$rbm" showconf --step get_build_tools android-toolchain filename)" + if ! test -f "$build_tools_zipfile"; then + "$rbm" build --step get_build_tools android-toolchain + test -f "$build_tools_zipfile" || exit_error "$build_tools_zipfile is missing" + fi + local build_tools_dir=$(mktemp -d) + trap "rm -Rf $build_tools_dir" EXIT + unzip -d "$build_tools_dir" "$build_tools_zipfile" + test -f "$build_tools_dir"/android-12/apksigner || \ + exit_error "$build_tools_dir/android-12/apksigner is missing" + export PATH="$build_tools_dir/android-12:${PATH}" +} + +download_unsigned_apks() { + apks_dir=$(mktemp -d) + trap "rm -Rf $apks_dir" EXIT + rsync -avH "$ssh_host_pkgstage:$pkgstage_tor_browser_build_dir/$tbb_version_type/signed/$tbb_version/*-qa.apk" "$apks_dir/" +} + +upload_signed_apks() { + rsync -avH --exclude="*-qa.apk" --exclude="*-unaligned.apk" \ + --exclude="*-unsigned.apk" "$apks_dir/" \ + "$ssh_host_pkgstage:$pkgstage_tor_browser_build_dir/$tbb_version_type/signed/$tbb_version/" +} # Sign individual apk sign_apk() { @@ -57,7 +98,7 @@ sign_apk() { # Step 3: Sign # Use this command if reading key from file - apksigner sign --verbose -ks ${SIGNING_KEY_PATH} --ks-type pkcs12 --ks-pass env:KSPASS --debuggable-apk-permitted=false --out "${SIGNED_APK}" "${UNSIGNED_APK}" + apksigner sign --verbose -ks ${android_signing_key_path} --ks-type pkcs12 --ks-pass env:KSPASS --debuggable-apk-permitted=false --out "${SIGNED_APK}" "${UNSIGNED_APK}" # Or, use below command if using a hardware token # apksigner sign --verbose --provider-class sun.security.pkcs11.SunPKCS11 --provider-arg pkcs11_java.cfg --ks NONE --ks-type PKCS11 --debuggable-apk-permitted=false --out "${SIGNED_APK}" "${UNSIGNED_APK}" @@ -81,18 +122,18 @@ sign_apk() { # Rename and verify signing certificate finalize() { for arch in ${ARCHS}; do - mv tor-browser-${VERSION}-android-${arch}-multi{-qa,}.apk + mv tor-browser-${tbb_version}-android-${arch}-multi{-qa,}.apk done for arch in ${ARCHS}; do - verified=`apksigner verify --print-certs --verbose tor-browser-${VERSION}-android-${arch}-multi.apk` + verified=`apksigner verify --print-certs --verbose tor-browser-${tbb_version}-android-${arch}-multi.apk` scheme_v1= scheme_v2= cert_digest= pubkey_digest= # Verify the expected signing key was used, Alpha verses Release based on the filename. - if `echo ${VERSION} | grep -q a`; then + if test "$tbb_version_type" = "alpha"; then scheme_v1="Verified using v1 scheme (JAR signing): true" scheme_v2="Verified using v2 scheme (APK Signature Scheme v2): true" cert_digest="Signer #1 certificate SHA-256 digest: 15f760b41acbe4783e667102c9f67119be2af62fab07763f9d57f01e5e1074e1" @@ -117,15 +158,7 @@ finalize() { echo Done. } -if [ -z "$VERSION" ]; then - echo Provide version number - exit -fi - -if [ -z "${SIGNING_KEY_PATH}" ]; then - echo Provide the path to the signing key: release or alpha - exit -fi +check_installed_packages if [ -z "$KSPASS" ]; then echo "Enter keystore passphrase" @@ -133,9 +166,17 @@ if [ -z "$KSPASS" ]; then export KSPASS fi +setup_build_tools + +download_unsigned_apks + +cd $apks_dir + # Sign all packages for arch in ${ARCHS}; do - sign_apk tor-browser-${VERSION}-android-${arch}-multi-qa.apk + sign_apk tor-browser-${tbb_version}-android-${arch}-multi-qa.apk done finalize + +upload_signed_apks diff --git a/tools/signing/set-config.android-signing b/tools/signing/set-config.android-signing new file mode 100644 index 0000000..1731efc --- /dev/null +++ b/tools/signing/set-config.android-signing @@ -0,0 +1,7 @@ +# The following line should be uncommented and updated: + +#ssh_host_pkgstage=tbbuild +#pkgstage_tor_browser_build_dir=/home/user/tor-browser-build +#android_signing_key_dir=/path/to/signing/key/dir + +var_is_defined ssh_host_pkgstage android_signing_key_dir -- To stop receiving notification emails like this one, please contact the administrator of this repository.

1 0

[tor-browser-spec] branch main updated: Bug 40034: Add Android signing to processes/ReleaseProcess
by gitolite role 26 Aug '22

26 Aug '22

This is an automated email from the git hooks/post-receive script. richard pushed a commit to branch main in repository tor-browser-spec. The following commit(s) were added to refs/heads/main by this push: new ecdd135 Bug 40034: Add Android signing to processes/ReleaseProcess ecdd135 is described below commit ecdd135421dd57dd1f253c1ebcbcf1bd223b63f1 Author: Nicolas Vigier <boklm(a)torproject.org> AuthorDate: Wed Jul 13 14:14:44 2022 +0200 Bug 40034: Add Android signing to processes/ReleaseProcess --- processes/ReleaseProcess | 32 ++++++++++++++++++++++++++++++++ 1 file changed, 32 insertions(+) diff --git a/processes/ReleaseProcess b/processes/ReleaseProcess index 82c7bfa..e97b2f2 100644 --- a/processes/ReleaseProcess +++ b/processes/ReleaseProcess @@ -61,6 +61,38 @@ # For stable releases put tails-dev(a)boum.org into Cc. +####################### +### Android signing ### +####################### + +#. The Android signing is done separately from the desktop signing. To +# do the Android signing you'll need to boot from a Tails usb stick, +# with persistent storage enabled. + +#. Install the openjdk-11-jdk-headless package + apt install openjdk-11-jdk-headless + +#. Make sure you have the android keys, for example in the +# ~/Persistent/android-keys directory. This directory should include +# the tba_alpha.p12 and tba_release.p12 files. + +#. Clone tor-browser-build, and checkout the tag for the release + git tag -v tbb-$TORBROWSER_VERSION-buildN + git checkout tbb-$TORBROWSER_VERSION-buildN + +#. Update set-config.tbb-version and set-config.android-signing + cd tools/signing + vim set-config.tbb-version + vim set-config.android-signing + +#. Run the android-signing script. This script will download the +# unsigned apks from the `pkgstage` machine (where `do-all-signing` +# is run), signed them, and upload back the signed apks to the +# `pkgstage` machine. It should be done before the hash_signed_bundles.sh +# step. + ./android-signing + + ########################## ### Signing and upload ### ########################## -- To stop receiving notification emails like this one, please contact the administrator of this repository.

1 0

[builders/tor-browser-build] annotated tag tbb-11.5.3-build1 created (now 2f70e0c)
by gitolite role 26 Aug '22

26 Aug '22

This is an automated email from the git hooks/post-receive script. richard pushed a change to annotated tag tbb-11.5.3-build1 in repository builders/tor-browser-build. at 2f70e0c (tag) tagging 38afab6c639e8aeee86d3f1c65fb222d3b34b725 (commit) replaces tbb-11.5.2-build1 by Richard Pospesel on Fri Aug 26 18:20:03 2022 +0000 - Log ----------------------------------------------------------------- Tagging build1 for 11.5.3 -----BEGIN PGP SIGNATURE----- iQJLBAABCAA1FiEEvnyRTMkiztnZPSO33kc2A2PzSywFAmMJDtMXHHJpY2hhcmRA dG9ycHJvamVjdC5vcmcACgkQ3kc2A2PzSyzuyQ/+PwOWS/wbiNXKGZSq886z5QRr lcsh9atJHDapuLZ0Gihx/5wTxb4Lz2/nX0nrFJyqhTrio6fywnvxxUBQGZejjJ78 Ftez2YvWOo3rq5YrJa+eGy+8zs+HYi9uqmA7Ytw9b2v1+/XFlpoRLlt7A7Z0heQD F0EKkcI+91OEYSpmiTGcql8DVgpIOkm3SUP4dyVC1i4e6yh3A0+3ou5aVaYDr3wz HSIBR56Am7blsrt6nsOFQZak8GkEJy4ilMZjvJep6wvh5n2bDHNV6yA3DTy/Jalb 5sCOkkCi+5ghJwd5M6dkLInFixFFAN+TDorMUmsf7SYFuCmMxZJyIsf1v3bRDOAl 4I4oSfgY7ESWnaSVqABOmSqKvcTLlf8AxjzgmthUCagcD8tSYzG/8Q7tTsxzniUh CuDWTsVm/0AlLGFS/G0LRCqK8IYegzk4XdVHOejPfp6c5Grl3gFogFD9ss+gz3ge PGrPoQJ3yGWogIxBBcVugVA46EEr8rln3X3jKIqYTkj/19CCcMXUx80IsCl3bDob wvZacmQqVism/REX7LwHlyn9auaMXHj3C6cbtThynWd/Wkj0M/KRwbEG9ENXhKcQ 3RM1l7Ipbq5sJ7+Bw4Y5qfDwNLKxXJHKJE2lD9+hxidcqFH5Zh3MaNpmGof+IaDd 0KdpCLA+D9LOkTsvaCo= =Vyyj -----END PGP SIGNATURE----- ----------------------------------------------------------------------- No new revisions were added by this update. -- To stop receiving notification emails like this one, please contact the administrator of this repository.

1 0

[builders/tor-browser-build] branch maint-11.5 updated: Bug 40613: Prepare stable release (Android Only) 11.5.3
by gitolite role 26 Aug '22

26 Aug '22

This is an automated email from the git hooks/post-receive script. richard pushed a commit to branch maint-11.5 in repository builders/tor-browser-build. The following commit(s) were added to refs/heads/maint-11.5 by this push: new 38afab6 Bug 40613: Prepare stable release (Android Only) 11.5.3 38afab6 is described below commit 38afab6c639e8aeee86d3f1c65fb222d3b34b725 Author: Giorgio Maone <ma1(a)tb-build-05.torproject.org> AuthorDate: Fri Aug 26 18:05:22 2022 +0000 Bug 40613: Prepare stable release (Android Only) 11.5.3 --- projects/android-components/config | 2 +- projects/fenix/config | 2 +- .../tor-browser/Bundle-Data/Docs/ChangeLog.txt | 6 ++ projects/tor-browser/allowed_addons.json | 90 +++++++++++----------- rbm.conf | 2 +- 5 files changed, 54 insertions(+), 48 deletions(-) diff --git a/projects/android-components/config b/projects/android-components/config index 8d4b39a..c27f679 100644 --- a/projects/android-components/config +++ b/projects/android-components/config @@ -1,7 +1,7 @@ # vim: filetype=yaml sw=2 version: '[% c("abbrev") %]' filename: '[% project %]-[% c("version") %]-[% c("var/build_id") %].tar.gz' -git_hash: '[% project %]-[% c("var/android_components_version") %]-[% c("var/torbrowser_branch") %]-1-build3' +git_hash: '[% project %]-[% c("var/android_components_version") %]-[% c("var/torbrowser_branch") %]-1-build4' git_url: https://gitlab.torproject.org/tpo/applications/android-components.git tag_gpg_id: 1 gpg_keyring: torbutton.gpg diff --git a/projects/fenix/config b/projects/fenix/config index b478d84..81d73f9 100644 --- a/projects/fenix/config +++ b/projects/fenix/config @@ -1,7 +1,7 @@ # vim: filetype=yaml sw=2 version: '[% c("abbrev") %]' filename: 'fenix-[% c("version") %]-[% c("var/build_id") %].tar.gz' -git_hash: 'tor-browser-[% c("var/fenix_version") %]-[% c("var/torbrowser_branch") %]-1-build3' +git_hash: 'tor-browser-[% c("var/fenix_version") %]-[% c("var/torbrowser_branch") %]-1-build4' git_url: https://gitlab.torproject.org/tpo/applications/fenix.git tag_gpg_id: 1 gpg_keyring: torbutton.gpg diff --git a/projects/tor-browser/Bundle-Data/Docs/ChangeLog.txt b/projects/tor-browser/Bundle-Data/Docs/ChangeLog.txt index 8d931a9..6f61504 100644 --- a/projects/tor-browser/Bundle-Data/Docs/ChangeLog.txt +++ b/projects/tor-browser/Bundle-Data/Docs/ChangeLog.txt @@ -1,3 +1,9 @@ +Tor Browser 11.5.3 - August 29 2022 + * Android + * Bug 40225: Bundled extensions don't get updated with Android Tor Browser + updates (they stay stuck at the first installed version) [fenix] + * Bug 41156: User-installed addons are broken on Android [tor-browser] + Tor Browser 11.5.2 - August 23 2022 * All Platforms * Update Tor to 0.4.7.10 diff --git a/projects/tor-browser/allowed_addons.json b/projects/tor-browser/allowed_addons.json index c0dbfe9..da88705 100644 --- a/projects/tor-browser/allowed_addons.json +++ b/projects/tor-browser/allowed_addons.json @@ -17,7 +17,7 @@ "picture_url": "https://addons.mozilla.org/user-media/userpics/13/13299/13299734.png?modifi…" } ], - "average_daily_users": 789781, + "average_daily_users": 803489, "categories": { "android": [ "experimental", @@ -221,9 +221,9 @@ "category": "recommended" }, "ratings": { - "average": 4.5529, - "bayesian_average": 4.551668826152354, - "count": 4543, + "average": 4.5532, + "bayesian_average": 4.5519689466017415, + "count": 4548, "text_count": 1459 }, "ratings_url": "https://addons.mozilla.org/en-US/firefox/addon/darkreader/reviews/", @@ -321,7 +321,7 @@ "type": "extension", "url": "https://addons.mozilla.org/en-US/firefox/addon/darkreader/", "versions_url": "https://addons.mozilla.org/en-US/firefox/addon/darkreader/versions/", - "weekly_downloads": 21321 + "weekly_downloads": 22583 }, "notes": null }, @@ -337,7 +337,7 @@ "picture_url": "https://addons.mozilla.org/user-media/userpics/5/5474/5474073.png?modified=…" } ], - "average_daily_users": 635170, + "average_daily_users": 645830, "categories": { "android": [ "security-privacy" @@ -471,7 +471,7 @@ }, "ratings": { "average": 4.6653, - "bayesian_average": 4.6627721269631595, + "bayesian_average": 4.66276978562778, "count": 2277, "text_count": 454 }, @@ -502,7 +502,7 @@ "type": "extension", "url": "https://www.eff.org/https-everywhere", "versions_url": "https://addons.mozilla.org/en-US/firefox/addon/https-everywhere/versions/", - "weekly_downloads": 8446 + "weekly_downloads": 9166 }, "notes": null }, @@ -518,7 +518,7 @@ "picture_url": "https://addons.mozilla.org/user-media/userpics/6/6937/6937656.png?modified=…" } ], - "average_daily_users": 229315, + "average_daily_users": 232939, "categories": { "android": [ "security-privacy" @@ -821,7 +821,7 @@ "type": "extension", "url": "https://addons.mozilla.org/en-US/firefox/addon/decentraleyes/", "versions_url": "https://addons.mozilla.org/en-US/firefox/addon/decentraleyes/versions/", - "weekly_downloads": 4473 + "weekly_downloads": 4894 }, "notes": null }, @@ -837,7 +837,7 @@ "picture_url": "https://addons.mozilla.org/user-media/userpics/5/5474/5474073.png?modified=…" } ], - "average_daily_users": 946189, + "average_daily_users": 963456, "categories": { "android": [ "security-privacy" @@ -1359,9 +1359,9 @@ "category": "recommended" }, "ratings": { - "average": 4.7941, - "bayesian_average": 4.791259973290882, - "count": 2093, + "average": 4.794, + "bayesian_average": 4.791156046415039, + "count": 2092, "text_count": 417 }, "ratings_url": "https://addons.mozilla.org/en-US/firefox/addon/privacy-badger17/reviews/", @@ -1386,7 +1386,7 @@ "type": "extension", "url": "https://addons.mozilla.org/en-US/firefox/addon/privacy-badger17/", "versions_url": "https://addons.mozilla.org/en-US/firefox/addon/privacy-badger17/versions/", - "weekly_downloads": 14835 + "weekly_downloads": 15463 }, "notes": null }, @@ -1402,7 +1402,7 @@ "picture_url": null } ], - "average_daily_users": 5322932, + "average_daily_users": 5440166, "categories": { "android": [ "security-privacy" @@ -1566,7 +1566,7 @@ }, "is_disabled": false, "is_experimental": false, - "last_updated": "2022-08-21T17:00:27Z", + "last_updated": "2022-08-23T20:45:17Z", "name": { "ar": "uBlock Origin", "bg": "uBlock Origin", @@ -1712,9 +1712,9 @@ }, "ratings": { "average": 4.7732, - "bayesian_average": 4.772778073045159, - "count": 14024, - "text_count": 3699 + "bayesian_average": 4.772778011885451, + "count": 14035, + "text_count": 3704 }, "ratings_url": "https://addons.mozilla.org/en-US/firefox/addon/ublock-origin/reviews/", "requires_payment": false, @@ -1776,7 +1776,7 @@ "type": "extension", "url": "https://addons.mozilla.org/en-US/firefox/addon/ublock-origin/", "versions_url": "https://addons.mozilla.org/en-US/firefox/addon/ublock-origin/versions/", - "weekly_downloads": 125750 + "weekly_downloads": 135648 }, "notes": null }, @@ -1792,7 +1792,7 @@ "picture_url": null } ], - "average_daily_users": 122696, + "average_daily_users": 123399, "categories": { "android": [ "photos-media" @@ -1890,7 +1890,7 @@ }, "ratings": { "average": 4.5231, - "bayesian_average": 4.517875003206405, + "bayesian_average": 4.517870186763684, "count": 1061, "text_count": 396 }, @@ -1914,7 +1914,7 @@ "type": "extension", "url": "https://addons.mozilla.org/en-US/firefox/addon/video-background-play-fix/", "versions_url": "https://addons.mozilla.org/en-US/firefox/addon/video-background-play-fix/ve…", - "weekly_downloads": 344 + "weekly_downloads": 413 }, "notes": null }, @@ -1930,7 +1930,7 @@ "picture_url": null } ], - "average_daily_users": 87742, + "average_daily_users": 88792, "categories": { "android": [ "experimental", @@ -2067,7 +2067,7 @@ "type": "extension", "url": "https://addons.mozilla.org/en-US/firefox/addon/privacy-possum/", "versions_url": "https://addons.mozilla.org/en-US/firefox/addon/privacy-possum/versions/", - "weekly_downloads": 773 + "weekly_downloads": 736 }, "notes": null }, @@ -2083,7 +2083,7 @@ "picture_url": "https://addons.mozilla.org/user-media/userpics/12/12929/12929064.png?modifi…" } ], - "average_daily_users": 206239, + "average_daily_users": 209619, "categories": { "android": [ "photos-media", @@ -2301,9 +2301,9 @@ "category": "recommended" }, "ratings": { - "average": 4.6442, - "bayesian_average": 4.639198744218672, - "count": 1144, + "average": 4.6437, + "bayesian_average": 4.638700644765555, + "count": 1145, "text_count": 226 }, "ratings_url": "https://addons.mozilla.org/en-US/firefox/addon/search_by_image/reviews/", @@ -2325,7 +2325,7 @@ "type": "extension", "url": "https://addons.mozilla.org/en-US/firefox/addon/search_by_image/", "versions_url": "https://addons.mozilla.org/en-US/firefox/addon/search_by_image/versions/", - "weekly_downloads": 6768 + "weekly_downloads": 7199 }, "notes": null }, @@ -2348,7 +2348,7 @@ "picture_url": null } ], - "average_daily_users": 83841, + "average_daily_users": 84209, "categories": { "android": [ "other" @@ -2653,7 +2653,7 @@ "type": "extension", "url": "https://addons.mozilla.org/en-US/firefox/addon/google-search-fixer/", "versions_url": "https://addons.mozilla.org/en-US/firefox/addon/google-search-fixer/versions/", - "weekly_downloads": 46 + "weekly_downloads": 48 }, "notes": null }, @@ -2669,7 +2669,7 @@ "picture_url": "https://addons.mozilla.org/user-media/userpics/0/0/143.png?modified=1506804…" } ], - "average_daily_users": 317416, + "average_daily_users": 321860, "categories": { "android": [ "performance", @@ -2858,10 +2858,10 @@ "category": "recommended" }, "ratings": { - "average": 4.409, - "bayesian_average": 4.406266139768881, - "count": 1968, - "text_count": 774 + "average": 4.4093, + "bayesian_average": 4.406565617967924, + "count": 1969, + "text_count": 775 }, "ratings_url": "https://addons.mozilla.org/en-US/firefox/addon/noscript/reviews/", "requires_payment": false, @@ -2905,7 +2905,7 @@ "type": "extension", "url": "https://addons.mozilla.org/en-US/firefox/addon/noscript/", "versions_url": "https://addons.mozilla.org/en-US/firefox/addon/noscript/versions/", - "weekly_downloads": 7226 + "weekly_downloads": 8033 }, "notes": null }, @@ -2921,7 +2921,7 @@ "picture_url": null } ], - "average_daily_users": 127853, + "average_daily_users": 129220, "categories": { "android": [ "performance", @@ -3035,10 +3035,10 @@ "category": "recommended" }, "ratings": { - "average": 3.914, - "bayesian_average": 3.90965159257373, - "count": 1070, - "text_count": 381 + "average": 3.9122, + "bayesian_average": 3.907855472558339, + "count": 1071, + "text_count": 382 }, "ratings_url": "https://addons.mozilla.org/en-US/firefox/addon/youtube-high-definition/revi…", "requires_payment": false, @@ -3057,7 +3057,7 @@ "type": "extension", "url": "https://addons.mozilla.org/en-US/firefox/addon/youtube-high-definition/", "versions_url": "https://addons.mozilla.org/en-US/firefox/addon/youtube-high-definition/vers…", - "weekly_downloads": 1564 + "weekly_downloads": 1670 }, "notes": null } diff --git a/rbm.conf b/rbm.conf index 0272dfc..6c1b146 100644 --- a/rbm.conf +++ b/rbm.conf @@ -69,7 +69,7 @@ buildconf: git_signtag_opt: '-s' var: - torbrowser_version: '11.5.2' + torbrowser_version: '11.5.3' torbrowser_build: 'build1' torbrowser_incremental_from: - 11.5.1 -- To stop receiving notification emails like this one, please contact the administrator of this repository.

1 0

[builders/tor-browser-build] branch main updated: fixup! Bug 40612: Migrate Release Prep template to Release Prep - Stable
by gitolite role 26 Aug '22

26 Aug '22

This is an automated email from the git hooks/post-receive script. richard pushed a commit to branch main in repository builders/tor-browser-build. The following commit(s) were added to refs/heads/main by this push: new 506caae fixup! Bug 40612: Migrate Release Prep template to Release Prep - Stable 506caae is described below commit 506caae0e5e95e763c237010ff47240b7c98fe10 Author: Richard Pospesel <richard(a)torproject.org> AuthorDate: Fri Aug 26 16:02:22 2022 +0000 fixup! Bug 40612: Migrate Release Prep template to Release Prep - Stable --- .gitlab/issue_templates/Release Prep - Stable.md | 12 ++++-------- 1 file changed, 4 insertions(+), 8 deletions(-) diff --git a/.gitlab/issue_templates/Release Prep - Stable.md b/.gitlab/issue_templates/Release Prep - Stable.md index fd96937..ec9234c 100644 --- a/.gitlab/issue_templates/Release Prep - Stable.md +++ b/.gitlab/issue_templates/Release Prep - Stable.md @@ -184,16 +184,14 @@ Tor Browser Alpha (and Nightly) are on the `main` branch, while Stable lives in - [ ] Update `rbm.conf` - [ ] `var/torbrowser_version` : update to next version - [ ] `var/torbrowser_build` : update to `$(TOR_BROWSER_BUILD_N)` -- [ ] `var/torbrowser_incremental_from` : update to previous version - - [ ] **IMPORTANT**: Really *actually* make sure this is the previous Desktop version or else the `make incrementals-*` step will fail + - [ ] `var/torbrowser_incremental_from` : update to previous version + - [ ] **IMPORTANT**: Really *actually* make sure this is the previous Desktop version or else the `make incrementals-*` step will fail - [ ] Update `projects/firefox/config` - [ ] `git_hash` : update the `$(BUILD_N)` section to match `tor-browser` tag - [ ] ***(Optional)*** `var/firefox_platform_version` : update to latest `$(ESR_VERSION)` if rebased - [ ] ***(Android Only)*** Update `projects/geckoview/config` - [ ] `git_hash` : update the `$(BUILD_N)` section to match `geckoview` tag - [ ] ***(Optional)*** `var/geckoview_version` : update to latest `$(RR_VERSION)` if rebased -- [ ] Update `projects/translation-base-browser/config` - - [ ] `git_hash` : update with `HEAD` commit of project's `base-browser` branch - [ ] ***(Android Only, Optional)*** Update `projects/tba-translations/config`: - [ ] `git_hash` : update with `HEAD` commit of project's `fenix-torbrowserstringsxml` branch - [ ] ***(Android Only, Optional)*** Update `projects/tor-android-service/config` @@ -201,9 +199,9 @@ Tor Browser Alpha (and Nightly) are on the `main` branch, while Stable lives in - [ ] ***(Android Only, Optional)*** Update `projects/fenix/config` - [ ] `git_hash` : update the `$(BUILD_N)` section to match `fenix` tag - [ ] ***(Optional)*** `var/fenix_version` : update to latest `$(RR_VERSION)` if rebased -- [ ] ***(Android Only)*** Update allowed_addons.json by running (from `tor-browser-build` root)`./tools/fetch_allowed_addons.py > projects/tor-browser/allowed_addons.json +- [ ] ***(Android Only)*** Update allowed_addons.json by running (from `tor-browser-build` root)`./tools/fetch_allowed_addons.py > projects/tor-browser/allowed_addons.json` - [ ] Check for NoScript updates here : https://addons.mozilla.org/en-US/firefox/addon/noscript - - [ ] ***(Optional)*** If new version available, update `noscript` section of `input_files` in `projects/browser/config` + - [ ] ***(Optional)*** If new version available, update `noscript` section of `input_files` in `projects/tor-browser/config` - [ ] `URL` - [ ] `sha256sum` - [ ] Check for OpenSSL updates here : https://github.com/openssl/openssl/tags @@ -324,5 +322,3 @@ Tor Browser Alpha (and Nightly) are on the `main` branch, while Stable lives in - [ ] Send an email to tor-announce(a)lists.torproject.org, using the same content as the blog post and subject "Tor Browser $version is released". </details> - -/label ~"Release Prep" -- To stop receiving notification emails like this one, please contact the administrator of this repository.

1 0

[Git][tpo/applications/fenix] Pushed new tag tor-browser-99.0.0b3-11.5-1-build4
by Pier Angelo Vendrame (＠pierov) 26 Aug '22

26 Aug '22

Pier Angelo Vendrame pushed new tag tor-browser-99.0.0b3-11.5-1-build4 at The Tor Project / Applications / fenix -- View it on GitLab: https://gitlab.torproject.org/tpo/applications/fenix/-/tree/tor-browser-99.… You're receiving this email because of your account on gitlab.torproject.org.

1 0

[Git][tpo/applications/android-components][android-components-102.0.14-12.0-1] fixup! Modify Addon support
by Pier Angelo Vendrame (＠pierov) 26 Aug '22

26 Aug '22

Pier Angelo Vendrame pushed to branch android-components-102.0.14-12.0-1 at The Tor Project / Applications / android-components Commits: 506721f0 by hackademix at 2022-08-26T10:06:25+02:00 fixup! Modify Addon support - - - - - 1 changed file: - components/feature/addons/src/main/java/mozilla/components/feature/addons/AddonManager.kt Changes: ===================================== components/feature/addons/src/main/java/mozilla/components/feature/addons/AddonManager.kt ===================================== @@ -154,6 +154,7 @@ class AddonManager( onSuccess = { ext -> val installedAddon = addon.copy(installedState = ext.toInstalledState()) addonUpdater.registerForFutureUpdates(installedAddon.id) + setAddonAllowedInPrivateBrowsing(installedAddon, true) completePendingAddonAction(pendingAction) onSuccess(installedAddon) }, View it on GitLab: https://gitlab.torproject.org/tpo/applications/android-components/-/commit/… -- View it on GitLab: https://gitlab.torproject.org/tpo/applications/android-components/-/commit/… You're receiving this email because of your account on gitlab.torproject.org.

1 0

[Git][tpo/applications/fenix][tor-browser-102.2.1-12.0-1] fixup! Modify Add-on support
by Pier Angelo Vendrame (＠pierov) 26 Aug '22

26 Aug '22

Pier Angelo Vendrame pushed to branch tor-browser-102.2.1-12.0-1 at The Tor Project / Applications / fenix Commits: b3677ba2 by hackademix at 2022-08-26T10:03:30+02:00 fixup! Modify Add-on support - - - - - 4 changed files: - .gitignore - app/src/main/java/org/mozilla/fenix/components/TorBrowserFeatures.kt - app/src/main/java/org/mozilla/fenix/utils/Settings.kt - app/src/main/res/values/preference_keys.xml Changes: ===================================== .gitignore ===================================== @@ -104,3 +104,7 @@ test_artifacts/ # Web extensions: manifest.json files are generated manifest.json + +# Other files modified at build time +.experimenter.json + ===================================== app/src/main/java/org/mozilla/fenix/components/TorBrowserFeatures.kt ===================================== @@ -6,15 +6,19 @@ package org.mozilla.fenix.components +import android.os.StrictMode import android.content.Context import mozilla.components.concept.engine.webextension.WebExtension import mozilla.components.concept.engine.webextension.WebExtensionRuntime import mozilla.components.support.base.log.logger.Logger +import org.mozilla.fenix.ext.components import org.mozilla.fenix.ext.settings +import org.mozilla.fenix.tor.TorEvents import java.io.IOException object TorBrowserFeatures { private val logger = Logger("torbrowser-features") + private const val NOSCRIPT_ID = "{73a6fe31-595d-460b-a920-fcc0f8843232}" private fun installNoScript( context: Context, @@ -25,11 +29,15 @@ object TorBrowserFeatures { /** * Copy the xpi from assets to cacheDir, we do not care if the file is later deleted. */ - val addonPath = - context.cacheDir.resolve("{73a6fe31-595d-460b-a920-fcc0f8843232}.xpi") + val xpiName = "$NOSCRIPT_ID.xpi" + val addonPath = context.cacheDir.resolve(xpiName) + val policy = StrictMode.getThreadPolicy() try { - context.assets.open("extensions/{73a6fe31-595d-460b-a920-fcc0f8843232}.xpi") + context.assets.open("extensions/$xpiName") .use { inStream -> + // we don't want penaltyDeath() on disk write + StrictMode.setThreadPolicy(StrictMode.ThreadPolicy.LAX) + addonPath.outputStream().use { outStream -> inStream.copyTo(outStream) } @@ -37,13 +45,15 @@ object TorBrowserFeatures { } catch (throwable: IOException) { onError(throwable) return + } finally { + StrictMode.setThreadPolicy(policy) } /** * Install with a file:// URI pointing to the temp location where the addon was copied to. */ runtime.installWebExtension( - id = "{73a6fe31-595d-460b-a920-fcc0f8843232}", + id = NOSCRIPT_ID, url = addonPath.toURI().toString(), onSuccess = { extension -> runtime.setAllowedInPrivateBrowsing( @@ -89,8 +99,7 @@ object TorBrowserFeatures { /** * Install NoScript as a user WebExtension if we have not already done so. - * AMO signature is checked, and AMO automatic updates will work. The extension should - * behave as if the user had installed it manually. + * AMO signature is checked, but automatic updates still need to be enabled. */ if (!context.settings().noscriptInstalled) { installNoScript( @@ -105,5 +114,40 @@ object TorBrowserFeatures { } ) } + + /** + * If we have not done it yet, enable automatic updates for NoScript and force a + * one-time immediate update check, in order to upgrade old profiles and ensure we've got + * the latest stable AMO version available on first startup. + * We will do it as soon as the Tor is connected, to prevent early addonUpdater activation + * causing automatic update checks failures (components.addonUpdater being a lazy prop). + * The extension, from then on, should behave as if the user had installed it manually. + */ + if (context.settings().noscriptUpdated == 0) { + context.components.torController.registerTorListener(object : TorEvents { + override fun onTorConnected() { + context.components.torController.unregisterTorListener(this) + // Enable automatic updates + context.components.addonUpdater.registerForFutureUpdates(NOSCRIPT_ID) + // Force an immediate update check + context.components.addonUpdater.update(NOSCRIPT_ID) + context.settings().noscriptUpdated = 1 + } + + @SuppressWarnings("EmptyFunctionBlock") + override fun onTorConnecting() { + } + + @SuppressWarnings("EmptyFunctionBlock") + override fun onTorStopped() { + } + + @SuppressWarnings("EmptyFunctionBlock") + override fun onTorStatusUpdate(entry: String?, status: String?) { + } + }) + } } + + } ===================================== app/src/main/java/org/mozilla/fenix/utils/Settings.kt ===================================== @@ -1379,4 +1379,9 @@ class Settings(private val appContext: Context) : PreferencesHolder { appContext.getPreferenceKey(R.string.pref_key_noscript_installed), default = false ) + + var noscriptUpdated by intPreference( + appContext.getPreferenceKey(R.string.pref_key_noscript_updated), + default = 0 + ) } ===================================== app/src/main/res/values/preference_keys.xml ===================================== @@ -297,6 +297,7 @@ <string name="pref_key_show_unified_search" translatable="false">pref_key_show_unified_search</string> <string name="pref_key_noscript_installed" translatable="false">pref_key_noscript_installed</string> + <string name="pref_key_noscript_updated" translatable="false">pref_key_noscript_updated</string>  <string name="pref_key_tor_security_level_settings" translatable="false">pref_key_tor_security_level_settings</string> View it on GitLab: https://gitlab.torproject.org/tpo/applications/fenix/-/commit/b3677ba2ea06a… -- View it on GitLab: https://gitlab.torproject.org/tpo/applications/fenix/-/commit/b3677ba2ea06a… You're receiving this email because of your account on gitlab.torproject.org.

1 0

[Git][tpo/applications/android-components][android-components-99.0.3-11.5-1] fixup! Modify Addon support
by Richard Pospesel (＠richard) 25 Aug '22

25 Aug '22

Richard Pospesel pushed to branch android-components-99.0.3-11.5-1 at The Tor Project / Applications / android-components Commits: 2ff416f6 by hackademix at 2022-08-24T23:30:09+02:00 fixup! Modify Addon support - - - - - 1 changed file: - components/feature/addons/src/main/java/mozilla/components/feature/addons/AddonManager.kt Changes: ===================================== components/feature/addons/src/main/java/mozilla/components/feature/addons/AddonManager.kt ===================================== @@ -154,6 +154,7 @@ class AddonManager( onSuccess = { ext -> val installedAddon = addon.copy(installedState = ext.toInstalledState()) addonUpdater.registerForFutureUpdates(installedAddon.id) + setAddonAllowedInPrivateBrowsing(installedAddon, true) completePendingAddonAction(pendingAction) onSuccess(installedAddon) }, View it on GitLab: https://gitlab.torproject.org/tpo/applications/android-components/-/commit/… -- View it on GitLab: https://gitlab.torproject.org/tpo/applications/android-components/-/commit/… You're receiving this email because of your account on gitlab.torproject.org.

1 0