May 2018 - tbb-dev - lists.torproject.org

Nightly rebase experiment proposal
by Arthur D. Edelstein 03 Feb '20

03 Feb '20

Hi everyone, Here's a plan for experimenting with moving Tor Browser from ESRs to mozilla-central. Why try this? There are several reasons I can think of: * There is no mobile Firefox ESR. In order to keep mobile Tor Browser secure, we would either need to constantly monitor for security fixes and apply backports. It will be simpler to follow the Mozilla release cycle. * Tor Browser will receive all security patches and security features from Mozilla, not simply those deemed important enough to backport to the last ESR. * Closer collaboration between Mozilla and the Tor Browser team will be possible, because everyone will be focused on the same codebase. For example, non-urgent patches can land directly on mozilla-central, bypassing tor-browser.git altogether, and those patches will be deployed to Tor Browser faster than they would have been on an ESR-only schedule. Mozilla will provide expert review of patches. Also, some non-urgent patches by Tor Browser may be written by Mozilla engineers. * The Tor Browser development process will be smoother and more gradual. Instead of rebasing and patch-fixing sprints ahead of each ESR, we can automatically rebase patches every night, and fix any patch whenever its rebase fails. (The total rebase effort should be approximately the same as before.) * Patches that frequently break because they live on "hot code" can be identified and uplifted. * We'll need to continuously monitor the mozilla codebase for new features that could harm privacy. That's potentially difficult, but by focusing on Mozilla's current work, we can hopefully stop patches that affect privacy before they land. Here's how I envision the new rebase process: * An automated script rebases all tor browser patches every night against mozilla-central, mozilla-beta, mozilla-stable and mozilla-esr. An email alert will be sent if the rebase of any patch fails. (I have a prototype script that does the basic rebasing -- it found that ~40/140 patches from our ESR-52 branch could be auto-rebased onto mozilla-central without any intervention.) * Any failed patches will need to be manually fixed up promptly so that the automated rebase can resume. * Diagnostic Tor Browser bundles will be built against the latest rebase branches. We can also run regression tests. So how do we ramp up this experiment? 1. 2018-1-1 to 2017-2-22: Rebase tor-browser.git patches manually on top of Firefox 59-beta. (We have to do this anyway.) 2. 2017-2-22 to 2018-3-13: Activate a script that rebases Tor Browser patches nightly onto mozilla-(central, beta, stable, esr). 3. 2018-03-13 to 2018-05-07: Create nightly Tor Browser bundle builds based on nightly rebases. At this point, we can evaluate whether we would like to transition to releasing Tor Browser alphas based on the mozilla-beta branch. Switching Tor Browser stable to mozilla-stable can happen sometime after that. How does this sound? Interested to hear what you think. Thanks, Arthur

7 12

Tor Browser nightly builds based on Firefox 60 ESR are available for Linux
by Georg Koppen 15 Jun '18

15 Jun '18

Hi all! We are happy to announce that we finally have Tor Browser nightly builds for Linux available that are based in Firefox 60 ESR. From today, May 30, on you find them at the usual location: http://f4amtbsowhix7rrf.onion/tor-browser-builds/ We already tagged a bunch of issues we found in the pre-nightly bundles we built locally. For those we used the "ff60-esr" keyword. If you feel brave and test those nightlies, please report unfiled bugs you encounter. This helps us prioritizing things and gets those very likely fixed faster. We'll provide macOS bundles and Windows bundles as fast as we can. We are currently still working on the toolchain update. Known major issues with the nightlies so far: 1) A couple of months ago we needed to get out an emergency Tor Browser release to fix a possibly proxy bypass bug[1], affecting above all macOS users and potentially some Linux setups as well. We currently don't have a patch for that one as the underlying code changed too much between ESR52 and ESR60. However, Mozilla is working on that for us and we'll port the final fix back as soon as possible. 2) Loacalized bundles are not working correctly due to missing locale strings for the new circuit display. This should be fixed starting with the next nightlies as I pushed the respective changes a couple of hours ago to our Torbutton repository. 3) The nightlies have JavaScript blocked by default (some of you might even call this a feature). 4) Loading default bridges/moat is not working. Georg [1] https://blog.torproject.org/tor-browser-709-released

1 2

Next meeting: Tue, May 29 1800 UTC in #tor-meeting
by Georg Koppen 23 May '18

23 May '18

Hi all! Next Monday is public holiday in the US (Memorial Day) and we decided to move the weekly Tor Browser meeting by one day to Tuesday, May 29. The time (1800 UTC) and the place (#tor-meeting on irc.oftc.net) stay the same. See you there, Georg

1 0