- tor-commits - lists.torproject.org

[Git][tpo/applications/tor-browser] Pushed new branch tor-browser-115.30.0esr-13.5-1
by Pier Angelo Vendrame (＠pierov) 03 Nov '25

03 Nov '25

Pier Angelo Vendrame pushed new branch tor-browser-115.30.0esr-13.5-1 at The Tor Project / Applications / Tor Browser -- View it on GitLab: https://gitlab.torproject.org/tpo/applications/tor-browser/-/tree/tor-brows… You're receiving this email because of your account on gitlab.torproject.org.

1 0

[Git][tpo/applications/tor-browser] Pushed new branch tor-browser-140.5.0esr-15.0-1
by Pier Angelo Vendrame (＠pierov) 03 Nov '25

03 Nov '25

Pier Angelo Vendrame pushed new branch tor-browser-140.5.0esr-15.0-1 at The Tor Project / Applications / Tor Browser -- View it on GitLab: https://gitlab.torproject.org/tpo/applications/tor-browser/-/tree/tor-brows… You're receiving this email because of your account on gitlab.torproject.org.

1 0

[Git][tpo/applications/tor-browser] Pushed new tag FIREFOX_115_30_0esr_BUILD1
by Pier Angelo Vendrame (＠pierov) 03 Nov '25

03 Nov '25

Pier Angelo Vendrame pushed new tag FIREFOX_115_30_0esr_BUILD1 at The Tor Project / Applications / Tor Browser -- View it on GitLab: https://gitlab.torproject.org/tpo/applications/tor-browser/-/tree/FIREFOX_1… You're receiving this email because of your account on gitlab.torproject.org.

1 0

[Git][tpo/applications/mullvad-browser] Pushed new tag FIREFOX_140_5_0esr_BUILD1
by Pier Angelo Vendrame (＠pierov) 03 Nov '25

03 Nov '25

Pier Angelo Vendrame pushed new tag FIREFOX_140_5_0esr_BUILD1 at The Tor Project / Applications / Mullvad Browser -- View it on GitLab: https://gitlab.torproject.org/tpo/applications/mullvad-browser/-/tree/FIREF… You're receiving this email because of your account on gitlab.torproject.org.

1 0

[Git][tpo/applications/tor-browser] Pushed new tag FIREFOX_140_5_0esr_BUILD1
by Pier Angelo Vendrame (＠pierov) 03 Nov '25

03 Nov '25

Pier Angelo Vendrame pushed new tag FIREFOX_140_5_0esr_BUILD1 at The Tor Project / Applications / Tor Browser -- View it on GitLab: https://gitlab.torproject.org/tpo/applications/tor-browser/-/tree/FIREFOX_1… You're receiving this email because of your account on gitlab.torproject.org.

1 0

[Git][tpo/applications/tor-browser-build][main] Bug 41622: Prepare Tor VPN 1.3.0Beta
by boklm (＠boklm) 03 Nov '25

03 Nov '25

boklm pushed to branch main at The Tor Project / Applications / tor-browser-build Commits: 8d31b3dd by Nicolas Vigier at 2025-10-31T08:29:05+01:00 Bug 41622: Prepare Tor VPN 1.3.0Beta - - - - - 1 changed file: - rbm.conf Changes: ===================================== rbm.conf ===================================== @@ -334,9 +334,9 @@ targets: torvpn: var: tor-vpn: 1 - torbrowser_version: '1.2.1Beta' + torbrowser_version: '1.3.0Beta' torbrowser_build: 'build1' - browser_release_date: '2025/10/23 09:00:00' + browser_release_date: '2025/10/31 07:30:00' project-name: tor-vpn projectname: torvpn Project_Name: 'Tor VPN' View it on GitLab: https://gitlab.torproject.org/tpo/applications/tor-browser-build/-/commit/8… -- View it on GitLab: https://gitlab.torproject.org/tpo/applications/tor-browser-build/-/commit/8… You're receiving this email because of your account on gitlab.torproject.org.

1 0

[Git][tpo/applications/tor-browser-build][maint-15.0] 3 commits: Bug 41620: Do not rerun zipalign when signing.
by Pier Angelo Vendrame (＠pierov) 30 Oct '25

30 Oct '25

Pier Angelo Vendrame pushed to branch maint-15.0 at The Tor Project / Applications / tor-browser-build Commits: dbe953b4 by Pier Angelo Vendrame at 2025-10-30T13:32:23+01:00 Bug 41620: Do not rerun zipalign when signing. APKs are already aligned during the build step. - - - - - 78db8a09 by Pier Angelo Vendrame at 2025-10-30T13:32:24+01:00 Bug 41621: Remove support for older android tools while signing. We had some conditional check to use Android tools version 12 when signing Tor Browser 14.5.x. Now that it's EOL, we do not need it anymore. - - - - - 2244a6f1 by Pier Angelo Vendrame at 2025-10-30T13:32:24+01:00 Bug 41617: Align .so pages to 16KiB with zipalign. Apps are required to support 16KiB page size. We already build our binaries so that they comply with this requirement, but we also need to pass the specific argument to zipalign before signing, for it to actually work. - - - - - 2 changed files: - projects/browser/build.android - tools/signing/wrappers/sign-apk Changes: ===================================== projects/browser/build.android ===================================== @@ -87,7 +87,7 @@ function generate_apk { popd aligned_apk=$(basename $apk .apk)_aligned.apk - zipalign -vp 4 repacked.apk $aligned_apk + zipalign -P 16 4 repacked.apk $aligned_apk # Sign a QA build. This .apk is not a debug version and doesn't contain a debug # flag in the manifest. ===================================== tools/signing/wrappers/sign-apk ===================================== @@ -30,10 +30,6 @@ test -f "$android_signing_key_path" || exit_error "$android_signing_key_path is setup_build_tools() { abt_version=16 - # If signing 14.5, keep using android-12 build tools - # (we can remove this when 15.0 is the stable release) - ( test -z "$tbb_version" || echo "$tbb_version" | grep -q '^14\.5' ) && \ - abt_version=12 build_tools_dir=/signing/android-build-tools test -f "$build_tools_dir"/android-$abt_version/apksigner || \ exit_error "$build_tools_dir/android-$abt_version/apksigner is missing" @@ -41,49 +37,31 @@ setup_build_tools() { } # Sign individual apk +# https://developer.android.com/studio/publish/app-signing#sign-manually sign_apk() { INPUTAPK="$1" OUTPUTAPK="$2" + SIGNEDAPK=$(basename "${INPUTAPK}") - # https://developer.android.com/studio/publish/app-signing#sign-manually - # After running `gradlew assembleRelease`, creates an unsigned-unaligned apk - - # Aligning ensures that all uncompressed data starts with a particular byte - # alignment relative to the start of the file, which may reduce the amount - # of RAM consumed by an app. - # zipalign -v -p 4 my-app-unsigned.apk my-app-unsigned-aligned.apk - echo Aligning and signing ${INPUTAPK} - - # Append the different stages of signing - UNSIGNED_UNALIGNED_APK=`basename "${INPUTAPK}" | sed 's/\.apk/-unsigned-unaligned.apk/'` - UNSIGNED_APK=`echo "${UNSIGNED_UNALIGNED_APK}" | sed 's/-unaligned//'` - SIGNED_APK=`echo "${UNSIGNED_APK}" | sed 's/-unsigned//'` - - # ${INPUTAPK} is full path. We copy to local tmp directory. - cp "${INPUTAPK}" "${UNSIGNED_UNALIGNED_APK}" - - # Step 1: Align - zipalign -v -p 4 "${UNSIGNED_UNALIGNED_APK}" "${UNSIGNED_APK}" - if [ ! $? = 0 ]; then - echo "zipalign failed" - exit 1 - fi - echo zipalign succeeded - - # Step 2: Verify alignment - zipalign -vc 4 "${UNSIGNED_APK}" + # Verify alignment before signing + # APKs have various requirements for being published on the Play Store. + # The input APKs should be ready before starting this process. + echo Verifying ${INPUTAPK} + zipalign -c -P 16 4 "${INPUTAPK}" if [ ! $? = 0 ]; then echo "zipalign verify failed" exit 1 fi echo zipalign verify succeeded - # Step 3: Sign + # Sign + echo Signing ${INPUTAPK} + # Use this command if reading key from file - apksigner sign --verbose -ks ${android_signing_key_path} --ks-type pkcs12 --ks-pass env:KSPASS --debuggable-apk-permitted=false --out "${SIGNED_APK}" "${UNSIGNED_APK}" + apksigner sign --verbose -ks ${android_signing_key_path} --ks-type pkcs12 --ks-pass env:KSPASS --debuggable-apk-permitted=false --out "${SIGNEDAPK}" "${INPUTAPK}" # Or, use below command if using a hardware token - # apksigner sign --verbose --provider-class sun.security.pkcs11.SunPKCS11 --provider-arg pkcs11_java.cfg --ks NONE --ks-type PKCS11 --debuggable-apk-permitted=false --out "${SIGNED_APK}" "${UNSIGNED_APK}" + # apksigner sign --verbose --provider-class sun.security.pkcs11.SunPKCS11 --provider-arg pkcs11_java.cfg --ks NONE --ks-type PKCS11 --debuggable-apk-permitted=false --out "${SIGNEDAPK}" "${INPUTAPK}" if [ ! $? = 0 ]; then echo "apksigner sign failed" @@ -91,15 +69,16 @@ sign_apk() { fi echo apksigner sign succeeded - # Step 4: Verify signature - apksigner verify --verbose "${SIGNED_APK}" + # Verify signature + apksigner verify --verbose "${SIGNEDAPK}" if [ ! $? = 0 ]; then echo "apksigner verify failed" exit 1 fi - - mv -f "${SIGNED_APK}" "$OUTPUTAPK" echo apksigner verify succeeded + + mv -f "${SIGNEDAPK}" "${OUTPUTAPK}" + echo ${OUTPUTAPK} signed } setup_build_tools View it on GitLab: https://gitlab.torproject.org/tpo/applications/tor-browser-build/-/compare/… -- View it on GitLab: https://gitlab.torproject.org/tpo/applications/tor-browser-build/-/compare/… You're receiving this email because of your account on gitlab.torproject.org.

1 0

[Git][tpo/applications/tor-browser-build][main] 3 commits: Bug 41620: Do not rerun zipalign when signing.
by Pier Angelo Vendrame (＠pierov) 30 Oct '25

30 Oct '25

Pier Angelo Vendrame pushed to branch main at The Tor Project / Applications / tor-browser-build Commits: 1fe25438 by Pier Angelo Vendrame at 2025-10-30T13:18:34+01:00 Bug 41620: Do not rerun zipalign when signing. APKs are already aligned during the build step. - - - - - e3a7b6d8 by Pier Angelo Vendrame at 2025-10-30T13:18:36+01:00 Bug 41621: Remove support for older android tools while signing. We had some conditional check to use Android tools version 12 when signing Tor Browser 14.5.x. Now that it's EOL, we do not need it anymore. - - - - - 3213be31 by Pier Angelo Vendrame at 2025-10-30T13:18:37+01:00 Bug 41617: Align .so pages to 16KiB with zipalign. Apps are required to support 16KiB page size. We already build our binaries so that they comply with this requirement, but we also need to pass the specific argument to zipalign before signing, for it to actually work. - - - - - 2 changed files: - projects/browser/build.android - tools/signing/wrappers/sign-apk Changes: ===================================== projects/browser/build.android ===================================== @@ -87,7 +87,7 @@ function generate_apk { popd aligned_apk=$(basename $apk .apk)_aligned.apk - zipalign -vp 4 repacked.apk $aligned_apk + zipalign -P 16 4 repacked.apk $aligned_apk # Sign a QA build. This .apk is not a debug version and doesn't contain a debug # flag in the manifest. ===================================== tools/signing/wrappers/sign-apk ===================================== @@ -30,10 +30,6 @@ test -f "$android_signing_key_path" || exit_error "$android_signing_key_path is setup_build_tools() { abt_version=16 - # If signing 14.5, keep using android-12 build tools - # (we can remove this when 15.0 is the stable release) - ( test -z "$tbb_version" || echo "$tbb_version" | grep -q '^14\.5' ) && \ - abt_version=12 build_tools_dir=/signing/android-build-tools test -f "$build_tools_dir"/android-$abt_version/apksigner || \ exit_error "$build_tools_dir/android-$abt_version/apksigner is missing" @@ -41,49 +37,31 @@ setup_build_tools() { } # Sign individual apk +# https://developer.android.com/studio/publish/app-signing#sign-manually sign_apk() { INPUTAPK="$1" OUTPUTAPK="$2" + SIGNEDAPK=$(basename "${INPUTAPK}") - # https://developer.android.com/studio/publish/app-signing#sign-manually - # After running `gradlew assembleRelease`, creates an unsigned-unaligned apk - - # Aligning ensures that all uncompressed data starts with a particular byte - # alignment relative to the start of the file, which may reduce the amount - # of RAM consumed by an app. - # zipalign -v -p 4 my-app-unsigned.apk my-app-unsigned-aligned.apk - echo Aligning and signing ${INPUTAPK} - - # Append the different stages of signing - UNSIGNED_UNALIGNED_APK=`basename "${INPUTAPK}" | sed 's/\.apk/-unsigned-unaligned.apk/'` - UNSIGNED_APK=`echo "${UNSIGNED_UNALIGNED_APK}" | sed 's/-unaligned//'` - SIGNED_APK=`echo "${UNSIGNED_APK}" | sed 's/-unsigned//'` - - # ${INPUTAPK} is full path. We copy to local tmp directory. - cp "${INPUTAPK}" "${UNSIGNED_UNALIGNED_APK}" - - # Step 1: Align - zipalign -v -p 4 "${UNSIGNED_UNALIGNED_APK}" "${UNSIGNED_APK}" - if [ ! $? = 0 ]; then - echo "zipalign failed" - exit 1 - fi - echo zipalign succeeded - - # Step 2: Verify alignment - zipalign -vc 4 "${UNSIGNED_APK}" + # Verify alignment before signing + # APKs have various requirements for being published on the Play Store. + # The input APKs should be ready before starting this process. + echo Verifying ${INPUTAPK} + zipalign -c -P 16 4 "${INPUTAPK}" if [ ! $? = 0 ]; then echo "zipalign verify failed" exit 1 fi echo zipalign verify succeeded - # Step 3: Sign + # Sign + echo Signing ${INPUTAPK} + # Use this command if reading key from file - apksigner sign --verbose -ks ${android_signing_key_path} --ks-type pkcs12 --ks-pass env:KSPASS --debuggable-apk-permitted=false --out "${SIGNED_APK}" "${UNSIGNED_APK}" + apksigner sign --verbose -ks ${android_signing_key_path} --ks-type pkcs12 --ks-pass env:KSPASS --debuggable-apk-permitted=false --out "${SIGNEDAPK}" "${INPUTAPK}" # Or, use below command if using a hardware token - # apksigner sign --verbose --provider-class sun.security.pkcs11.SunPKCS11 --provider-arg pkcs11_java.cfg --ks NONE --ks-type PKCS11 --debuggable-apk-permitted=false --out "${SIGNED_APK}" "${UNSIGNED_APK}" + # apksigner sign --verbose --provider-class sun.security.pkcs11.SunPKCS11 --provider-arg pkcs11_java.cfg --ks NONE --ks-type PKCS11 --debuggable-apk-permitted=false --out "${SIGNEDAPK}" "${INPUTAPK}" if [ ! $? = 0 ]; then echo "apksigner sign failed" @@ -91,15 +69,16 @@ sign_apk() { fi echo apksigner sign succeeded - # Step 4: Verify signature - apksigner verify --verbose "${SIGNED_APK}" + # Verify signature + apksigner verify --verbose "${SIGNEDAPK}" if [ ! $? = 0 ]; then echo "apksigner verify failed" exit 1 fi - - mv -f "${SIGNED_APK}" "$OUTPUTAPK" echo apksigner verify succeeded + + mv -f "${SIGNEDAPK}" "${OUTPUTAPK}" + echo ${OUTPUTAPK} signed } setup_build_tools View it on GitLab: https://gitlab.torproject.org/tpo/applications/tor-browser-build/-/compare/… -- View it on GitLab: https://gitlab.torproject.org/tpo/applications/tor-browser-build/-/compare/… You're receiving this email because of your account on gitlab.torproject.org.

1 0

[Git][tpo/applications/tor-browser-build][maint-15.0] fixup! MB 466: Automate the release process / replace the new build email
by ma1 (＠ma1) 29 Oct '25

29 Oct '25

ma1 pushed to branch maint-15.0 at The Tor Project / Applications / tor-browser-build Commits: 57d15d3b by hackademix at 2025-10-29T18:49:02+01:00 fixup! MB 466: Automate the release process / replace the new build email Fixed auth token var typo - - - - - 1 changed file: - tools/signing/publish-github.mullvadbrowser Changes: ===================================== tools/signing/publish-github.mullvadbrowser ===================================== @@ -7,9 +7,10 @@ function showconf { # we may want to add a suffix to the release tag, e.g. rc1 mbrtag_suffix="$1" -github_token=$(showconf release buildconf/devmole_auth_token2 2>/dev/null) +token_var="buildconf/devmole_auth_token" +github_token=$(showconf release $token_var 2>/dev/null) if ! [[ $github_token ]]; then - echo >&2 "Github token (buildconf/devmole_auth_token) missing!" + echo >&2 "Github token ($token_var) missing!" exit 1 fi View it on GitLab: https://gitlab.torproject.org/tpo/applications/tor-browser-build/-/commit/5… -- View it on GitLab: https://gitlab.torproject.org/tpo/applications/tor-browser-build/-/commit/5… You're receiving this email because of your account on gitlab.torproject.org.

1 0

[Git][tpo/applications/tor-browser-build][main] fixup! MB 466: Automate the release process / replace the new build email
by ma1 (＠ma1) 29 Oct '25

29 Oct '25

ma1 pushed to branch main at The Tor Project / Applications / tor-browser-build Commits: effe1120 by hackademix at 2025-10-29T18:44:27+01:00 fixup! MB 466: Automate the release process / replace the new build email Fixed auth token var typo - - - - - 1 changed file: - tools/signing/publish-github.mullvadbrowser Changes: ===================================== tools/signing/publish-github.mullvadbrowser ===================================== @@ -7,9 +7,10 @@ function showconf { # we may want to add a suffix to the release tag, e.g. rc1 mbrtag_suffix="$1" -github_token=$(showconf release buildconf/devmole_auth_token2 2>/dev/null) +token_var="buildconf/devmole_auth_token" +github_token=$(showconf release $token_var 2>/dev/null) if ! [[ $github_token ]]; then - echo >&2 "Github token (buildconf/devmole_auth_token) missing!" + echo >&2 "Github token ($token_var) missing!" exit 1 fi View it on GitLab: https://gitlab.torproject.org/tpo/applications/tor-browser-build/-/commit/e… -- View it on GitLab: https://gitlab.torproject.org/tpo/applications/tor-browser-build/-/commit/e… You're receiving this email because of your account on gitlab.torproject.org.

1 0