morgan pushed to branch mullvad-browser-128.4.0esr-14.5-1 at The Tor Project / Applications / Mullvad Browser

Commits:

4 changed files:

Changes:

  • .gitlab/issue_templates/Emergency Security Issue.md
    ... ... @@ -18,7 +18,9 @@
    18 18 
     ### Type of Issue: What are we dealing with?
    19 19
    20 20 
     - [ ] Security (sandbox escape, remote code execution, etc)
    21 
    -- [ ] Cross-Site Linkability (correlating sessions across websites)
    21 
    +- [ ] Proxy Bypass (traffic contents becoming MITM'able)
    22 
    +- [ ] De-Anonymization (otherwise identifying which website a user is visiting)
    23 
    +- [ ] Cross-Site Linkability (correlating sessions across circuits and websites)
    22 24 
     - [ ] Disk Leak (persisting session information to disk)
    23 25 
     - [ ] Other (please explain)
    24 26
    ... ... @@ -34,11 +36,16 @@
    34 36 
       - [ ] **richard** : signing, release
    35 37 
       - [ ] **thorin** : fingerprinting
    36 38 
     - [ ] Other Engineering Teams
    39 
    +  - [ ] Networking (**ahf**, **dgoulet**)
    40 
    +  - [ ] Anti-Censorship (**meskio**, **cohosh**)
    37 41 
       - [ ] UX (**donuts**)
    38 42 
       - [ ] TPA (**anarcat**, **lavamind**)
    39 43 
     - [ ] External Tor Partners
    40 
    -  - [ ] Mozilla (**tjr**)
    41 
    -  - [ ] Mullvad (**ruihildt**)
    44 
    +  - [ ] Mozilla
    45 
    +  - [ ] Mullvad
    46 
    +  - [ ] Brave
    47 
    +  - [ ] Guardian Project (Orbot, Onion Browser)
    48 
    +  - [ ] Tails
    42 49 
       - [ ] Other (please list)
    43 50
    44 51 
     ### Urgency: When do we need to act?
    ... ... @@ -65,7 +72,6 @@ Sometimes fixes have side-effects: users lose their data, roadmaps need to be ad
    65 72
    66 73 
     - [ ] Start an initial email thread with the following people:
    67 74 
       - [ ] **bella**
    68 
    -  - [ ] **ruihildt**, **support@mullvadvpn.net**
    69 75 
       - [ ] Relevant Applications Developers
    70 76 
       - [ ] **(Optional)** **micah**
    71 77 
         - if there are considerations or asks outside the Applications Team
    ... ... @@ -78,7 +84,6 @@ Sometimes fixes have side-effects: users lose their data, roadmaps need to be ad
    78 84 
     /cc @ma1
    79 85 
     /cc @micah
    80 86 
     /cc @richard
    81 
    -/cc @ruihildt
    82 87
    83 88 
     /confidential
    84 89

  • .gitlab/issue_templates/Rebase Browser - Alpha.md deleted
    1 
    -**NOTE:** All examples in this template reference the rebase from 102.7.0esr to 102.8.0esr
    2 
    -
    3 
    -<details>
    4 
    -  <summary>Explanation of Variables</summary>
    5 
    -
    6 
    -- `$(ESR_VERSION)`: the Mozilla defined ESR version, used in various places for building mullvad-browser tags, labels, etc
    7 
    -  - **Example**: `102.8.0`
    8 
    -- `$(ESR_TAG)`: the Mozilla defined hg (Mercurial) tag associated with `$(ESR_VERSION)`
    9 
    -  - **Example**: `FIREFOX_102_8_0esr_RELEASE`
    10 
    -- `$(BROWSER_MAJOR)`: the browser major version
    11 
    -  - **Example**: `12`
    12 
    -- `$(BROWSER_MINOR)`: the browser minor version
    13 
    -  - **Example**: either `0` or `5`; Alpha's is always `(Stable + 5) % 10`
    14 
    -- `$(BASE_BROWSER_BRANCH)`: the full name of the current `base-browser` branch
    15 
    -  - **Example**: `base-browser-102.8.0esr-12.5-1`
    16 
    -- `$(BASE_BROWSER_BRANCH_PREV)`: the full name of the previous `base-browser` branch
    17 
    -  - **Example**: `base-browser-102.7.0esr-12.5-1`
    18 
    -- `$(BASE_BROWSER_BRANCH_TAG)`: the `base-browser` build tag used as base commit for `mullvad-browser`
    19 
    -  - **Example**: `base-browser-102.8.0esr-12.5-1-build1`
    20 
    -- `$(BASE_BROWSER_BRANCH_PREV_TAG)`: the `base-browser` build tag used as base commit for the previous `mullvad-browser`
    21 
    -  - **Example**: `base-browser-102.7.0esr-12.5-1-build1`
    22 
    -- `$(MULLVAD_BROWSER_BRANCH)`: the full name of the current `mullvad-browser` branch
    23 
    -  - **Example**: `mullvad-browser-102.8.0esr-12.5-1`
    24 
    -- `$(MULLVAD_BROWSER_BRANCH_PREV)`: the full name of the previous `mullvad-browser` branch
    25 
    -  - **Example**: `mullvad-browser-102.7.0esr-12.5-1`
    26 
    -</details>
    27 
    -
    28 
    -**NOTE:** It is assumed that we've already rebased and tagged `base-browser` alpha and that we've already rebased `mullvad-browser` stable
    29 
    -
    30 
    -### **Bookkeeping**
    31 
    -
    32 
    -- [ ] Link this issue to the appropriate [Release Prep](https://gitlab.torproject.org/tpo/applications/tor-browser-build/-/issues/?sort=updated_desc&state=opened&label_name%5B%5D=Release%20Prep) issue.
    33 
    -
    34 
    -### Update Branch Protection Rules
    35 
    -
    36 
    -- [ ] In [Repository Settings](https://gitlab.torproject.org/tpo/applications/mullvad-browser/-/settings/repository):
    37 
    -  - [ ] Remove previous alpha `mullvad-browser` branch protection rules (this will prevent pushing new changes to the branches being rebased)
    38 
    -  - [ ] Create new `mullvad-browser` branch protection rule:
    39 
    -    - **Branch**: `mullvad-browser-$(ESR_VERSION)esr-$(BROWSER_MAJOR).$(BROWSER_MINOR)-1*`
    40 
    -      - **Example**: `mullvad-browser-102.8.0esr-12.5-1*`
    41 
    -    - **Allowed to merge**: `Maintainers`
    42 
    -    - **Allowed to push and merge**: `Maintainers`
    43 
    -    - **Allowed to force push**: `false`
    44 
    -
    45 
    -### **Create and Push New Branch**
    46 
    -
    47 
    -- [ ] Create new alpha `mullvad-browser` branch from this ESR's alpha `base-browser` tag
    48 
    -  - Branch name in the form: `mullvad-browser-$(ESR_VERSION)esr-$(BROWSER_MAJOR).$(BROWSER_MINOR)-1`
    49 
    -  - **Example**: `git branch mullvad-browser-102.8.0esr-12.5-1 base-browser-102.8.0esr-12.5-1-build1`
    50 
    -- [ ] Push new `mullvad-browser` branch to `upstream`
    51 
    -- [ ] Push `base-browser` tag to `upstream`
    52 
    -
    53 
    -### **Rebase tor-browser**
    54 
    -
    55 
    -- [ ] Checkout a new local branch for the `mullvad-browser` rebase
    56 
    -  - **Example**: `git branch mullvad-browser-rebase upstream/mullvad-browser-102.8.0esr-12.5-1`
    57 
    -- [ ] `mullvad-browser` rebase
    58 
    -  - [ ] Cherry-pick the previous `mullvad-browser` branch's commit range up to the last `mullvad-browser` `build1` tag
    59 
    -    - **Example**: `git cherry-pick base-browser-102.7.0esr-12.5-1-build1..mullvad-browser-102.7.0esr-12.5-1-build1`
    60 
    -  - [ ] Rebase and autosquash these newly cherry-picked commits
    61 
    -    - **Example**: `git rebase --autosquash --interactive upstream/mullvad-browser-102.8.0esr-12.5-1`
    62 
    -  - [ ] Cherry-pick remainder of patches after the last `mullvad-browser` `buildN` tag
    63 
    -    - **Example**: `git cherry-pick mullvad-browser-102.7.0esr-12.5-1-build1..upstream/mulvad-browser-102.7.0esr-12.5-1`
    64 
    -  - [ ] Rebase and autosquash again, this time replacing all `fixup` and `squash` commands with `pick`. The goal here is to have all of the `fixup` and `squash` commits beside the commit which they modify, but kept un-squashed for easy debugging/bisecting.
    65 
    -    - **Example**: `git rebase --autosquash --interactive upstream/mullvad-browser-102.8.0esr-12.5-1`
    66 
    -- [ ] Compare patch sets to ensure nothing *weird* happened during conflict resolution:
    67 
    -  - [ ] diff of diffs:
    68 
    -    -  Do the diff between `current_patchset.diff` and `rebased_patchset.diff` with your preferred difftool and look at differences on lines that starts with + or -
    69 
    -    - `git diff $(BASE_BROWSER_BRANCH_PREV_TAG)..$(MULLVAD_BROWSER_BRANCH_PREV) > current_patchset.diff`
    70 
    -    - `git diff $(BASE_BROWSER_BRANCH_TAG)..HEAD > rebased_patchset.diff`
    71 
    -    - diff `current_patchset.diff` and `rebased_patchset.diff`
    72 
    -      - If everything went correctly, the only lines which should differ should be the lines starting with `index abc123...def456` (unless the previous `base-browser` branch includes changes not included in the previous `mullvad-browser` branch)
    73 
    -  - [ ] rangediff: `git range-diff $(BASE_BROWSER_BRANCH_PREV_TAG)..$(MULLVAD_BROWSER_BRANCH_PREV) $(BASE_BROWSER_BRANCH_TAG)..HEAD`
    74 
    -    - **Example**: `git range-diff base-browser-102.7.0esr-12.5-1-build1..upstream/mullvad-browser-102.7.0esr-12.5-1 base-browser-102.8.0esr-12.5-1-build1..HEAD`
    75 
    -- [ ] Open MR for the `mullvad-browser` rebase
    76 
    -- [ ] Merge
    77 
    -
    78 
    -### **Sign and Tag**
    79 
    -
    80 
    -- [ ] Sign/Tag `HEAD` of the merged `mullvad-browser` branch:
    81 
    -  - **Tag**: `mullvad-browser-$(ESR_VERSION)esr-$(BROWSER_MAJOR).$(BROWSER_MINOR)-1-build1`
    82 
    -  - **Message**: `Tagging build1 for $(ESR_VERSION)esr-based stable`
    83 
    -  - [ ] Push tag to `upstream`

  • .gitlab/issue_templates/Rebase Browser - Stable.md deleted
    1 
    -**NOTE:** All examples in this template reference the rebase from 102.7.0esr to 102.8.0esr
    2 
    -
    3 
    -<details>
    4 
    -  <summary>Explanation of Variables</summary>
    5 
    -
    6 
    -- `$(ESR_VERSION)`: the Mozilla defined ESR version, used in various places for building mullvad-browser tags, labels, etc
    7 
    -  - **Example**: `102.8.0`
    8 
    -- `$(ESR_TAG)`: the Mozilla defined hg (Mercurial) tag associated with `$(ESR_VERSION)`
    9 
    -  - **Example**: `FIREFOX_102_8_0esr_RELEASE`
    10 
    -- `$(BROWSER_MAJOR)`: the browser major version
    11 
    -  - **Example**: `12`
    12 
    -- `$(BROWSER_MINOR)`: the browser minor version
    13 
    -  - **Example**: either `0` or `5`; Alpha's is always `(Stable + 5) % 10`
    14 
    -- `$(BASE_BROWSER_BRANCH)`: the full name of the current `base-browser` branch
    15 
    -  - **Example**: `base-browser-102.8.0esr-12.0-1`
    16 
    -- `$(BASE_BROWSER_BRANCH_PREV)`: the full name of the previous `base-browser` branch
    17 
    -  - **Example**: `base-browser-102.7.0esr-12.0-1`
    18 
    -- `$(BASE_BROWSER_BRANCH_TAG)`: the `base-browser` build tag used as base commit for `mullvad-browser`
    19 
    -  - **Example**: `base-browser-102.8.0esr-12.0-1-build1`
    20 
    -- `$(BASE_BROWSER_BRANCH_PREV_TAG)`: the `base-browser` build tag used as base commit for the previous `mullvad-browser`
    21 
    -  - **Example**: `base-browser-102.7.0esr-12.0-1-build1`
    22 
    -- `$(MULLVAD_BROWSER_BRANCH)`: the full name of the current `mullvad-browser` branch
    23 
    -  - **Example**: `mullvad-browser-102.8.0esr-12.0-1`
    24 
    -- `$(MULLVAD_BROWSER_BRANCH_PREV)`: the full name of the previous `mullvad-browser` branch
    25 
    -  - **Example**: `mullvad-browser-102.7.0esr-12.0-1`
    26 
    -</details>
    27 
    -
    28 
    -**NOTE:** It is assumed that we've already rebased and tagged `base-browser` stable
    29 
    -
    30 
    -### **Bookkeeping**
    31 
    -
    32 
    -- [ ] Link this issue to the appropriate [Release Prep](https://gitlab.torproject.org/tpo/applications/tor-browser-build/-/issues/?sort=updated_desc&state=opened&label_name%5B%5D=Release%20Prep) issue.
    33 
    -
    34 
    -### Update Branch Protection Rules
    35 
    -
    36 
    -- [ ] In [Repository Settings](https://gitlab.torproject.org/tpo/applications/mullvad-browser/-/settings/repository):
    37 
    -  - [ ] Remove previous stable `mullvad-browser` branch protection rules (this will prevent pushing new changes to the branches being rebased)
    38 
    -  - [ ] Create new `mullvad-browser` branch protection rule:
    39 
    -    - **Branch**: `mullvad-browser-$(ESR_VERSION)esr-$(BROWSER_MAJOR).$(BROWSER_MINOR)-1*`
    40 
    -      - **Example**: `mullvad-browser-102.8.0esr-12.0-1*`
    41 
    -    - **Allowed to merge**: `Maintainers`
    42 
    -    - **Allowed to push and merge**: `Maintainers`
    43 
    -    - **Allowed to force push**: `false`
    44 
    -
    45 
    -### **Create and Push New Branch**
    46 
    -
    47 
    -- [ ] Create new stable `mullvad-browser` branch from this ESR's stable `base-browser` tag
    48 
    -  - Branch name in the form: `mullvad-browser-$(ESR_VERSION)esr-$(BROWSER_MAJOR).$(BROWSER_MINOR)-1`
    49 
    -  - **Example**: `git branch mullvad-browser-102.8.0esr-12.0-1 base-browser-102.8.0esr-12.0-1-build1`
    50 
    -- [ ] Push new `mullvad-browser` branch to `upstream`
    51 
    -- [ ] Push `base-browser` tag to `upstream`
    52 
    -- [ ] Push `$(ESR_TAG)` to `upstream`
    53 
    -
    54 
    -### **Rebase mullvad-browser**
    55 
    -
    56 
    -- [ ] Checkout a new local branch for the `mullvad-browser` rebase
    57 
    -  - **Example**: `git branch mullvad-browser-rebase upstream/mullvad-browser-102.8.0esr-12.0-1`
    58 
    -- [ ] `mullvad-browser` rebase
    59 
    -  - [ ] Cherry-pick the previous `mullvad-browser` branch's commit range up to the last `mullvad-browser` `build1` tag
    60 
    -    - **Example**: `git cherry-pick base-browser-102.7.0esr-12.0-1-build1..mullvad-browser-102.7.0esr-12.0-1-build1`
    61 
    -  - [ ] Rebase and autosquash these newly cherry-picked commits
    62 
    -     - **Example**: `git rebase --autosquash --interactive upstream/mullvad-browser-102.8.0esr-12.0-1`
    63 
    -  - [ ] Cherry-pick remainder of patches after the last `mullvad-browser` `buildN` tag
    64 
    -    - **Example**: `git cherry-pick mullvad-browser-102.7.0esr-12.0-1-build1..upstream/mullvad-browser-102.7.0esr-12.0-1`
    65 
    -  - [ ] Rebase and autosquash again, this time replacing all `fixup` and `squash` commands with `pick`. The goal here is to have all of the `fixup` and `squash` commits beside the commit which they modify, but kept un-squashed for easy debugging/bisecting.
    66 
    -    - **Example**: `git rebase --autosquash --interactive upstream/mullvad-browser-102.8.0esr-12.0-1`
    67 
    -- [ ] Compare patch sets to ensure nothing *weird* happened during conflict resolution:
    68 
    -  - [ ] diff of diffs:
    69 
    -    -  Do the diff between `current_patchset.diff` and `rebased_patchset.diff` with your preferred difftool and look at differences on lines that starts with + or -
    70 
    -    - `git diff $(BASE_BROWSER_BRANCH_PREV_TAG)..$(MULLVAD_BROWSER_BRANCH_PREV) > current_patchset.diff`
    71 
    -    - `git diff $(BASE_BROWSER_BRANCH_TAG)..HEAD > rebased_patchset.diff`
    72 
    -    - diff `current_patchset.diff` and `rebased_patchset.diff`
    73 
    -      - If everything went correctly, the only lines which should differ should be the lines starting with `index abc123...def456` (unless the previous `base-browser` branch includes changes not included in the previous `mullvad-browser` branch)
    74 
    -  - [ ] rangediff: `git range-diff $(BASE_BROWSER_BRANCH_PREV_TAG)..$(MULLVAD_BROWSER_BRANCH_PREV) $(BASE_BROWSER_BRANCH_TAG)..HEAD`
    75 
    -    - **Example**: `git range-diff base-browser-102.7.0esr-12.0-1-build1..upstream/mullvad-browser-102.7.0esr-12.5-1 base-browser-102.8.0esr-12.5-1-build1..HEAD`
    76 
    -- [ ] Open MR for the `mullvad-browser` rebase
    77 
    -- [ ] Merge
    78 
    -
    79 
    -### **Sign and Tag**
    80 
    -
    81 
    -- [ ] Sign/Tag `HEAD` of the merged `mullvad-browser` branch:
    82 
    -  - **Tag**: `mullvad-browser-$(ESR_VERSION)esr-$(BROWSER_MAJOR).$(BROWSER_MINOR)-1-build1`
    83 
    -  - **Message**: `Tagging build1 for $(ESR_VERSION)esr-based stable`
    84 
    -  - [ ] Push tag to `upstream`

  • .gitlab/merge_request_templates/default.md
    ... ... @@ -2,18 +2,41 @@
    2 2
    3 3 
     <!-- Bookkeeping information for release management -->
    4 4
    5 
    -### Related Issues
    5 
    +### Issues
    6 
    +
    7 
    +#### Resolves
    8 
    +- mullvad-browser#xxxxx
    6 9 
     - tor-browser#xxxxx
    10 
    +- tor-browser-build#xxxxx
    11 
    +
    12 
    +#### Related
    13 
    +
    7 14 
     - mullvad-browser#xxxxx
    15 
    +- tor-browser#xxxxx
    8 16 
     - tor-browser-build#xxxxx
    9 17
    18 
    +### Merging
    19 
    +
    20 
    +<!-- This block tells the merger where commits need to be merged and future code archaeologists where commits were *supposed* to be merged -->
    21 
    +
    22 
    +#### Target Branches
    23 
    +
    24 
    +- [ ] **`mullvad-browser`** - `!fixups` to `mullvad-browser`-specific commits, new features, security backports
    25 
    +- [ ] **`base-browser`** *and* **`tor-browser`** - `!fixups` to `base-browser`-specific commits or new features to be shared with `tor-browser`
    26 
    +  - ⚠️ **IMPORTANT**: Please list the `base-browser`-specific commits which need to be cherry-picked to the `base-browser` and `tor-browser` branches here
    27 
    +
    28 
    +#### Target Channels
    29 
    +
    30 
    +- [ ] **Alpha**: esr128-14.5
    31 
    +- [ ] **Stable**: esr128-14.0
    32 
    +
    10 33 
     ### Backporting
    11 34
    12 35 
     #### Timeline
    36 
    +- [ ] **No Backport (preferred)**: patchset for the next major stable
    13 37 
     - [ ] **Immediate**: patchset needed as soon as possible
    14 38 
     - [ ] **Next Minor Stable Release**: patchset that needs to be verified in nightly before backport
    15 39 
     - [ ] **Eventually**: patchset that needs to be verified in alpha before backport
    16 
    -- [ ] **No Backport (preferred)**: patchset for the next major stable
    17 40
    18 41 
     #### (Optional) Justification
    19 42 
     - [ ] **Emergency security update**: patchset fixes CVEs, 0-days, etc
    ... ... @@ -23,11 +46,6 @@
    23 46 
     - [ ] **Localization**: typos and other localization changes that should be also in the release branch
    24 47 
     - [ ] **Other**: please explain
    25 48
    26 
    -### Merging
    27 
    -- [ ] Merge to `mullvad-browser` - `!fixups` to `mullvad-browser`-specific commits, new features, security backports
    28 
    -- [ ] Merge to `base-browser` -`!fixups` to `base-browser`-specific commits, new features to be shared with `tor-browser`
    29 
    -  - **NOTE**: if your changeset includes patches to both `base-browser` and `mullvad-browser` please clearly label in the change description which commits should be cherry-picked to `base-browser` after merging
    30 
    -
    31 49 
     ### Issue Tracking
    32 50 
     - [ ] Link resolved issues with appropriate [Release Prep issue](https://gitlab.torproject.org/groups/tpo/applications/-/issues/?sort=updated_desc&state=opened&label_name%5B%5D=Release%20Prep&first_page_size=20) for changelog generation
    33 51
    ... ... @@ -36,7 +54,7 @@
    36 54 
     #### Request Reviewer
    37 55
    38 56 
     - [ ] Request review from an applications developer depending on modified system:
    39 
    -  - **NOTE**: if the MR modifies multiple areas, please `/cc` all the relevant reviewers (since gitlab only allows 1 reviewer)
    57 
    +  - **NOTE**: if the MR modifies multiple areas, please `/cc` all the relevant reviewers (since Gitlab only allows 1 reviewer)
    40 58 
       - **accessibility** : henry
    41 59 
       - **android** : clairehurst, dan
    42 60 
       - **build system** : boklm
    ... ... @@ -44,21 +62,22 @@
    44 62 
       - **firefox internals (XUL/JS/XPCOM)** : jwilde, ma1
    45 63 
       - **fonts** : pierov
    46 64 
       - **frontend (implementation)** : henry
    47 
    -  - **frontend (review)** : donuts, richard
    65 
    +  - **frontend (review)** : donuts, morgan
    48 66 
       - **localization** : henry, pierov
    49 67 
       - **macOS** : clairehurst, dan
    50 68 
       - **nightly builds** : boklm
    51 
    -  - **rebases/release-prep** : dan, ma1, pierov, richard
    69 
    +  - **rebases/release-prep** : dan, ma1, pierov, morgan
    52 70 
       - **security** : jwilde, ma1
    53 
    -  - **signing** : boklm, richard
    71 
    +  - **signing** : boklm, morgan
    54 72 
       - **updater** : pierov
    55 
    -  - **windows** : jwilde, richard
    56 
    -  - **misc/other** : pierov, richard
    73 
    +  - **windows** : jwilde, morgan
    74 
    +  - **misc/other** : pierov, morgan
    57 75
    58 76 
     #### Change Description
    59 77
    60 78 
     <!-- Whatever context the reviewer needs to effectively review the patchset; if the patch includes UX updates be sure to include screenshots/video of how any new behaviour -->
    61 79
    80 
    +
    62 81 
     #### How Tested
    63 82
    64 83 
     <!-- Description of steps taken to verify the change -->

    • —
    View it on GitLab.
    You're receiving this email because of your account on gitlab.torproject.org. Manage all notifications · Help