[Git][tpo/applications/tor-browser-build][main] 2 commits: Bug 41766: Use Gzip for all platforms for Go vendoring.

31 Mar 2026


      Pier Angelo Vendrame pushed to branch main at The Tor Project / Applications / tor-browser-build


Commits:
d7c21044 by Pier Angelo Vendrame at 2026-03-31T19:38:26+02:00
Bug 41766: Use Gzip for all platforms for Go vendoring.

If we use different compression method, we need to version different
tarball hashes, one for each method.

- - - - -
cf6881e7 by Pier Angelo Vendrame at 2026-03-31T19:38:33+02:00
Bug 41755&41756: Prepare Tor&Mullvad Browser 16.0a5

- - - - -


10 changed files:

- projects/browser/Bundle-Data/Docs-MB/ChangeLog.txt
- projects/browser/Bundle-Data/Docs-TBB/ChangeLog.txt
- projects/browser/config
- projects/firefox/config
- projects/geckoview/config
- projects/lyrebird/config
- projects/moat-settings/config
- projects/tor/config
- projects/translation/config
- rbm.conf


Changes:

=====================================
projects/browser/Bundle-Data/Docs-MB/ChangeLog.txt
=====================================
@@ -1,3 +1,31 @@
+Mullvad Browser 16.0a5 - April 01 2026
+ * All Platforms
+   * Updated Firefox to 149.0a1
+   * Updated NoScript to 13.6.14.90101984
+   * Updated uBlock Origin to 1.70.0
+   * Bug 514: Revert New Identity commit [mullvad-browser]
+   * Bug 522: Rebase Mullvad Browser onto 149 [mullvad-browser]
+   * Bug 44546: Rename `appearance-chooser-item` to `setting-chooser-item` after we reach nightly 149 [tor-browser]
+   * Bug 44702: Rebase alpha onto 149.0a1 [tor-browser]
+   * Bug 44714: The browser opens a new about:blank tab in 148 [tor-browser]
+   * Bug 44755: Trusted Types (Firefox 148 and above) + Web Workers broken on Safer Level [tor-browser]
+   * Bug 44757: Update tests for removed Services.search [rebase-149] [tor-browser]
+   * Bug 44761: Safer Level's worker patching filters out Worker constructor options [tor-browser]
+   * Bug 44763: Disable WebGPU until audited [tor-browser]
+   * Bug 44764: Review Mozilla 2012344: Hide main AI settings when the feature is blocked [tor-browser]
+   * Bug 44765: Review Mozilla 1972073: Convert Sidebar to config-based prefs [tor-browser]
+   * Bug 44767: Safer Level's worker patching throws on new about:blank frames with Trusted Types [tor-browser]
+   * Bug 44772: Review Mozilla 1980264: Canvas randomization is too slow [tor-browser]
+   * Bug 44778: Safer Level: xray causes patched TrustedTypePolicy instances to be unusable by content. [tor-browser]
+   * Bug 44780: AIFeature.sys.mjs failures in 149 desktop builds [tor-browser]
+   * Bug 44793: `privacy.spoof_english` console error in about:preferences [tor-browser]
+   * Bug 44801: Redact onion origins from Location.ancestorOrigins. [tor-browser]
+   * Bug 44814: Disable trustpanel until our new designs are ready [tor-browser]
+ * Build System
+   * All Platforms
+     * Bug 43180: Remove translation CI 13.5 legacy extension [tor-browser]
+     * Bug 41758: Rename `tools/signing/deploy-legacy` to `tools/signing/redeploy-update_responses-release` [tor-browser-build]
+
 Mullvad Browser 16.0a4 - March 11 2026
  * All Platforms
    * Updated Firefox to 148.0a1


=====================================
projects/browser/Bundle-Data/Docs-TBB/ChangeLog.txt
=====================================
@@ -1,3 +1,57 @@
+Tor Browser 16.0a5 - April 01 2026
+ * All Platforms
+   * Updated NoScript to 13.6.14.90101984
+   * Updated Tor to 0.4.9.6
+   * Bug 43858: Clean out deprecated or unused methods in TorConnect [tor-browser]
+   * Bug 44251: Drop pt_config.json meek-azure migration logic [tor-browser]
+   * Bug 44546: Rename `appearance-chooser-item` to `setting-chooser-item` after we reach nightly 149 [tor-browser]
+   * Bug 44621: Move about:torconnect back to browser [tor-browser]
+   * Bug 44702: Rebase alpha onto 149.0a1 [tor-browser]
+   * Bug 44720: Migrate New Identity commit to Tor Browser [tor-browser]
+   * Bug 44753: Drop TorProvider.isBootstrapDone [tor-browser]
+   * Bug 44755: Trusted Types (Firefox 148 and above) + Web Workers broken on Safer Level [tor-browser]
+   * Bug 44757: Update tests for removed Services.search [rebase-149] [tor-browser]
+   * Bug 44761: Safer Level's worker patching filters out Worker constructor options [tor-browser]
+   * Bug 44763: Disable WebGPU until audited [tor-browser]
+   * Bug 44764: Review Mozilla 2012344: Hide main AI settings when the feature is blocked [tor-browser]
+   * Bug 44765: Review Mozilla 1972073: Convert Sidebar to config-based prefs [tor-browser]
+   * Bug 44767: Safer Level's worker patching throws on new about:blank frames with Trusted Types [tor-browser]
+   * Bug 44772: Review Mozilla 1980264: Canvas randomization is too slow [tor-browser]
+   * Bug 44778: Safer Level: xray causes patched TrustedTypePolicy instances to be unusable by content. [tor-browser]
+   * Bug 44801: Redact onion origins from Location.ancestorOrigins. [tor-browser]
+   * Bug 44814: Disable trustpanel until our new designs are ready [tor-browser]
+ * Windows + macOS + Linux
+   * Updated Firefox to 149.0a1
+   * Bug 44714: The browser opens a new about:blank tab in 148 [tor-browser]
+   * Bug 44780: AIFeature.sys.mjs failures in 149 desktop builds [tor-browser]
+   * Bug 44781: Use a static page title for about:torconnect [tor-browser]
+   * Bug 44793: `privacy.spoof_english` console error in about:preferences [tor-browser]
+   * Bug 44797: Clean up `about:torconnect` styling [tor-browser]
+   * Bug 44799: Onionize toggle in `about:tor` uses blue text color [tor-browser]
+ * Android
+   * Updated GeckoView to 149.0a1
+   * Bug 43790: Address "Various android workarounds" commit introduced in the 138 rebase [tor-browser]
+   * Bug 44332: Fix android tor logs screen issues presented in 144 rebase [tor-browser]
+   * Bug 44594: DoH is visible on Android [tor-browser]
+   * Bug 44653: Disable "Allow search suggestions in private sessions" prompt presented in RR 148 android [tor-browser]
+   * Bug 44694: Remove new "Tab bar" feature on Android [tor-browser]
+   * Bug 44698: Clean up comments in AccountSettingsFragment.kt. FIXME: Update A-S [tor-browser]
+   * Bug 44700: Untracked change to `HomepageHeader.kt` [tor-browser]
+   * Bug 44751: Noscript (and likely any extension) can be accidently turned off on Android alpha [tor-browser]
+   * Bug 44752: Remove new expanded toolbar option on Android due to fingerprintability [tor-browser]
+   * Bug 44785: Fix SiteSecurityRobot.kt after the 149 rebase [tor-browser]
+   * Bug 44788: Extensions are unreachable via 3 dot menu in alpha (android) [tor-browser]
+   * Bug 44789: Icon of "New Circuit" is not centered but lies in top left corner [tor-browser]
+ * Build System
+   * All Platforms
+     * Bug 43180: Remove translation CI 13.5 legacy extension [tor-browser]
+     * Bug 41758: Rename `tools/signing/deploy-legacy` to `tools/signing/redeploy-update_responses-release` [tor-browser-build]
+     * Bug 41766: Use gzip for all platforms for Go vendoring [tor-browser-build]
+   * Windows + macOS
+     * Bug 41741: Create a 13.5-specific update path [tor-browser-build]
+   * macOS
+     * Bug 41753: Allow running custom commands when vendoring Go dependencies [tor-browser-build]
+
 Tor Browser 16.0a4 - March 11 2026
  * All Platforms
    * Updated NoScript to 13.6.6.90401984


=====================================
projects/browser/config
=====================================
@@ -87,12 +87,12 @@ input_files:
     enable: '[% !c("var/android") %]'
   - filename: dmg-root
     enable: '[% c("var/macos") %]'
-  - URL: https://dist.torproject.org/torbrowser/noscript/noscript-13.6.6.90401984.xpi
+  - URL: https://dist.torproject.org/torbrowser/noscript/noscript-13.6.14.90101984.xp...
     name: noscript
-    sha256sum: a961c57791bc4dc8add25f8e21b527d5b60d8eaff32e627bd6b61383588921ed
-  - URL: https://addons.mozilla.org/firefox/downloads/file/4675310/ublock_origin-1.69...
+    sha256sum: e02bcdecaa47512a116ae7367f70c327aaa084817fe64e66ac6fbb52dc2c492a
+  - URL: https://addons.mozilla.org/firefox/downloads/file/4721638/ublock_origin-1.70...
     name: ublock-origin
-    sha256sum: 785bcde68a25faa8a0949964ec5ffe9bdcb85d3f0ae21c23f607c6c8f91472cf
+    sha256sum: f2730d2877005763a45d765749892e936f49cae713d28f7aa6ea314454b89cf1
     enable: '[% c("var/mullvad-browser") %]'
   - URL: https://cdn.mullvad.net/browser-extension/0.9.7/mullvad-browser-extension-0....
     name: mullvad-extension


=====================================
projects/firefox/config
=====================================
@@ -22,7 +22,7 @@ var:
   browser_series: '16.0'
   browser_rebase: 2
   browser_branch: '[% c("var/browser_series") %]-[% c("var/browser_rebase") %]'
-  browser_build: 1
+  browser_build: 2
   upstream_firefox_commit: FIREFOX_NIGHTLY_149_END
   copyright_year: '[% exec("git show -s --format=%ci " _ c("git_hash") _ "^{commit}", { exec_noco => 1 }).remove("-.*") %]'
   nightly_updates_publish_dir: '[% c("var/nightly_updates_publish_dir_prefix") %]nightly-[% c("var/osname") %]'


=====================================
projects/geckoview/config
=====================================
@@ -25,7 +25,7 @@ var:
   browser_series: '16.0'
   browser_rebase: 2
   browser_branch: '[% c("var/browser_series") %]-[% c("var/browser_rebase") %]'
-  browser_build: 1
+  browser_build: 2
   gitlab_project: https://gitlab.torproject.org/tpo/applications/tor-browser
   git_commit: '[% exec("git rev-parse " _ c("git_hash") _ "^{commit}", { exec_noco => 1 }) %]'
   deps:


=====================================
projects/lyrebird/config
=====================================
@@ -18,7 +18,6 @@ targets:
     tag_gpg_id: 0
   macos:
     var:
-      go_vendor_sha256sum: 6a054acb7793becdbcb9a08ce7781f3d331f15e85242b399fcef96fb89941f4d
       pre_go_vendor: |
         if [ -e "/var/tmp/build/[% project %]-[% c('version') %]/go-1.22.patch" ]; then
           patch -p1 < "/var/tmp/build/[% project %]-[% c('version') %]/go-1.22.patch"


=====================================
projects/moat-settings/config
=====================================
@@ -1,7 +1,7 @@
 # vim: filetype=yaml sw=2
 filename: '[% project %]-[% c("version") %]-[% c("var/build_id") %].tar.[% c("compress_tar") %]'
 git_url: https://gitlab.torproject.org/tpo/anti-censorship/rdsys-admin.git
-git_hash: b4e3b47c3ed31c35a6df43ba654de37b62b93c27
+git_hash: b99317d18b69d878700e124bbfe575495581270d
 version: '[% c("abbrev") %]'
 # Use gz for now, since we do not support Zstandard on Linux containers.
 compress_tar: 'gz'


=====================================
projects/tor/config
=====================================
@@ -1,6 +1,6 @@
 # vim: filetype=yaml sw=2
 filename: '[% project %]-[% c("version") %]-[% c("var/osname") %]-[% c("var/build_id") %].tar.[% c("compress_tar") %]'
-version: 0.4.9.5
+version: 0.4.9.6
 git_hash: 'tor-[% c("version") %]'
 git_url: https://gitlab.torproject.org/tpo/core/tor.git
 git_submodule: 1


=====================================
projects/translation/config
=====================================
@@ -12,13 +12,13 @@ compress_tar: 'gz'
 steps:
   base-browser:
     base-browser: '[% INCLUDE build %]'
-    git_hash: 0c951426ef9c309ba2c5e49f2a429c7914c73c6c
+    git_hash: 25f648dc77b9fe7a6f376a009f2e0073df66b62e
     targets:
       nightly:
         git_hash: 'base-browser'
   tor-browser:
     tor-browser: '[% INCLUDE build %]'
-    git_hash: e531300282aef8d2af89e94a8725ed9368f0a52b
+    git_hash: df0ed48b6e007f4e078ea03cbe2c06a5756af991
     targets:
       nightly:
         git_hash: 'tor-browser'
@@ -32,7 +32,7 @@ steps:
     fenix: '[% INCLUDE build %]'
     # We need to bump the commit before releasing but just pointing to a branch
     # might cause too much rebuidling of the Firefox part.
-    git_hash: 01957ed5cfe97206ebd1fbdba8c7bd94c10ebf0e
+    git_hash: 8451b06e9473a2b137d2f19cd604062891396788
     compress_tar: 'zst'
     targets:
       nightly:


=====================================
rbm.conf
=====================================
@@ -49,6 +49,9 @@ steps:
 
   go_vendor:
     filename: '[% project %]-vendor-[% c("version") %]-[% c("var/build_id") %].tar.[% c("compress_tar") %]'
+    # Use gzip for all platforms, so that they all have the same hash, at least
+    # if they do not have a patch step.
+    compress_tar: gz
     output_dir: "out/[% project %]/go_vendor"
     go_vendor: |
       #!/bin/bash
@@ -78,11 +81,11 @@ buildconf:
   git_signtag_opt: '-s'
 
 var:
-  torbrowser_version: '16.0a4'
+  torbrowser_version: '16.0a5'
   torbrowser_build: 'build1'
   # This should be the date of when the build is started. For the build
   # to be reproducible, browser_release_date should always be in the past.
-  browser_release_date: '2026/03/10 18:30:00'
+  browser_release_date: '2026/03/31 17:00:00'
   browser_release_date_timestamp: '[% USE date; date.format(c("var/browser_release_date"), "%s") %]'
   browser_default_channel: alpha
   browser_platforms:
@@ -128,9 +131,9 @@ var:
   updater_enabled: 1
   build_mar: 1
   torbrowser_incremental_from:
+    - 16.0a4
     - 16.0a3
     - 16.0a2
-    - 16.0a1
   mar_channel_id: '[% c("var/projectname") %]-torproject-[% c("var/channel") %]'
 
 #  torbrowser_legacy_version: 13.5.22



View it on GitLab: https://gitlab.torproject.org/tpo/applications/tor-browser-build/-/compare/9...

-- 
View it on GitLab: https://gitlab.torproject.org/tpo/applications/tor-browser-build/-/compare/9...
You're receiving this email because of your account on gitlab.torproject.org. Manage all notifications: https://gitlab.torproject.org/-/profile/notifications | Help: https://gitlab.torproject.org/help

    

Pier Angelo Vendrame (＠pierov)

tags

participants (1)