- tor-project - lists.torproject.org

TPA-RFC-87: container image lifecycle
by Antoine Beaupré 08 May '25

08 May '25

--- affected users: container registry users deadline: 2025-05-08 (3 weeks) status: proposed discussion: https://gitlab.torproject.org/tpo/tpa/base-images/-/issues/24 --- Summary: TPA container images will follow upstream OS support schedules Table of contents: - Proposal - Debian images - Ubuntu images - Alternatives considered - Different schedules according to image type - Upgrades in lockstep with our major upgrades - Upgrade completes before EOL - Upgrade completes after … [View More]EOL - References # Proposal Container image versions published by TPA as part of the `base-images` repository will be supported following upstream (Debian and Ubuntu) support policies, including "LTS" releases. In other words, we will *not* retire the images in lockstep with the normal "major release" upgrade policy, which typically starts the upgrade during the freeze and aims to retire the previous release within a year. This is to give our users a fallback if they have trouble with the major upgrades, and to simplify our upgrade policy. This implies supporting 4 or 5 Debian build per image, per architecture, depending on how long upstream live, including testing and unstable. We can make exceptions in case our major upgrades take an extremely long time (say, past the LTS EOL date), but we *strongly* encourage all container image users to regularly follow the latest "stable" release (if not "testing") to keep their things up to date, regardless of TPA's major upgrades schedules. Before image retirements, we'll send an announcement, typically about a year in advance (when the new stable is released, which is typically a year before the previous LTS drops out of support) and a month before the actual retirement. ## Debian images Those are the Debian images currently supported and their scheduled retirement date. | codename | version | end of support | |------------|---------|----------------| | `bullseye` | 11 | 2026-08-31 | | `bookworm` | 12 | 2028-06-30 | | `trixie` | 13 | likely 2030 | | `sid` | N/A | N/A | Note that `bullseye` was actually retired already, before this proposal was adopted ([tpo/tpa/base-images#19][]). [tpo/tpa/base-images#19]: https://gitlab.torproject.org/tpo/tpa/base-images/-/issues/19 ## Ubuntu images Ubuntu releases are tracked separately, as we do not actually perform Ubuntu major upgrades. So we currently have those images: | codename | version | end of support | |------------|-----------|----------------| | `focal` | 20.04 LTS | 2025-05-29 | | `jammy` | 22.04 LTS | 2027-06-01 | | `noble` | 24.04 LTS | 2029-05-31 | | `oracular` | 24.10 | 2025-07 | Concretely, it means we're supporting a relatively constant number (4) of upstream releases. Note that we do not currently build other images on top of Ubuntu images, and would discourage such an approach, as Ubuntu is typically not supported by TPA, except to build third-party software (in this case, "C" Tor). # Alternatives considered Those approaches were discussed but ultimately discarded. ## Different schedules according to image type We've also considered having different schedules for different image types, for example having only "stable" for some less common images. This, however, would be confusing for users: they would need to *guess* what exactly we consider to be a "common" image. This implies we build more images than we might truly need (e.g. who really needs the `redis-server` image from `testing` *and* `unstable`?) but this seems like a small cost to pay for the tradeoff. We currently do not feel the number of built images is a problem in our pipelines. ## Upgrades in lockstep with our major upgrades We've also considered retiring container images in lockstep with the major OS upgrades as performed by TPA. For Debian, this would have *not* include LTS releases, unless our upgrades are delayed. For Ubuntu, it includes LTS releases and supported rolling releases. For Debian, it meant we generally supported 3 releases (including testing and unstable), except during the upgrade, when we support 4 versions of the container images for however long it takes to complete the upgrade after the stable release. This was confusing, as the lifetime of an image depended upon the speed at which major upgrades were performed. Those are highly variable, as they depend on the team's workload and the difficulties encountered (or not) during the procedure. It could mean that support for a container image would abruptly be dropped if the major upgrade crossed the LTS boundary, although this is also a problem with the current proposal, alleviated by pre-retirement announcements. ### Upgrade completes before EOL In this case, we complete the Debian 13 upgrade before the EOL: - 2025-04-01: Debian 13 upgrade starts, 12 and 13 images supported - 2025-06-10: Debian 13 released, Debian 14 becomes `testing`, 12, 13 and 14 images supported - 2026-02-15: Debian 13 upgrade completes - 2026-06-10: Debian 12 becomes LTS, 12 support dropped, 13 and 14 supported In this case, "oldstable" images (Debian 12) images are supported 4 months after the major upgrade completion, and 14 months after the upgrades start. ### Upgrade completes after EOL In this case, we complete the Debian 13 upgrade after the EOL: - 2025-04-01: Debian 13 upgrade starts, 12 and 13 images supported - 2025-06-10: Debian 13 released, Debian 14 becomes `testing`, 12, 13 and 14 images supported - 2026-06-10: Debian 12 becomes LTS, 12, 13 and 14 supported - 2027-02-15: Debian 13 upgrade completes, Debian 12 images support dropped, 13 and 14 supported - 2028-06-30: Debian 12 LTS support dropped upstream In this case, "oldstable" (Debian 12) images are supported zero months after the major upgrades completes, and 22 months after the upgrade started. # References - [discussion issue][] - [Debian release support schedule][] - [Ubuntu][] and [Debian][] release timelines at Wikipedia - [Debian major upgrades progress and history][] [discussion issue]: https://gitlab.torproject.org/tpo/tpa/base-images/-/issues/24 [Debian major upgrades progress and history]: https://gitlab.torproject.org/tpo/tpa/team/-/wikis/howto/upgrades#all-time-… [Debian]: https://en.wikipedia.org/wiki/Debian_version_history#Release_table [Ubuntu]: https://en.wikipedia.org/wiki/Ubuntu_version_history#Table_of_versions [Debian release support schedule]: https://www.debian.org/releases/ -- Antoine Beaupré torproject.org system administration [View Less]

1 1

Anti-censorship team meeting notes, 2025-05-08
by meskio 08 May '25

08 May '25

Hey everyone! Here are our meeting logs: http://meetbot.debian.net/tor-meeting/2025/tor-meeting.2025-05-08-16.00.html And our meeting pad: Anti-censorship -------------------------------- Next meeting: Thursday, May 15 16:00 UTC Facilitator: shelikhoo ^^^(See Facilitator Queue at tail) Weekly meetings, every Thursday at 16:00 UTC, in #tor-meeting at OFTC (channel is logged while meetings are in progress) This week's Facilitator: meskio == Goal of this meeting == Weekly check-in about … [View More]

1 0

Haidi April'25 Monthly report
by haidis＠riseup.net 07 May '25

07 May '25

Hi! Below is my April’25 (Period: 2025-04-01 - 2025-04-30) report! In April, I resolved 92 tickets: * On Telegram (@TorProjectSupportBot) – 88 (from Iran); * On RT (frontdesk@tpo) – 4 (from Iran); * On WhatsApp (+447421000612) - 0; * And on Signal (+17787431312) - 0; I Worked on a forum document for ” Iran : Circumventing Censorship with Tor” to update according to the latest screenshots, translation, instruction and links. Working on some Farsi translations articles and text modules … [View More]

1 0

Nina’s Monthly Status Report, April 2025
by Nina 06 May '25

06 May '25

Hi! Below is my April’25 report! In April, I resolved 629 (↓47) tickets: * On Telegram (@TorProjectSupportBot) - 531 (↓40); * On RT (frontdesk@tpo) - 94 (↓8); * On WhatsApp (+447421000612) - 3 (0); * And on Signal (+17787431312) - 1 (↑1). My main focus remains the same: I help Russian-speaking users bypass censorship and troubleshoot any issues with Tor Browser. Idocumentedthe latest internet censorship developments in Russia[1] and how it's affecting Tor users, for example, … [View More]

1 0

Felicia's Monthly Status Report, April 2025
by Priscila 05 May '25

05 May '25

Hi everyone, This is my status report for April 2025. It's a list of all tasks I've been involved with/responsible for. ## Design tasks 1. Allow authentication of Onion Services on Android: https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/31672 2. Figure out how to display conflux circuits in Tor Browser’s UI: https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/41716 3. Update Connection Assist for Android designs: https://gitlab.torproject.… [View More]

1 0

ebanam's monthly user support and status report for April 2025
by ebanam 05 May '25

05 May '25

Hello everyone, With the first milestone release of Tor Browser (14.5)[0] in the year, I worked on a few related tasks, namely, updating the Tor Browser User Manual before the release[1], updating the Support Portal[2] and other relevant user support documentation on our support channels and the Tor Forum and user support work post-release. I made progress with writing documentation for the upcoming Tor VPN Android client[3]. Much of my user support related work last month, as is usual, was … [View More]focused on helping users in regions where Tor is censored. That's it for the summary, following is a more detailed report about the tickets our user support team worked on last month. # Updates We fixed some issues with our Signal user support channel and it should be reachable again[4]. To reach our team on Signal, please contact +17787431312 or @torsupport.89 on Signal. # Frontdesk (email user support channel) * 679(↑) RT tickets created * 691(↑) RT tickets resolved Tickets by topics and numbers: 1. 383(↓) tickets: instructions to circumvent censorship for Chinese speaking users. 2. 102(-) tickets: circumventing censorship in Russian speaking countries. 3. 15(↓) tickets: help with troubleshooting existing Tor Browser install on Desktop (Windows, macOS and Linux). 4. 4(↑) tickets: reports of fake apps on iOS AppStore masquerading as official Tor Browser. 5. 4(↑) tickets: help with troubleshooting existing Tor Browser install on Android. 6. 3(-) tickets: reports of websites blocking Tor connections. 7. 3(↑) tickets: help with installing Tor Browser on Windows. 8. 2(↓) tickets: installing Tor Browser on Linux. 9. 2(↑) tickets: questions about onion services and how to access them. 10. 2(↑) tickets: question about setting up a Tor relay. 11. 2(↑) tickets: users seeing a "proxy refused" error when visiting websites on Tor Browser for Android using Samsung devices.[5] 12. 2(↑) tickets: reports of Tor bug (tor 0.4.8.16): https://gitlab.torproject.org/tpo/core/tor/-/issues/41040 13. 1(↓) ticket: Unable to login on X.com (formerly Twitter) when using Tor Browser.[6] 14. 1(↓) ticket: circumventing censorship with Tor in Farsi. 15. 1(-) ticket: Websites display in other languages when using Tor Browser. 16. 1(↑) ticket: question about operating system spoofing in Tor Browser. 17. 1(↑) ticket: question about the Tor Browser User Survey. 18. 1(↑) ticket: question about contributing and helping with with localization. 19. 1(↑) ticket: helping users on iOS, using Onion Browser or Orbot, to use censorship circumvention methods. 20. 1(↑) ticket: Bridges website hitting an error while fetching bridges with WebTunnel pluggable transport.[7] # Telegram, WhatsApp and Signal user support channels * 866(↑) tickets resolved Breakdown: * 827(↑) tickets on Telegram * 13(↓) tickets on WhatsApp * 26(↑) tickets on Signal Tickets by topics and numbers: 1. 509(↓) tickets: circumventing censorship in Russian speaking countries. 2. 102(↑) tickets: circumventing censorship with Tor in Farsi. 3. 55(↓) tickets: instructions to circumvent censorship for Chinese speaking users. 4. 14(↓) tickets: helping users on iOS, using Onion Browser or Orbot, to use censorship circumvention methods. 5. 13(↑) tickets: help with using Snowflake with Tor to circumvent censorship. 6. 11(↓) tickets: help with troubleshooting Tor Browser Desktop on Windows, macOS and Linux. 7. 11(↑) tickets: help with troubleshooting Tor Browser Android. 8. 7(↑) tickets: instructions on how to get Tor Browser binaries from GetTor. 9. 5(↓) tickets: help with instructions to use bridges with Tails. 10. 4(-) tickets: questions about onion services and how to access them. 11. 4(↑) tickets: Unable to login on X.com (formerly Twitter) when using Tor Browser. 12. 3(↑) tickets: Bookmarks are failing to load on Tor Browser for Android Alpha. (Issue is resolved.) 13. 2(↑) tickets: instructions to download Tor Browser 13.5 legacy for legacy operating systems. 14. 1(↓) ticket: users seeing a "proxy refused" error when visiting websites on Tor Browser for Android using Samsung devices. 15. 1(↑) ticket: question about operating system spoofing in Tor Browser. # Highlights from the Tor Forum 1. Tor user support now available in Farsi.[8] 2. Canvas fingerprinting protection in Tor Browser.[9] 3. Download protection in Tor Browser.[10] Note: (↑), (↓) and (-) are indicating if the number of tickets we received for these topics have been increasing, decreasing or have been the same from the previous month respectively. best, e. [0]: https://blog.torproject.org/new-release-tor-browser-145/ [1]: https://gitlab.torproject.org/tpo/web/manual/-/issues/182 [2]: https://gitlab.torproject.org/tpo/web/support/-/issues/390 [3]: https://gitlab.torproject.org/tpo/web/support/-/issues/370 [4]: https://gitlab.torproject.org/tpo/community/support/-/issues/40188 [5]: https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/42714 [6]: https://forum.torproject.org/t/x-com-formerly-twitter-issues-with-tor-brows… [7]: https://gitlab.torproject.org/tpo/anti-censorship/rdsys/-/issues/262 [8]: https://forum.torproject.org/t/tor-user-support-now-available-in-farsi/18520 [9]: https://forum.torproject.org/t/why-website-display-stripes/18281 [10]: https://forum.torproject.org/t/tor-browser-blocking-downloads/18316 [View Less]

1 0

cve's monthly status report -- April 2025
by Clara Engler 05 May '25

05 May '25

Hello tor-project@, the following contains a list of the work I have done for Tor in April 2025. # arti * Assisted gabi in the release of 1.4.2 * Removed a dead code reference in the RPC API * Added a gitignore for Python * Added a CI check for wildcard requirements in Cargo.toml files # onionmasq * Updated arti to 1.4.2 * Fixed rust-clippy CI container failure * Migrated all containers to a common image * Rewrote the integration test suite to a much cleaner implementation that is not … [View More]

1 0

sajolida's report for April 2025
by sajolida 01 May '25

01 May '25

Hi, Tails ===== Misc ---- - Interviewed an activist in struggle against a nuclear project in France who uses Tails and trains others: https://tails.net/contribute/how/user_experience/interviews/robin/ It was the first time we invited for an interview someone who contacted us initially by email on our Help Desk. It proved to be a success! - Explained why and how we've used https://tails.net/home as the homepage of Tor Browser in Tails until now. (#20822) Project 165 -----… [View More]

1 0

Rhatto's Monthly Status Report, April 2025
by rhatto 01 May '25

01 May '25

Hi all :) This is my monthly status report for April 2025 with the main relevant activities I have done, was involved or are related to my work during the period. ## CI Templates * Did a soft fork of TPA's ci-templates repository and added various templates for common procedures such as container management, packaging and spell checking: https://gitlab.torproject.org/tpo/onion-services/ci-templates/-/tree/main/o… * AnCIble (CI and Role templates for Ansible) had it's pipeline cleaned … [View More]

1 0

PieroV's Monthly Status Report, April 2025
by Pier Angelo Vendrame 01 May '25

01 May '25

Hi everyone, Here is my status report for April 2025. At the beginning of the month, I helped to do some QA for the 14.5 release (on Linux i686, Android armv7, and Android x86_64). I also did some last-minute fixes, such as the one to actually provide a localized version of region names on Android [tor-browser#43633]. After the big release, I worked on rapid-release rebases (I was an additional reviewer for 133 and did the 134 rebase [tor-browser#43415]). I also started working on the … [View More]

1 0