[tbb-bugs] #32498 [Applications/Tor Browser]: Consider updating MAR_CHANNEL_ID for nightly build (and maybe alpha too)

[Tor Bug Tracker & Wiki]

#32498: Consider updating MAR_CHANNEL_ID for nightly build (and maybe alpha too)
-------------------------------------------------+-------------------------
 Reporter:  boklm                                |          Owner:  tbb-
                                                 |  team
     Type:  task                                 |         Status:  new
 Priority:  Medium                               |      Milestone:
Component:  Applications/Tor Browser             |        Version:
 Severity:  Normal                               |     Resolution:
 Keywords:  tbb-rbm, boklm201911, tbb-update,    |  Actual Points:
  TorBrowserTeam201911                           |
Parent ID:  #18867                               |         Points:
 Reviewer:                                       |        Sponsor:
-------------------------------------------------+-------------------------

Comment (by boklm):

 Replying to [comment:1 mcs]:
 > Using different MAR channel IDs would prevent the updater from accepting
 a mar file from a different channel (probably better from a security point
 of view). If I remember correctly, doing so would also prevent use of MAR
 tools such as `signmar` across releases. That would probably be OK, but
 might lead to some confusion for developers.

 Preventing an attacker from being able to switch stable users to alpha
 seems useful. Although that does not seems to be a major threat, so it is
 probably not urgent to do it.

 Looking at `modules/libmar/tool/mar.c`, I see that some of the commands
 have a `-H MARChannelID` option (for example the one to create a MAR
 file), but it seems the signing one does not have that option. We normally
 use the martools from the corresponding version when generating mar and
 incremental mars, so this should not be an issue.

 >
 > If we do switch the MAR channel for in our alpha series we need to think
 about how to make the transition. I believe that such a transition will
 require a "watershed" update, but I have not spent a lot of time thinking
 about it.

 As there is no urgency to do the switch, maybe we could have an
 `ACCEPTED_MAR_CHANNEL_IDS` containing both channels for something like 9
 months, before doing the switch without a watershed update (or taking
 advantage the watershed update to the next ESR if one is needed). This
 would break update for alpha users who did not update in a few months, but
 maybe there are not so many users of 9 month-old alpha versions.

 For the nightly, switching channels is already prevented by using
 different signing keys, but since there is no transition needed, maybe we
 can use a separate channel ID from the beginning.

--
Ticket URL: <https://trac.torproject.org/projects/tor/ticket/32498#comment:2>
Tor Bug Tracker & Wiki <https://trac.torproject.org/>
The Tor Project: anonymity online