[tor-bugs] #20691 [Applications/Tor Browser]: Updates are not getting properly applied when trying to update to 6.5a4(-hardened) on Linux

Thu Nov 17 19:46:22 UTC 2016

#20691: Updates are not getting properly applied when trying to update to
6.5a4(-hardened) on Linux
--------------------------------------+--------------------------
 Reporter:  gk                        |          Owner:  tbb-team
     Type:  defect                    |         Status:  new
 Priority:  Immediate                 |      Milestone:
Component:  Applications/Tor Browser  |        Version:
 Severity:  Critical                  |     Resolution:
 Keywords:  TorBrowserTeam201611      |  Actual Points:
Parent ID:                            |         Points:
 Reviewer:                            |        Sponsor:
--------------------------------------+--------------------------

Comment (by mcs):

 Replying to [comment:13 gk]:
 > Thanks for looking into it. So, what do you suggest? Enabling the
 updates for Linux as well and doing a final update to our blog post?

 Yes, because we do want users to get the update.

 > It seems in the worst case users are downloading the update again and
 again until they get the "Update failed x times" dialog. Can we say
 something sensibly on it conveying the current issue (with some attribute
 in the XML files)? I guess not? Or would we just leave the updater
 disabled and getting the onion to flash getting users to find the "Check
 for Tor Browser Update..." in the Torbutton menu? I guess this is
 suboptimal, at least for the reason that it is probably an unusal update
 flow even for alpha users.

 I don't think we can add text to that dialog, but there is a "billboard"
 feature that we have never used that might be helpful in this case. (note
 that Mozilla recently remove that feature; see
 https://bugzilla.mozilla.org/show_bug.cgi?id=1296207). I tried it and it
 seems to work. You can create an HTML page that is displayed instead of
 the standard update prompt, and there is also a way to force the prompt to
 be shown even for automatic/background updates. Here is a sample update
 manifest; note the `showPrompt` and `billboard` attributes:
 {{{
 <?xml version="1.0"?>
 <updates>
     <update type="minor" displayVersion="6.5a4" appVersion="6.5a4"
             platformVersion="45.5.0"
             buildID="20000101000000"
             showPrompt="true"
 billboardURL="https://example.com/tor/update_2/alpha/billboard.html"
             detailsURL="https://example.com/tor/details.html">
         <patch type="complete"
                URL="http://example.com/tor/update_2/alpha/mars/tor-
 browser-linux64-6.5a4_en-US.mar"
                hashFunction="SHA512"
 hashValue="ce9e233cac4495b803b08243603ccaf3c968c0ecb48f725e9ccb1a2b9d61c0b78cd71ecd324ed3b1a71875a94ecaeff0018ad059c139eaf61f37ad432fe8befe"
                size="89297856"/>
     </update>
 </updates>
 }}}

 The other thing that took Kathy and me some time to figure out is that the
 HTML file must include a billboard attribute on the body, e.g.,
 {{{
 <!DOCTYPE html>
 <html>
 <head>
 <meta charset="UTF-8">
 <title>Billboard Test</title>
 </head>
 <body billboard="true">
 This is a test.
 <p>
 Useful info should be placed here.
 </body>
 </html>
 }}}

 I will attach a screenshot that shows what this looks like. The text
 should include "Tor Browser 6.5a4 is available" plus whatever you include
 in the blog to help people work around this update issue (which most
 people will be affected by).

--
Ticket URL: <https://trac.torproject.org/projects/tor/ticket/20691#comment:14>
Tor Bug Tracker & Wiki <https://trac.torproject.org/>
The Tor Project: anonymity online