.eslintignore

@@ -299,3 +299,5 @@ toolkit/components/uniffi-bindgen-gecko-js/components/generated/*
 # Test files for circular import in modules.
 dom/base/test/jsmodules/import_circular.mjs
 dom/base/test/jsmodules/import_circular_1.mjs
+
+browser/app/profile/001-base-profile.js

.gitlab-ci.yml

+stages:
+  - setup
+  - lint
+
+variables:
+  IMAGE_PATH: containers.torproject.org/tpo/applications/tor-browser/base:latest
+
+include:
+  - local: '.gitlab/ci/setup.yml'
+  - local: '.gitlab/ci/lint.yml'

.gitlab/ci/docker/base/Dockerfile

+FROM debian:latest
+
+# Base image which includes all* dependencies checked by ./mach configure.
+#
+# * Actually not all dependencies. WASM sandboxed depencies were left out for now.
+# This installs all dependencies checked by `./mach configure --without-wasm-sandboxed-libraries`.
+#
+# # Building and publishing
+#
+# Whenever this file changes, the updated Docker image must be built and published _manually_ to
+# the tor-browser container registry (https://gitlab.torproject.org/tpo/applications/tor-browser/container_registry/185).
+#
+# This image copies a script from the taskcluster/ folder, which requires it
+# to be built from a folder which is a parent of the taskcluster/ folder.
+#
+# To build, run:
+#
+# ```bash
+# docker build \
+#   -f <PATH_TO_DOCKERFILE> \
+#   -t <REGISTRY_URL>/<IMAGE_NAME>:<IMAGE_TAG>
+#   .
+# ```
+#
+# For example, when building from the root of this repository to the main tor-browser repository
+# and assuming image name to be "base" and tag "latest" -- which is the current terminology:
+#
+# ```bash
+# docker build \
+#   -f .gitlab/ci/docker/Dockerfile \
+#   -t containers.torproject.org/tpo/applications/tor-browser/base:latest
+#   .
+# ```
+
+RUN apt-get update && apt-get install -y \
+    clang \
+    curl \
+    git \
+    libasound2-dev \
+    libdbus-glib-1-dev \
+    libgtk-3-dev \
+    libpango1.0-dev \
+    libpulse-dev \
+    libx11-xcb-dev \
+    libxcomposite-dev \
+    libxcursor-dev \
+    libxdamage-dev \
+    libxi-dev \
+    libxrandr-dev \
+    libxtst-dev \
+    m4 \
+    mercurial \
+    nasm \
+    pkg-config \
+    python3 \
+    python3-pip \
+    unzip \
+    wget
+
+COPY taskcluster/docker/recipes/install-node.sh /scripts/install-node.sh
+RUN chmod +x /scripts/install-node.sh
+RUN /scripts/install-node.sh
+
+RUN curl https://sh.rustup.rs -sSf | sh -s -- -y
+RUN $HOME/.cargo/bin/cargo install cbindgen
+
+WORKDIR /app
+
+CMD ["/bin/bash"]

.gitlab/ci/lint.yml

+.base:
+  stage: lint
+  image: $IMAGE_PATH
+  interruptible: true
+  needs:
+    - job: setup-env
+      artifacts: true
+    - job: create-bundle
+      artifacts: true
+  variables:
+    MOZBUILD_STATE_PATH: "$CI_PROJECT_DIR/.cache/mozbuild"
+    GIT_STRATEGY: "none"
+  cache:
+    paths:
+      - node_modules
+      - .cache/mozbuild
+    # Store the cache regardless on job outcome
+    when: 'always'
+    # Share the cache throughout all pipelines running for a given branch
+    key: $CI_COMMIT_REF_SLUG
+  before_script:
+    # DEBUG: Are all artifacts here?
+    - ls -a
+    - mkdir app && cd app
+    # Initialize a fresh git repo
+    - git init
+    # Add app.bundle as the remote. All operations that communicate with the remote will be local.
+    - git remote add origin ../app.bundle
+    # shallow.txt contains the SHA of the base commit of the bundle.
+    # The bundle is shallow, therefore it's base commit will not have a parent.
+    # Adding the SHA of the base commit to .git/shallow tells git that it doesn't need
+    # to crash when it realizes said base commit doesn't have a parent.
+    - cp ../shallow.txt .git/shallow
+    # Finally, unpack the bundle. Time it for debugging purposes.
+    - time git pull origin $BRANCH_NAME
+
+eslint:
+  extends: .base
+  script:
+    - cat ../changedfiles.txt | xargs -d '\n' ./mach lint -l eslint
+  rules:
+    - if: $CI_PIPELINE_SOURCE == 'merge_request_event'
+      changes:
+        # List copied from: taskcluster/ci/source-test/mozlint.yml
+        #
+        # Files that are likely audited.
+        - '**/*.js'
+        - '**/*.jsm'
+        - '**/*.json'
+        - '**/*.jsx'
+        - '**/*.mjs'
+        - '**/*.sjs'
+        - '**/*.html'
+        - '**/*.xhtml'
+        - '**/*.xml'
+        - 'tools/lint/eslint.yml'
+        # Run when eslint policies change.
+        - '**/.eslintignore'
+        - '**/*eslintrc*'
+        # The plugin implementing custom checks.
+        - 'tools/lint/eslint/eslint-plugin-mozilla/**'
+        - 'tools/lint/eslint/eslint-plugin-spidermonkey-js/**'
+    # Run job whenever a commit is merged to a protected branch
+    - if: $CI_COMMIT_REF_PROTECTED == 'true'
+
+stylelint:
+  extends: .base
+  script:
+    - cat ../changedfiles.txt | xargs -d '\n' ./mach lint -l stylelint
+  rules:
+    - if: $CI_PIPELINE_SOURCE == 'merge_request_event'
+      changes:
+        # List copied from: taskcluster/ci/source-test/mozlint.yml
+        #
+        # Files that are likely audited.
+        - '**/*.css'
+        - 'tools/lint/styleint.yml'
+        # Run when stylelint policies change.
+        - '**/.stylelintignore'
+        - '**/*stylelintrc*'
+    # Run job whenever a commit is merged to a protected branch
+    - if: $CI_COMMIT_REF_PROTECTED == 'true'
+
+py-black:
+  extends: .base
+  script:
+    - cat ../changedfiles.txt | xargs -d '\n' ./mach lint -l black
+  rules:
+    - if: $CI_PIPELINE_SOURCE == 'merge_request_event'
+      changes:
+        # List copied from: taskcluster/ci/source-test/mozlint.yml
+        #
+        # The list of extensions should match tools/lint/black.yml
+        - '**/*.py'
+        - '**/moz.build'
+        - '**/*.configure'
+        - '**/*.mozbuild'
+        - 'pyproject.toml'
+        - 'tools/lint/black.yml'
+    # Run job whenever a commit is merged to a protected branch
+    - if: $CI_COMMIT_REF_PROTECTED == 'true'
+
+py-ruff:
+  extends: .base
+  script:
+    - cat ../changedfiles.txt | xargs -d '\n' ./mach lint -l ruff
+  rules:
+    - if: $CI_PIPELINE_SOURCE == 'merge_request_event'
+      changes:
+        # List copied from: taskcluster/ci/source-test/mozlint.yml
+        #
+        - '**/*.py'
+        - '**/*.configure'
+        - '**/.ruff.toml'
+        - 'pyproject.toml'
+        - 'tools/lint/ruff.yml'
+        - 'tools/lint/python/ruff.py'
+        - 'tools/lint/python/ruff_requirements.txt'
+    # Run job whenever a commit is merged to a protected branch
+    - if: $CI_COMMIT_REF_PROTECTED == 'true'
+
+yaml:
+  extends: .base
+  script:
+    - cat ../changedfiles.txt | xargs -d '\n' ./mach lint -l yaml
+  rules:
+    - if: $CI_PIPELINE_SOURCE == 'merge_request_event'
+      changes:
+        # List copied from: taskcluster/ci/source-test/mozlint.yml
+        #
+        - '**/*.yml'
+        - '**/*.yaml'
+        - '**/.ymllint'
+    # Run job whenever a commit is merged to a protected branch
+    - if: $CI_COMMIT_REF_PROTECTED == 'true'
+
+shellcheck:
+  extends: .base
+  script:
+    - cat ../changedfiles.txt | xargs -d '\n' ./mach lint -l shellcheck
+  rules:
+    - if: $CI_PIPELINE_SOURCE == 'merge_request_event'
+      changes:
+        # List copied from: taskcluster/ci/source-test/mozlint.yml
+        #
+        - '**/*.sh'
+        - 'tools/lint/shellcheck.yml'
+    # Run job whenever a commit is merged to a protected branch
+    - if: $CI_COMMIT_REF_PROTECTED == 'true'
+
+clang-format:
+  extends: .base
+  script:
+    - ./mach configure --without-wasm-sandboxed-libraries --with-base-browser-version=0.0.0
+    - cat ../changedfiles.txt | xargs -d '\n' ./mach lint -l clang-format
+  rules:
+    - if: $CI_PIPELINE_SOURCE == 'merge_request_event'
+      changes:
+        # List copied from: taskcluster/ci/source-test/mozlint.yml
+        #
+        - '**/*.cpp'
+        - '**/*.c'
+        - '**/*.cc'
+        - '**/*.h'
+        - '**/*.m'
+        - '**/*.mm'
+        - 'tools/lint/clang-format.yml'
+    # Run job whenever a commit is merged to a protected branch
+    - if: $CI_COMMIT_REF_PROTECTED == 'true'
+
+rustfmt:
+  extends: .base
+  script:
+    - cat ../changedfiles.txt | xargs -d '\n' ./mach lint -l rustfmt
+  rules:
+    - if: $CI_PIPELINE_SOURCE == 'merge_request_event'
+      changes:
+        # List copied from: taskcluster/ci/source-test/mozlint.yml
+        #
+        - '**/*.rs'
+        - 'tools/lint/rustfmt.yml'
+    # Run job whenever a commit is merged to a protected branch
+    - if: $CI_COMMIT_REF_PROTECTED == 'true'
+
+fluent-lint:
+  extends: .base
+  script:
+    - cat ../changedfiles.txt | xargs -d '\n' ./mach lint -l fluent-lint
+  rules:
+    - if: $CI_PIPELINE_SOURCE == 'merge_request_event'
+      changes:
+        # List copied from: taskcluster/ci/source-test/mozlint.yml
+        #
+        - '**/*.ftl'
+        - 'tools/lint/fluent-lint.yml'
+        - 'tools/lint/fluent-lint/exclusions.yml'
+    # Run job whenever a commit is merged to a protected branch
+    - if: $CI_COMMIT_REF_PROTECTED == 'true'
+
+localization:
+  extends: .base
+  script:
+    - cat ../changedfiles.txt | xargs -d '\n' ./mach lint -l l10n
+  rules:
+    - if: $CI_PIPELINE_SOURCE == 'merge_request_event'
+      changes:
+        # List copied from: taskcluster/ci/source-test/mozlint.yml
+        #
+        - '**/locales/en-US/**'
+        - '**/l10n.toml'
+        - 'third_party/python/compare-locales/**'
+        - 'third_party/python/fluent/**'
+        - 'tools/lint/l10n.yml'
+    # Run job whenever a commit is merged to a protected branch
+    - if: $CI_COMMIT_REF_PROTECTED == 'true'
+
+mingw-capitalization:
+  extends: .base
+  script:
+    - cat ../changedfiles.txt | xargs -d '\n' ./mach lint -l mingw-capitalization
+  rules:
+    - if: $CI_PIPELINE_SOURCE == 'merge_request_event'
+      changes:
+        # List copied from: taskcluster/ci/source-test/mozlint.yml
+        #
+        - '**/*.cpp'
+        - '**/*.cc'
+        - '**/*.c'
+        - '**/*.h'
+        - 'tools/lint/mingw-capitalization.yml'
+    # Run job whenever a commit is merged to a protected branch
+    - if: $CI_COMMIT_REF_PROTECTED == 'true'
+
+mscom-init:
+  extends: .base
+  script:
+    - cat ../changedfiles.txt | xargs -d '\n' ./mach lint -l mscom-init
+  rules:
+    - if: $CI_PIPELINE_SOURCE == 'merge_request_event'
+      changes:
+        # List copied from: taskcluster/ci/source-test/mozlint.yml
+        #
+        - '**/*.cpp'
+        - '**/*.cc'
+        - '**/*.c'
+        - '**/*.h'
+        - 'tools/lint/mscom-init.yml'
+    # Run job whenever a commit is merged to a protected branch
+    - if: $CI_COMMIT_REF_PROTECTED == 'true'
+
+file-whitespace:
+  extends: .base
+  script:
+    - cat ../changedfiles.txt | xargs -d '\n' ./mach lint -l file-whitespace
+  rules:
+    - if: $CI_PIPELINE_SOURCE == 'merge_request_event'
+      changes:
+        # List copied from: taskcluster/ci/source-test/mozlint.yml
+        #
+        - '**/*.c'
+        - '**/*.cc'
+        - '**/*.cpp'
+        - '**/*.css'
+        - '**/*.dtd'
+        - '**/*.idl'
+        - '**/*.ftl'
+        - '**/*.h'
+        - '**/*.html'
+        - '**/*.md'
+        - '**/*.properties'
+        - '**/*.py'
+        - '**/*.rs'
+        - '**/*.rst'
+        - '**/*.webidl'
+        - '**/*.xhtml'
+        - 'tools/lint/file-whitespace.yml'
+    # Run job whenever a commit is merged to a protected branch
+    - if: $CI_COMMIT_REF_PROTECTED == 'true'
+
+test-manifest:
+  extends: .base
+  script:
+    - cat ../changedfiles.txt | xargs -d '\n' ./mach lint -l test-manifest-alpha -l test-manifest-disable -l test-manifest-skip-if
+  rules:
+    - if: $CI_PIPELINE_SOURCE == 'merge_request_event'
+      changes:
+        # List copied from: taskcluster/ci/source-test/mozlint.yml
+        #
+        - '**/*.ini'
+        - 'python/mozlint/**'
+        - 'tools/lint/**'
+    # Run job whenever a commit is merged to a protected branch
+    - if: $CI_COMMIT_REF_PROTECTED == 'true'
+
+trojan-source:
+  extends: .base
+  script:
+    - cat ../changedfiles.txt | xargs -d '\n' ./mach lint -l trojan-source
+  rules:
+    - if: $CI_PIPELINE_SOURCE == 'merge_request_event'
+      changes:
+        # List copied from: taskcluster/ci/source-test/mozlint.yml
+        #
+        - '**/*.c'
+        - '**/*.cc'
+        - '**/*.cpp'
+        - '**/*.h'
+        - '**/*.py'
+        - '**/*.rs'
+        - 'tools/lint/trojan-source.yml'
+    # Run job whenever a commit is merged to a protected branch
+    - if: $CI_COMMIT_REF_PROTECTED == 'true'

.gitlab/ci/scripts/helpers.py

+#!/usr/bin/env python3
+
+import argparse
+import os
+import re
+import shlex
+import subprocess
+
+
+def git(command):
+    result = subprocess.run(
+        ["git"] + shlex.split(command), check=True, capture_output=True, text=True
+    )
+    return result.stdout.strip()
+
+
+def get_firefox_tag(reference):
+    """Extracts the Firefox tag associated with a branch or tag name.
+
+       The "firefox tag" is the tag that marks
+       the end of the Mozilla commits and the start of the Tor Project commits.
+
+       Know issue: If ever there is more than one tag per Firefox ESR version,
+       this function may return the incorrect reference number.
+
+    Args:
+        reference: The branch or tag name to extract the Firefox tag from.
+        Expected format is tor-browser-91.2.0esr-11.0-1,
+        where 91.2.0esr is the Firefox version.
+
+    Returns:
+        The reference specifier of the matching Firefox tag.
+        An exception will be raised if anything goes wrong.
+    """
+
+    # Extracts the version number from a branch or tag name.
+    firefox_version = ""
+    match = re.search(r"(?<=browser-)([^-]+)", reference)
+    if match:
+        # TODO: Validate that what we got is actually a valid semver string?
+        firefox_version = match.group(1)
+    else:
+        raise ValueError(f"Failed to extract version from reference '{reference}'.")
+
+    tag = f"FIREFOX_{firefox_version.replace('.', '_')}_"
+    remote_tags = git("ls-remote --tags origin")
+
+    # Each line looks like:
+    # 9edd658bfd03a6b4743ecb75fd4a9ad968603715  refs/tags/FIREFOX_91_9_0esr_BUILD1
+    pattern = rf"(.*){re.escape(tag)}(.*)$"
+    match = re.search(pattern, remote_tags, flags=re.MULTILINE)
+    if match:
+        return match.group(0).split()[0]
+    else:
+        raise ValueError(
+            f"Failed to find reference specifier for Firefox tag '{tag}' from '{reference}'."
+        )
+
+
+def get_list_of_changed_files():
+    """Gets a list of files changed in the working directory.
+
+       This function is meant to be run inside the Gitlab CI environment.
+
+       When running in a default branch, get the list of changed files since the last Firefox tag.
+       When running for a new MR commit, get a list of changed files in the current MR.
+
+    Returns:
+        A list of filenames of changed files (excluding deleted files).
+        An exception wil be raised if anything goes wrong.
+    """
+
+    base_reference = ""
+
+    if os.getenv("CI_PIPELINE_SOURCE") == "merge_request_event":
+        # For merge requests, the base_reference is the common ancestor between the MR and the target branch
+        base_reference = os.getenv("CI_MERGE_REQUEST_DIFF_BASE_SHA")
+    else:
+        # When not in merge requests, the base reference is the Firefox tag
+        base_reference = get_firefox_tag(os.getenv("CI_COMMIT_BRANCH"))
+
+    if not base_reference:
+        raise RuntimeError("No base reference found. There might be more errors above.")
+
+    # Fetch the tag reference
+    git(f"fetch origin {base_reference} --depth=1 --filter=blob:none")
+    # Return but filter the issue_templates files because those file names have spaces which can cause issues
+    return git("diff --diff-filter=d --name-only FETCH_HEAD HEAD").split("\n")
+
+
+if __name__ == "__main__":
+    parser = argparse.ArgumentParser(description="")
+
+    parser.add_argument(
+        "--get-firefox-tag",
+        help="Get the Firefox tag related to a given (tor-mullvad-base)-browser tag or branch name.",
+        type=str,
+    )
+    parser.add_argument(
+        "--get-changed-files",
+        help="Get list of changed files."
+        "When running from a merge request get sthe list of changed files since the merge-base of the current branch."
+        "When running from a protected branch i.e. any branch that starts with <something>-browser-, gets the list of files changed since the FIREFOX_ tag.",
+        action="store_true",
+    )
+
+    args = parser.parse_args()
+
+    if args.get_firefox_tag:
+        print(get_firefox_tag(args.get_firefox_tag))
+    elif args.get_changed_files:
+        print("\n".join(get_list_of_changed_files()))
+    else:
+        print("No valid option provided.")

.gitlab/ci/setup.yml

+setup-env:
+  stage: setup
+  interruptible: true
+  variables:
+    GIT_STRATEGY: "none"
+  rules:
+    - if: $CI_PIPELINE_SOURCE == 'merge_request_event' || $CI_COMMIT_REF_PROTECTED == 'true'
+  script:
+    - |
+      if [ -n "$CI_MERGE_REQUEST_SOURCE_BRANCH_NAME" ]; then
+        echo "BRANCH_NAME=$CI_MERGE_REQUEST_SOURCE_BRANCH_NAME" > build.env
+      else
+        echo "BRANCH_NAME=$CI_COMMIT_REF_NAME" > build.env
+      fi
+  artifacts:
+    reports:
+      dotenv:
+        - build.env
+
+create-bundle:
+  stage: setup
+  # TODO: Find a better suited image, this one just has git.
+  image: python
+  needs:
+    - job: setup-env
+      artifacts: true
+  rules:
+    - if: $CI_PIPELINE_SOURCE == 'merge_request_event' || $CI_COMMIT_REF_PROTECTED == 'true'
+  variables:
+    GIT_DEPTH: "1"
+  interruptible: true
+  script:
+    # DEBUG: Check repository status.
+    - git status
+    # DEBUG: Check branches in repository
+    - git branch
+    # Force switch to a named branch. We force it in case there is already
+    # a branch with the same name from previous runs.
+    - git switch -C $BRANCH_NAME
+    # Create a git bundle -- this will generate the app.bundle file,
+    # which can be used as a git remote for offline fetching.
+    - git bundle create app.bundle $BRANCH_NAME
+    # Retain the SHA of the base of this shallow repository.
+    - cat .git/shallow > shallow.txt
+    # DEBUG: Check sizes.
+    - du -sh .git
+    - du -sh app.bundle
+    # Since this is the only job we have access to the Gitlab remote,
+    # let's get a list of changed files to use in the next jobs.
+    - .gitlab/ci/scripts/helpers.py --get-changed-files > changedfiles.txt
+  artifacts:
+    paths:
+      - app.bundle
+      - shallow.txt
+      - changedfiles.txt
+    expire_in: 1 hour

.gitlab/issue_templates/Emergency Security Issue.md

+**NOTE** This is an issue template to standardise our process for responding to and fixing critical security and privacy vulnerabilities, exploits, etc.
+
+## Information
+
+### Related Issue
+- tor-browser#AAAAA
+- mullvad-browser#BBBBB
+- tor-browser-build#CCCCC
+
+#### Affected Platforms
+
+- [ ] Android
+- [ ] Desktop
+  - [ ] Windows
+  - [ ] macOS
+  - [ ] Linux
+
+### Type of Issue: What are we dealing with?
+
+- [ ] Security (sandbox escape, remote code execution, etc)
+- [ ] Proxy Bypass (traffic contents becoming MITM'able)
+- [ ] De-Anonymization (otherwise identifying which website a user is visiting)
+- [ ] Cross-Site Linkability (correlating sessions across circuits and websites)
+- [ ] Disk Leak (persisting session information to disk)
+- [ ] Other (please explain)
+
+### Involvement: Who needs to be consulted and or involved to fix this?
+
+- [ ] Applications Developers
+  - [ ] **boklm** : build, packaging, signing, release
+  - [ ] **clairehurst** : Android, macOS
+  - [ ] **dan** : Android, macOS
+  - [ ] **henry** : accessibility, frontend, localisation
+  - [ ] **ma1** : firefox internals
+  - [ ] **pierov** : updater, fonts, localisation, general
+  - [ ] **richard** : signing, release
+  - [ ] **thorin** : fingerprinting
+- [ ] Other Engineering Teams
+  - [ ] Networking (**ahf**, **dgoulet**)
+  - [ ] Anti-Censorship (**meskio**, **cohosh**)
+  - [ ] UX (**donuts**)
+  - [ ] TPA (**anarcat**, **lavamind**)
+- [ ] External Tor Partners
+  - [ ] Mozilla
+  - [ ] Mullvad
+  - [ ] Brave
+  - [ ] Guardian Project (Orbot, Onion Browser)
+  - [ ] Tails
+  - [ ] Other (please list)
+
+### Urgency: When do we need to act?
+
+- [ ] **ASAP** :rotating_light: Emergency release :rotating_light:
+- [ ] Next scheduled stable
+- [ ] Next scheduled alpha, then backport to stable
+- [ ] Next major release
+- [ ] Other (please explain)
+
+#### Justification
+
+<!-- Provide some paragraph here justifying the logic behind our estimated urgency -->
+
+### Side-Effects: Who will be affected by a fix for this?
+Sometimes fixes have side-effects: users lose their data, roadmaps need to be adjusted, services have to be upgraded, etc. Please enumerate the known downstream consequences a fix to this issue will likely incur.
+- [ ] End-Users (please list)
+- [ ] Internal Partners (please list)
+- [ ] External Partners (please list)
+
+## Todo:
+
+### Communications
+
+- [ ] Start an initial email thread with the following people:
+  - [ ] **bella**
+  - [ ] Relevant Applications Developers
+  - [ ] **(Optional)** **micah**
+    - if there are considerations or asks outside the Applications Team
+  - [ ] **(Optional)** Other Team Leads
+    - if there are considerations or asks outside the Applications Team
+  - [ ] **(Optional)** **gazebook**
+    - if there are consequences to the organisation or partners beyond a browser update, then a communication plan may be needed
+
+/cc @bella
+/cc @ma1
+/cc @micah
+/cc @richard
+
+/confidential
+
+Godspeed! :pray:

.gitlab/issue_templates/QA - Android.md

+Manual QA test check-list for major android releases. Please copy/paste form into your own comment, fill out relevant info and run through the checklist!
+<details>
+    <summary>Tor Browser Android QA Checklist</summary>
+```markdown
+# System Information
+
+- Version: Tor Browser XXX
+- OS: Android YYY
+- Device + CPU Architecture: ZZZ
+
+# Features
+
+## Base functionality
+- [ ] Tor Browser launches successfully
+- [ ] Connects to the Tor network
+- [ ] Localisation (Browser chrome)
+  - [ ] Check especially the recently added strings
+- [ ] Toolbars and menus work
+- [ ] Fingerprinting resistance: https://arkenfox.github.io/TZP/tzp.html
+- [ ] Security level (Standard, Safer, Safest)
+    - **TODO**: test pages verifying correct behaviour
+
+## Proxy safety
+- [ ] Tor exit test: https://check.torproject.org
+- [ ] Circuit isolation
+    - Following websites should all report different IP addresses
+    - https://ifconfig.io
+    - https://myip.wtf
+    - https://wtfismyip.com
+- [ ] DNS leaks: https://dnsleaktest.com
+
+## Connectivity + Anti-Censorship
+- [ ] Bridges:
+    - Bootstrap
+    - Browse: https://check.torproject.org
+    - [ ] Default bridges:
+        - [ ] obfs4
+        - [ ] meek
+        - [ ] snowflake
+    - [ ] User provided bridges:
+        - [ ] obfs4 from https://bridges.torproject.org
+        - [ ] webtunnel from https://bridges.torproject.org
+        - [ ] conjure from [gitlab](https://gitlab.torproject.org/tpo/anti-censorship/pluggable-transports/conjure/-/blob/main/client/torrc?ref_type=heads#L6)
+
+## Web Browsing
+- [ ] HTTPS-Only: http://http.badssl.com
+- [ ] .onion:
+    - [ ] torproject.org onion: http://2gzyxa5ihm7nsggfxnu52rck2vv4rvmdlkiu3zzui5du4xyclen53wid.onion/
+    - [ ] Onion service errors
+        - [ ] invalid onion: http://invalid.onion
+        - [ ] onion offline: http://wfdn32ds656ycma5gvrh7duvdvxbg2ygzr3no3ijsya25qm6nnko4iqd.onion/
+        - [ ] onion baddssl: https://gitlab.torproject.org/tpo/applications/team/-/wikis/Development-Information/BadSSL-But-Onion
+        - **TODO** all the identity block states
+        - **TODO** client auth
+- [ ] **TODO**: .securedrop.tor.onion
+- [ ] **TODO**: onion-service alt-svc
+- [ ] HTML5 Video: https://tekeye.uk/html/html5-video-test-page
+    - [ ] MPEG4
+    - [ ] WebM
+    - [ ] Ogg
+- [ ] WebSocket Test: https://websocketking.com/
+
+## External Components
+- [ ] NoScript
+  - [ ] Latest Version: https://addons.mozilla.org/en-US/firefox/addon/noscript/
+  - [ ] Not removable from about:addons
+  - [ ] Tests: https://test-data.tbb.torproject.org/test-data/noscript/
+    - **TODO**: fix test pages
+```
+
+</details>

.gitlab/issue_templates/QA - Desktop.md

+Manual QA test check-list for major desktop releases. Please copy/paste form into your own comment, fill out relevant info and run through the checklist!
+
+<details>
+    <summary>Tor Browser Desktop QA Checklist</summary>
+
+```markdown
+# System Information
+
+- Version: Tor Browser XXX
+- OS: Windows|macOS|Linux YYY
+- CPU Architecture:
+- Profile: New|Old
+
+# Features
+
+## Base functionality
+- [ ] Tor Browser launches successfully
+- [ ] Connects to the Tor network
+    - [ ] Homepage loads:
+        - [ ] about:tor
+        - [ ] about:blank
+        - [ ] custom
+- [ ] Tor Browser loads URLs passed by command-line after bootstrapped
+- [ ] Localisation (Browser chrome)
+  - [ ] Language notification/message bar
+  - [ ] Spoof English
+  - [ ] Check especially the recently added strings
+- [ ] UI Customisations:
+    - [ ] New Identity
+        - [ ] Toolbar icon
+        - [ ] Hamburger menu
+        - [ ] File menu
+    - [ ] New circuit for this site
+        - [ ] Circuit display
+        - [ ] Hamburger menu
+        - [ ] File menu
+    - [ ] No Firefox extras (Sync, Pocket, Report broken site, Tracking protection, etc)
+    - [ ] No unified extensions button (puzzle piece)
+    - [ ] NoScript button hidden
+    - [ ] Context Menu Populated
+- [ ] Fingerprinting resistance: https://arkenfox.github.io/TZP/tzp.html
+- [ ] Security level (Standard, Safer, Safest)
+    - Displays in:
+        - toolbar icon
+        - toolbar panel
+        - about:preferences#privacy
+    - [ ] On switch, each UI element is updated
+    - [ ] On custom config (toggle `svg.disabled`)
+        - [ ] each UI element displays warning
+        - [ ] `Restore defaults` reverts custom prefs
+    - **TODO**: test pages verifying correct behaviour
+- [ ] New identity
+- [ ] Betterboxing
+    - [ ] Reuse last window size
+    - [ ] Content alignment
+    - [ ] No letterboxing:
+        - [ ]empty tabs or privileged pages (eg: about:blank, about:about)
+        - [ ] full-screen video
+        - [ ] pdf viewer
+        - [ ] reader-mode
+- [ ] Downloads Warning
+    - [ ] Downloads toolbar panel
+    - [ ] about:downloads
+    - [ ] Library window (<kbd>Ctrl</kbd>+<kbd>Shift</kbd>+<kbd>o</kbd>)
+- [ ] Drag and Drop protections:
+    - [ ] Dragging a link from a tab to another tab in the same window works
+    - [ ] Dragging a link from a tab to another tab in a separate window works
+    - [ ] Dragging a link into the library creates a bookmark
+    - [ ] Dragging a link from Tor Browser to Firefox doesn't work
+    - [ ] Dragging a link from Firefox to Tor Browser works
+    - [ ] Dragging a link from Tor Browser to another app (e.g., text editor) doesn't work
+    - [ ] Repeat with page favicon
+
+## Proxy safety
+- [ ] Tor exit test: https://check.torproject.org
+- [ ] Circuit isolation
+    - Following websites should all report different IP addresses
+    - https://ifconfig.io
+    - https://myip.wtf
+    - https://wtfismyip.com
+- [ ] DNS leaks: https://dnsleaktest.com
+- [ ] Circuit Display
+    - [ ] Website => circuit
+    - [ ] Remote PDF => circuit
+    - [ ] Remote image => circuit
+    - [ ] .onion Website => circuit with onion-service relays
+    - [ ] .tor.onion Website => circuit with onion-service relays, link to true onion address
+        - http://ft.securedrop.tor.onion
+    - [ ] Website in reader mode => circuit (same as w/o reader mode)
+    - [ ] Local image => no circuit
+    - [ ] Local SVG with remote content => catch-all circuit, but not shown
+    - [ ] Local PDF => no circuit
+    - [ ] Local HTML `file://` with local resources  => no circuit
+    - [ ] Local HTML `file://` with remote resources => catch-all circuit, but not shown
+
+## Connectivity + Anti-Censorship
+- [ ] Tor daemon config by environment variables
+    - https://gitlab.torproject.org/tpo/applications/team/-/wikis/Environment-variables-and-related-preferences
+- [ ] Internet Test ( about:preferences#connection )
+  - [ ] Fails when offline
+  - [ ] Succeeds when online
+- [ ] Bridges:
+    - Bootstrap
+    - Browse: https://check.torproject.org
+    - Bridge node in circuit-display
+    - Bridge cards
+    - Disable
+    - Remove
+    - [ ] Default bridges:
+        - [ ] Removable as a group, not editable
+        - [ ] obfs4
+        - [ ] meek
+        - [ ] snowflake
+    - [ ] User provided bridges:
+        - [ ] Removable and editable individually
+        - [ ] obfs4 from https://bridges.torproject.org
+        - [ ] webtunnel from https://bridges.torproject.org
+        - [ ] conjure from [gitlab](https://gitlab.torproject.org/tpo/anti-censorship/pluggable-transports/conjure/-/blob/main/client/torrc?ref_type=heads#L6)
+    - [ ] Request bridges...
+        - [ ] Removable as a group, but not editable
+        - [ ] Succeeds when bootstrapped
+        - [ ] Succeeds when not bootstrapped
+    - **TODO**: Lox
+- [ ] Connect Assist
+    - Useful pref: `torbrowser.debug.censorship_level`
+    - [ ] Auto-bootstrap updates Tor connection settings on success
+    - [ ] Auto-bootstrap restore previous Tor connection settings on failure
+
+## Web Browsing
+- [ ] HTTPS-Only: http://http.badssl.com
+- [ ] Crypto-currency warning on http website
+    - **TODO**: we should provide an example page
+- [ ] .onion:
+    - [ ] torproject.org onion: http://2gzyxa5ihm7nsggfxnu52rck2vv4rvmdlkiu3zzui5du4xyclen53wid.onion/
+    - [ ] Onion-Location pill
+    - [ ] Client authentication
+        - You can create an ephemeral client-auth onion-service using [onion share](https://onionshare.org)
+    - [ ] Onion service errors
+        - [ ] invalid onion: http://invalid.onion
+        - [ ] onion offline: http://wfdn32ds656ycma5gvrh7duvdvxbg2ygzr3no3ijsya25qm6nnko4iqd.onion/
+        - [ ] onion baddssl: https://gitlab.torproject.org/tpo/applications/team/-/wikis/Development-Information/BadSSL-But-Onion
+        - **TODO** all the identity block states
+        - **TODO** client auth
+- [ ] **TODO**: .securedrop.tor.onion
+- [ ] **TODO**: onion-service alt-svc
+- [ ] HTML5 Video: https://tekeye.uk/html/html5-video-test-page
+    - [ ] MPEG4
+    - [ ] WebM
+    - [ ] Ogg
+- [ ] WebSocket Test: https://websocketking.com/
+
+## External Components
+- [ ] NoScript
+  - [ ] Latest Version: https://addons.mozilla.org/en-US/firefox/addon/noscript/
+  - [ ] Not removable from about:addons
+  - [ ] Tests: https://test-data.tbb.torproject.org/test-data/noscript/
+    - **TODO**: fix test pages
+```
+
+</details>

.gitlab/issue_templates/bug.md

+<!--
+* Use this issue template for reporting a new bug.
+-->
+
+### Summary
+**Summarize the bug encountered concisely.**
+
+
+### Steps to reproduce:
+**How one can reproduce the issue - this is very important.**
+
+1. Step 1
+2. Step 2
+3. ...
+
+### What is the current bug behavior?
+**What actually happens.**
+
+
+### What is the expected behavior?
+**What you want to see instead**
+
+
+
+### Environment
+**Which operating system are you using? For example: Debian GNU/Linux 10.1, Windows 10, Ubuntu Xenial, FreeBSD 12.2, etc.**
+**Which installation method did you use? Distribution package (apt, pkg, homebrew), from source tarball, from Git, etc.**
+
+### Relevant logs and/or screenshots
+
+
+/label ~bug

.gitlab/merge_request_templates/default.md

+## Merge Info
+
+<!-- Bookkeeping information for release management -->
+
+### Related Issues
+- tor-browser#xxxxx
+- mullvad-browser#xxxxx
+- tor-browser-build#xxxxx
+
+### Backporting
+
+#### Timeline
+- [ ] **Immediate**: patchset needed as soon as possible
+- [ ] **Next Minor Stable Release**: patchset that needs to be verified in nightly before backport
+- [ ] **Eventually**: patchset that needs to be verified in alpha before backport
+- [ ] **No Backport (preferred)**: patchset for the next major stable
+
+#### (Optional) Justification
+- [ ] **Emergency security update**: patchset fixes CVEs, 0-days, etc
+- [ ] **Censorship event**: patchset enables censorship circumvention
+- [ ] **Critical bug-fix**: patchset fixes a bug in core-functionality
+- [ ] **Consistency**: patchset which would make development easier if it were in both the alpha and release branches; developer tools, build system changes, etc
+- [ ] **Sponsor required**: patchset required for sponsor
+- [ ] **Localization**: typos and other localization changes that should be also in the release branch
+- [ ] **Other**: please explain
+
+### Merging
+- [ ] Merge to `tor-browser` - `!fixups` to `tor-browser`-specific commits, new features, security backports
+- [ ] Merge to `base-browser` - `!fixups` to `base-browser`-specific commits, new features to be shared with `mullvad-browser`, and security backports
+  - **NOTE**: if your changeset includes patches to both `base-browser` and `tor-browser` please clearly label in the change description which commits should be cherry-picked to `base-browser` after merging
+
+### Issue Tracking
+- [ ] Link resolved issues with appropriate [Release Prep issue](https://gitlab.torproject.org/groups/tpo/applications/-/issues/?sort=updated_desc&state=opened&label_name%5B%5D=Release%20Prep&first_page_size=20) for changelog generation
+
+### Review
+
+#### Request Reviewer
+
+- [ ] Request review from an applications developer depending on modified system:
+  - **NOTE**: if the MR modifies multiple areas, please `/cc` all the relevant reviewers (since gitlab only allows 1 reviewer)
+  - **accessibility** : henry
+  - **android** : clairehurst, dan
+  - **build system** : boklm
+  - **extensions** : ma1
+  - **firefox internals (XUL/JS/XPCOM)** : jwilde, ma1
+  - **fonts** : pierov
+  - **frontend (implementation)** : henry
+  - **frontend (review)** : donuts, richard
+  - **localization** : henry, pierov
+  - **macOS** : clairehurst, dan
+  - **nightly builds** : boklm
+  - **rebases/release-prep** : dan, ma1, pierov, richard
+  - **security** : jwilde, ma1
+  - **signing** : boklm, richard
+  - **updater** : pierov
+  - **windows** : jwilde, richard
+  - **misc/other** : pierov, richard
+
+#### Change Description
+
+<!-- Whatever context the reviewer needs to effectively review the patchset; if the patch includes UX updates be sure to include screenshots/video of how any new behaviour -->
+
+#### How Tested
+
+<!-- Description of steps taken to verify the change -->

.prettierignore

@@ -1528,3 +1528,5 @@ tools/browsertime/package-lock.json
 tools/ts/error_list.json
 try_task_config.json
 xpcom/idl-parser/xpidl/fixtures/xpctest.d.json
+
+browser/app/profile/001-base-profile.js

browser/actors/RFPHelperChild.sys.mjs

-/* -*- indent-tabs-mode: nil; js-indent-level: 2 -*- */
-/* This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
-
-import { XPCOMUtils } from "resource://gre/modules/XPCOMUtils.sys.mjs";
-
-const kPrefLetterboxing = "privacy.resistFingerprinting.letterboxing";
-
-const lazy = {};
-
-XPCOMUtils.defineLazyPreferenceGetter(
-  lazy,
-  "isLetterboxingEnabled",
-  kPrefLetterboxing,
-  false
-);
-
-export class RFPHelperChild extends JSWindowActorChild {
-  handleEvent(event) {
-    if (lazy.isLetterboxingEnabled && event.type == "resize") {
-      this.sendAsyncMessage("Letterboxing:ContentSizeUpdated");
-    }
-  }
-}

browser/actors/RFPHelperParent.sys.mjs

-1; /* -*- indent-tabs-mode: nil; js-indent-level: 2 -*- */
-/* This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
-
-import { XPCOMUtils } from "resource://gre/modules/XPCOMUtils.sys.mjs";
-
-const lazy = {};
-ChromeUtils.defineESModuleGetters(lazy, {
-  RFPHelper: "resource://gre/modules/RFPHelper.sys.mjs",
-});
-
-const kPrefLetterboxing = "privacy.resistFingerprinting.letterboxing";
-
-XPCOMUtils.defineLazyPreferenceGetter(
-  lazy,
-  "isLetterboxingEnabled",
-  kPrefLetterboxing,
-  false
-);
-
-export class RFPHelperParent extends JSWindowActorParent {
-  receiveMessage(aMessage) {
-    if (
-      lazy.isLetterboxingEnabled &&
-      aMessage.name == "Letterboxing:ContentSizeUpdated"
-    ) {
-      let browser = this.browsingContext.top.embedderElement;
-      let window = browser.ownerGlobal;
-      lazy.RFPHelper.contentSizeUpdated(window);
-    }
-  }
-}

browser/actors/moz.build

@@ -75,8 +75,6 @@ FINAL_TARGET_FILES.actors += [
     "PromptParent.sys.mjs",
     "RefreshBlockerChild.sys.mjs",
     "RefreshBlockerParent.sys.mjs",
-    "RFPHelperChild.sys.mjs",
-    "RFPHelperParent.sys.mjs",
     "ScreenshotsComponentChild.sys.mjs",
     "SearchSERPTelemetryChild.sys.mjs",
     "SearchSERPTelemetryParent.sys.mjs",

browser/app/Makefile.in

@@ -100,9 +100,11 @@ tools repackage:: $(DIST)/bin/$(MOZ_APP_NAME) $(objdir)/macbuild/Contents/MacOS-
 	rsync -aL $(DIST)/bin/$(MOZ_APP_NAME) '$(dist_dest)/Contents/MacOS'
 	cp -RL $(topsrcdir)/$(MOZ_BRANDING_DIRECTORY)/firefox.icns '$(dist_dest)/Contents/Resources/firefox.icns'
 	cp -RL $(topsrcdir)/$(MOZ_BRANDING_DIRECTORY)/document.icns '$(dist_dest)/Contents/Resources/document.icns'
+ifndef BASE_BROWSER_UPDATE
 	$(MKDIR) -p '$(dist_dest)/Contents/Library/LaunchServices'
 ifdef MOZ_UPDATER
 	cp -f '$(dist_dest)/Contents/MacOS/updater.app/Contents/MacOS/org.mozilla.updater' '$(dist_dest)/Contents/Library/LaunchServices'
+endif
 endif
 	$(MKDIR) -p '$(dist_dest)/Contents/Frameworks'
 	mv '$(dist_dest)/Contents/Resources/ChannelPrefs.framework' '$(dist_dest)/Contents/Frameworks'

browser/app/macbuild/Contents/MacOS-files.in

@@ -17,7 +17,6 @@
 /minidump-analyzer
 #endif
 /nmhproxy
-/pingsender
 /pk12util
 /ssltunnel
 /xpcshell

browser/app/moz.build

@@ -76,7 +76,8 @@ if CONFIG["CC_TYPE"] == "clang-cl":
 if CONFIG["OS_ARCH"] == "WINNT":
     RCINCLUDE = "splash.rc"
     DIRS += [
-        "pbproxy",
+        # tor-browser#41798 don't build private_browsing.exe on Windows
+        # "pbproxy",
         "winlauncher",
     ]
     USE_LIBS += [

browser/app/permissions

@@ -6,20 +6,3 @@
 # * permission is an integer between 1 and 15
 # Permissions defined here will also be set for private browsing.
 # See PermissionManager.cpp for more...
-
-# UITour
-# Bug 1557153: www.mozilla.org gets a special workaround in UITourChild.sys.mjs
-# Bug 1837407: support.mozilla.org gets a special workaround for similar reasons.
-origin	uitour	1	https://www.mozilla.org
-origin	uitour	1	https://support.mozilla.org
-origin	uitour	1	about:home
-origin	uitour	1	about:newtab
-
-# XPInstall
-origin	install	1	https://addons.mozilla.org
-
-# Remote troubleshooting
-origin	remote-troubleshooting	1	https://support.mozilla.org
-
-# autoplay video/audio
-origin	autoplay-media	1	about:welcome