MB 200: Changes for the system installer

Merge Info

Related Issues

• tor-browser#xxxxx
• #200 (closed)
• tor-browser-build#41077 (closed)

Backporting

Timeline

• Immediate: patchset needed as soon as possible
• Next Minor Stable Release: patchset that needs to be verified in nightly before backport
• Eventually: patchset that needs to be verified in alpha before backport
• No Backport (preferred): patchset for the next major stable

(Optional) Justification

• Emergency security update: patchset fixes CVEs, 0-days, etc
• Critical bug-fix: patchset fixes a bug in core-functionality
• Consistency: patchset which would make development easier if it were in both the alpha and release branches; developer tools, build system changes, etc
• Sponsor required: patchset required for sponsor
• Localization: typos and other localization changes that should be also in the release branch
• Other: please explain

Merging

• Merge to mullvad-browser - !fixups to mullvad-browser-specific commits, new features, security backports
• Merge to base-browser -!fixups to base-browser-specific commits, new features to be shared with tor-browser
  • NOTE: if your changeset includes patches to both base-browser and mullvad-browser please clearly label in the change description which commits should be cherry-picked to base-browser after merging

Issue Tracking

• Link resolved issues with appropriate Release Prep issue for changelog generation

Review

Request Reviewer

• Request review from an applications developer depending on modified system:
  • NOTE: if the MR modifies multiple areas, please /cc all the relevant reviewers (since gitlab only allows 1 reviewer)
  • accessibility : henry
  • android : clairehurst, dan
  • build system : boklm
  • extensions : ma1
  • firefox internals (XUL/JS/XPCOM) : ma1
  • fonts : pierov
  • frontend (implementation) : henry
  • frontend (review) : donuts, richard
  • localization : henry, pierov
  • macos : clairehurst, dan
  • nightly builds : boklm
  • rebases/release-prep : dan, ma1, pierov, richard
  • security : ma1
  • signing : boklm, richard
  • updater : pierov
  • misc/other : pierov, richard

Change Description

This MR does three four things:

1. re-enables calling a post-update executable (it does so also in Tor Browser! And it will fail, but it isn't a big deal, as the only bad consequence is writing on stderr! But we can also add a Tor Browser commit to re-disable it in case)
2. customize the path to the postupdate binary (I changed it to emphasize it isn't the same as Firefox)
3. expose whether the installation is portable or not to JS (not strictly needed for this, but it'll be probably needed for the default browser)
4. updates the update root directory when not running in portable mode (to avoid writing an UpdateInfo directory in %appData)

How Tested

For the postupdate:

1. built two nightlies with custom updater URL to check the updater
2. checked that the version in the control panel entry is updated after the update
3. checked that running postupdate.exe in a portable install doesn't update the registry
4. checked that running postupdate.exe can delete the tobedeleted directory (it doesn't always work because of Windows locks, but it works when you call postupdate.exe separately)

For the portable mode I ran this in the JS console and checked I got the expected output:

const xreDirProvider = Cc["@mozilla.org/xre/directory-provider;1"].getService(Ci.nsIXREDirProvider);
xreDirProvider.isPortableMode

For the update directory, you can get it with:

Services.dirsvc.get("UpdRootD", Ci.nsIFile).path

Link to the build: https://tb-build-03.torproject.org/~pierov/mullvadbrowser/nightly/tbb-nightly.2024.01.10/mullvad-browser-windows-x86_64-install-tbb-nightly.2024.01.10.exe

browser/components/resistfingerprinting/test/browser/browser_timezone.js

 /**
  * Bug 1330890 - A test case for verifying Date() object of javascript will use
- *               UTC timezone after fingerprinting resistance is enabled.
+ *               Atlantic/Reykjavik timezone (GMT and "real" equivalent to UTC)
+ *               after fingerprinting resistance is enabled.
  */
 
 async function verifySpoofed() {
@@ -16,13 +17,15 @@ async function verifySpoofed() {
   // Running in content:
   function test() {
     let date = new Date();
+    const TZ_NAME = "Atlantic/Reykjavik";
+    const TZ_SUFFIX = "(Greenwich Mean Time)";
     ok(
-      date.toString().endsWith("(Coordinated Universal Time)"),
-      "The date toString() is in UTC timezone."
+      date.toString().endsWith(TZ_SUFFIX),
+      `The date toString() is in ${TZ_NAME} timezone.`
     );
     ok(
-      date.toTimeString().endsWith("(Coordinated Universal Time)"),
-      "The date toTimeString() is in UTC timezone."
+      date.toTimeString().endsWith(TZ_SUFFIX),
+      `The date toTimeString() is in ${TZ_NAME} timezone.`
     );
     let dateTimeFormat = Intl.DateTimeFormat("en-US", {
       dateStyle: "full",
@@ -30,12 +33,12 @@ async function verifySpoofed() {
     });
     is(
       dateTimeFormat.resolvedOptions().timeZone,
-      "UTC",
-      "The Intl.DateTimeFormat is in UTC timezone."
+      TZ_NAME,
+      `The Intl.DateTimeFormat is in ${TZ_NAME} timezone.`
     );
     ok(
-      dateTimeFormat.format(date).endsWith("Coordinated Universal Time"),
-      "The Intl.DateTimeFormat is formatting with the UTC timezone."
+      dateTimeFormat.format(date).endsWith(TZ_SUFFIX),
+      `The Intl.DateTimeFormat is formatting with the ${TZ_NAME} timezone.`
     );
     is(
       date.getFullYear(),