Prepare stable release 11.0.12 (Android)

Explanation of variables

• $(TOR_LAUNCHER_VERSION) : version of tor-launcher, used in tags
  • example : 0.2.33
• $(ESR_VERSION) : the Mozilla defined ESR version, used in various places for building tor-browser tags, labels, etc
  • example : 91.6.0
• $(ESR_TAG) : the Mozilla defined hg (Mercurial) tag associated with $(ESR_VERSION)
  • exmaple : FIREFOX_91_7_0esr_BUILD2
• $(TOR_BROWSER_MAJOR) : the Tor Browser major version
  • example : 11
• $(TOR_BROWSER_MINOR) : the Tor Browser minor version
  • example : either 0 or 5; Alpha's is always (Stable + 5) % 10
• $(FIREFOX_BUILD_N) : the firefox build revision within a given tor-browser branch; this is separate from the $(TOR_BROWSER_BUILD_N) value
  • example : build1
• $(TOR_BROWSER_BUILD_N) : the tor-browser build revision for a given Tor Browser release; used in tagging git commits
  • example : build2
  • NOTE : $(FIREFOX_BUILD_N) and $(TOR_BROWSER_BUILD_N) typically are the same, but it is possible for them to diverge. For example :
    • if we have multiple Tor Browser releases on a given ESR branch the two will become out of sync as the $(FIREFOX_BUILD_N) value will increase, while the $(TOR_BROWSER_BUILD_N) value may stay at build1 (but the $(TOR_BROWSER_VERSION) will increase)
    • if we have build failures unrelated to tor-browser, the $(TOR_BROWSER_BUILD_N) value will increase while the $(FIREFOX_BUILD_N) will stay the same.
• $(TOR_BROWSER_VERSION) : the published Tor Browser version
  • example : 11.5a6, 11.0.7

fenix

• Sign/Tag commit: tor-browser-96.3.0-11.0-1-build2
• Push tag to GitLab

android-components

• Sign/Tag commit: android-components-96.0.15-11.0-1 (not updated from 11.0.8)
• Push tag to GitLab

geckoview

• Sign/Tag commit: geckoview-96.0.3-11.0-1-build2
• Push tag to Gitolite

tor-browser-build

• Update rbm.conf
  • var/torbrowser_version : update to next version
  • var/torbrowser_build : update to $(TOR_BROWSER_BUILD_N)
• (Android Only) Update allowed_addons.json by running (from tor-browser-build root)`./tools/fetch_allowed_addons.py > projects/tor-browser/allowed_addons.json
• Check for NoScript updates here : https://addons.mozilla.org/en-US/firefox/addon/noscript - no updates, stay on 11.4.5
• Check for openssl updates here : https://github.com/openssl/openssl/tags
  • update to 1.1.1o
• Check for tor updates here: https://gitlab.torproject.org/tpo/core/tor/-/tags
  • Stay on 0.4.6.10, as requested in #40479 (closed)
• Check for go updates here : https://golang.org/dl - already at 1.17.9
• Update ChangeLog.txt
• Open MR with above changes
• Sign/Tag commit : make signtag-(alpha|release)
• Push tag to origin

blog

• Duplicate previous Stable or Alpha release blog post as appropriate to new directory under content/blog/new-release-tor-browser-$(TOR_BROWSER_VERSION) and update with info on release :
  • Update Tor Browser version numbers
  • Note any ESR rebase
  • Link to any Firefox security updates
  • Note any updates to :
    • tor
    • openssl
    • go
    • noscript
  • Convert ChangeLog.txt to markdown format used here by : tor-browser-build/tools/changelog-format-blog-post
• Push to origin as new branch, open 'Draft :' MR
• Remove draft from MR once signed-packages are uploaded

website

• databags/versions.ini : Update the downloads versions
  • torbrowser-stable/version : sort of a catch-all for latest stable version
  • torbrowser-stable/win32 : tor version in the expert bundle
  • torbrowser-*-stable/version : platform-specific stable versions
  • torbrowser-*-alpha/version : platform-specific alpha versions
  • tor-stable,tor-alpha : set by tor devs, do not touch
  • Git commit commands:
    • For all platforms: git commit databags/versions.ini -m "Add new Tor Browser version ${VERSION}"
    • For only desktop platforms: git commit databags/versions.ini -m "Add new Tor Browser version ${VERSION} (desktop)"
    • For only Android platform: git commit databags/versions.ini -m "Add new Tor Browser version ${VERSION} (Android)"
• Push to origin as new branch, open 'Draft :' MR
• Remove draft from MR once signed-packages are uploaded

unsigned build uploads

• Upload unsigned builds to people.torproject.org
• Email tor-qa@lists.torproject.org with links to unsigned builds

signing (Android)

• Sign apks using alpha or release signing key
• Upload packages to signing machine
• Create OpenPGP detached signatures

signed build uploads

• Upload all build artifacts to web server
• Upload signed apks, shasums, and detached signature files to web server
• Synchronize all packages to web server mirrors