Prepare Tor Browser Alpha 12.5a5
Explanation of variables
- 
$(BUILD_SERVER): the server the main builder is using to build a tor-browser release - 
$(STAGING_SERVER): the server the signer is using to to run the signing process - 
$(ESR_VERSION): the Mozilla defined ESR version, used in various places for building tor-browser tags, labels, etc- example : 
91.6.0 
 - example : 
 - 
$(TOR_BROWSER_MAJOR): the Tor Browser major version- example : 
11 
 - example : 
 - 
$(TOR_BROWSER_MINOR): the Tor Browser minor version- example : either 
0or5; Alpha's is always(Stable + 5) % 10 
 - example : either 
 - 
$(BUILD_N): a project's build revision within a its branch; this is separate from the$(TOR_BROWSER_BUILD_N)value; many of the Firefox-related projects have a$(BUILD_N)suffix and may differ between projects even when they contribute to the same build.- example : 
build1 
 - example : 
 - 
$(TOR_BROWSER_BUILD_N): the tor-browser build revision for a given Tor Browser release; used in tagging git commits- example : 
build2 - 
NOTE : A project's 
$(BUILD_N)and$(TOR_BROWSER_BUILD_N)may be the same, but it is possible for them to diverge. For example :- if we have multiple Tor Browser releases on a given ESR branch the two will become out of sync as the 
$(BUILD_N)value will increase, while the$(TOR_BROWSER_BUILD_N)value may stay atbuild1(but the$(TOR_BROWSER_VERSION)will increase) - if we have build failures unrelated to 
tor-browser, the$(TOR_BROWSER_BUILD_N)value will increase while the$(BUILD_N)will stay the same. 
 - if we have multiple Tor Browser releases on a given ESR branch the two will become out of sync as the 
 
 - example : 
 - 
$(TOR_BROWSER_VERSION): the published Tor Browser version- example : 
11.5a6,11.0.7 
 - example : 
 
NOTE It is assumed that the tor-browser rebase and security backport tasks have been completed
Build Updates
tor-browser-build: https://gitlab.torproject.org/tpo/applications/tor-browser-build.git
Tor Browser Alpha (and Nightly) are on the main branch
- 
Update rbm.conf- 
var/torbrowser_version: update to next version - 
var/torbrowser_build: update to$(TOR_BROWSER_BUILD_N) - 
***(Desktop Only)*** var/torbrowser_incremental_from: update to previous Desktop version- 
IMPORTANT: Really actually make sure this is the previous Desktop version or else the 
make torbrowser-incrementals-*step will fail 
 - 
IMPORTANT: Really actually make sure this is the previous Desktop version or else the 
 
 - 
 - 
Update Desktop-specific build configs - 
Update projects/firefox/config- 
browser_build: update to matchtor-browsertag - 
(Optional) var/firefox_platform_version: update to latest$(ESR_VERSION)if rebased 
 - 
 - 
Update projects/translation/config:- 
run make list_translation_updates-alphato get updated hashes - 
steps/base-browser/git_hash: update withHEADcommit of project'sbase-browserbranch - 
steps/base-browser-fluent/git_hash: update withHEADcommit of project'sbasebrowser-newidentityftlbranch - 
steps/tor-browser/git_hash: update withHEADcommit of project'stor-browserbranch - 
steps/fenix/git_hash: update withHEADcommit of project'sfenix-torbrowserstringsxmlbranch 
 - 
 
 - 
 - 
Update Android-specific build configs - 
(Optional) Update projects/geckoview/config- 
browser_build: update to matchtor-browsertag - 
(Optional) var/geckoview_version: update to latest$(ESR_VERSION)if rebased 
 - 
 - 
(Optional) Update projects/tor-android-service/config- 
git_hash: update withHEADcommit of project'smainbranch 
 - 
 - 
(Optional) Update projects/application-services/config: NOTE we don't currently have any of our own patches for this project- 
git_hash: update to appropriate git commit associated with$(ESR_VERSION) 
 - 
 - 
(Optional) Update projects/android-components/config:- 
android_components_build: update to match alpha android-components tag 
 - 
 - 
(Optional) Update projects/fenix/config- 
fenix_build: update to match fenix tag - 
(Optional) var/fenix_version: update to latest$(ESR_VERSION)if rebased 
 - 
 - 
Update allowed_addons.json by running (from tor-browser-buildroot):./tools/fetch_allowed_addons.py > projects/browser/allowed_addons.json
 
 - 
 - 
Update common build configs - 
Check for NoScript updates here : https://addons.mozilla.org/en-US/firefox/addon/noscript - 
(Optional) If new version available, update noscriptsection ofinput_filesinprojects/browser/config- 
URL - 
sha256sum 
 - 
 
 - 
 - 
Check for OpenSSL updates here : https://www.openssl.org/source/ - 
(Optional) If new 1.X.Y version available, update projects/openssl/config- 
version: update to next 1.X.Y version - 
input_files/sha256sum: update to sha256 sum of source tarball 
 - 
 
 - 
 - 
Check for zlib updates here: https://github.com/madler/zlib/releases - 
(Optional) If new tag available, update projects/zlib/config- 
version: update to next release tag 
 - 
 
 - 
 - 
Check for tor updates here : https://gitlab.torproject.org/tpo/core/tor/-/tags - 
(Optional) Update projects/tor/config- 
version: update to latest-alphatag or release tag if newer (ping dgoulet or ahf if unsure) 
 - 
 
 - 
 - 
Check for go updates here : https://golang.org/dl - NOTE : Tor Browser Alpha uses the latest Stable major series go version
 - 
(Optional) Update projects/go/config- 
version: update go version - 
input_files/sha256sumforgo: update sha256sum of archive (sha256 sums are displayed on the go download page) 
 - 
 
 - 
Update the manual : https://gitlab.torproject.org/tpo/web/manual/-/jobs/ - 
Download the artifacts.zipfile from latest build stage row (download icon button on the right) - 
Rename it to manual_$PIPELINEID.zip - 
Upload it to people.tpo  - 
Update projects/manual/config- 
Change the version to $PIPELINEID - 
Update the hash in the input_files section  - 
Update the URL if you have uploaded to a different people.tpo home  
 - 
 
 - 
 
 - 
 - 
Update ChangeLog.txt- 
Ensure ChangeLog.txt is sync'd between alpha and stable branches  - 
Check the linked issues: ask people to check if any are missing, remove the not fixed ones  - 
Run tools/fetch-changelogs.py $(TOR_BROWSER_VERSION)ortools/fetch-changelogs.py '#$(ISSUE_NUMBER)'- Make sure you have 
requestsinstalled (e.g.,apt install python3-requests) - The first time you run this script you will need to generate an access token; the script will guide you
 
 - Make sure you have 
 - 
Copy the output of the script to the beginning of ChangeLog.txtand adjust its output- If you used the issue number, you will need to write the Tor Browser version manually
 
 - 
Include any version updates for: - 
translations  - 
OpenSSL  - 
NoScript  - 
Go  - 
zlib  
 - 
 - 
Include any ESR rebase for Firefox and GeckoView  
 - 
 - 
Open MR with above changes  - 
Begin build on $(BUILD_SERVER)(fix any issues which come up and update MR) - 
Merge  - 
Sign/Tag commit: make torbrowser-signtag-alpha - 
Push tag to origin 
Communications
notify stakeholders
email template
  Hello All,
  Unsigned Tor Browser $(TOR_BROWSER_VERSION) alpha candidate builds are now available for testing:
  - https://tb-build-05.torproject.org/~$(BUILDER)/builds/release/unsigned/$(TOR_BROWSER_VERSION)/
  The full changelog can be found here:
  - https://gitlab.torproject.org/tpo/applications/tor-browser-build/-/raw/main/projects/browser/Bundle-Data/Docs/ChangeLog.txt
- 
Email tor-qa mailing list: tor-qa@lists.torproject.org - Additional information:
- 
Note any new functionality which needs testing  - 
Link to any known issues  
 - 
 
 - Additional information:
 - 
(Optional, only around build/packaging changes) Email downstream consumers: - Recipients:
- Tails dev mailing list: tails-dev@boum.org
 - Guardian Project: nathan@guardianproject.info
 - torbrowser-launcher: micah@micahflee.com
 - FreeBSD port: freebsd@sysctl.cz
 - OpenBSD port: caspar@schutijser.com
 
 - 
Note any changes which may affect packaging/downstream integration  
 - Recipients:
 - 
Email upstream stakeholders: - 
(Optional, after ESR migration) Cloudflare: ask-research@cloudflare.com
- NOTE : We need to provide them with updated user agent string so they can update their internal machinery to prevent Tor Browser users from getting so many CAPTCHAs
 
 
 - 
(Optional, after ESR migration) Cloudflare: ask-research@cloudflare.com
 
Signing
signing + publishing
- 
Ensure builders have matching builds  - 
On $(STAGING_SERVER), ensure updated:- 
tor-browser-build/tools/signing/set-config- 
NSS_DB_DIR: location of thenssdb7directory 
 - 
 - 
tor-browser-build/tools/signing/set-config.hosts- 
ssh_host_builder: ssh hostname of machine with unsigned builds- 
NOTE : 
tor-browser-buildis expected to be in the$HOMEdirectory) 
 - 
NOTE : 
 - 
ssh_host_linux_signer: ssh hostname of linux signing machine - 
ssh_host_macos_signer: ssh hostname of macOS signing machine 
 - 
 - 
tor-browser-build/tools/signing/set-config.macos-notarization- 
macos_notarization_user: the email login for a tor notariser Apple Developer account 
 - 
 - 
set-config.update-responses- 
update_responses_repository_dir: directory where you clonedgit@gitlab.torproject.org:tpo/applications/tor-browser-update-responses.git 
 - 
 - 
tor-browser-build/tools/signing/set-config.tbb-version- 
tbb_version: tor browser version string, same asvar/torbrowser_versioninrbm.conf(examples:11.5a12,11.0.13) - 
tbb_version_build: the tor-browser-build build number (ifvar/torbrowser_buildinrbm.confisbuildNthen this value isN) - 
tbb_version_type: eitheralphafor alpha releases orreleasefor stable releases 
 - 
 
 - 
 - 
On $(STAGING_SERVER)in a separatescreensession, run the macOS proxy script:cd tor-browser-build/tools/signing/./macos-signer-proxy
 - 
On $(STAGING_SERVER)in a separatescreensession, ensure tor daemon is running with SOCKS5 proxy on the default port 9050 - 
apk signing : copy signed *multi.apkfiles to the unsigned build outputs directory - 
run do-all-signing script: cd tor-browser-build/tools/signing/./do-all-signing.torbrowser
 - 
NOTE: at this point the signed binaries should have been copied to 
staticiforme - 
Update staticiforme.torproject.org:- From 
screensession onstaticiforme.torproject.org: - 
Static update components : static-update-component cdn.torproject.org && static-update-component dist.torproject.org - 
Enable update responses : sudo -u tb-release ./deploy_update_responses-alpha.sh - 
Remove old release data from following places: - NOTE : Skip this step if the current release is Android or Desktop only
 - 
/srv/cdn-master.torproject.org/htdocs/aus1/torbrowser - 
/srv/dist-master.torproject.org/htdocs/torbrowser 
 - 
Static update components (again) : `static-update-component cdn.torproject.org && static-update-component  
 - From 
 - 
Publish APKs to Google Play: - Log into https://play.google.com/apps/publish
 - Select 
Tor Browser (Alpha)app - Navigate to 
Release > Productionand clickCreate new releasebutton:- Upload the 
*.multi.apkAPKs - Update Release Name to Tor Browser version number
 - Update Release Notes
 - Next to 'Release notes', click 
Copy from a previous release - Edit blog post url to point to most recent blog post
 
 - Upload the 
 - Save, review, and configure rollout percentage
- 
25% rollout when publishing a scheduled update  - 
100% rollout when publishing a security-driven release  
 - 
 - 
Update rollout percentage to 100% after confirmed no major issues  
 
Publishing
website: https://gitlab.torproject.org/tpo/web/tpo.git
- 
databags/versions.ini: Update the downloads versions- 
torbrowser-stable/version: sort of a catch-all for latest stable version - 
torbrowser-alpha/version: sort of a catch-all for latest stable version - 
torbrowser-*-stable/version: platform-specific stable versions - 
torbrowser-*-alpha/version: platform-specific alpha versions - 
tor-stable,tor-alpha: set by tor devs, do not touch 
 - 
 - 
Push to origin as new branch, open 'Draft :' MR  - 
Remove Draft:from MR once signed-packages are uploaded - 
Merge  - 
Publish after CI passes and builds are published  
blog: https://gitlab.torproject.org/tpo/web/blog.git
- 
Duplicate previous Stable or Alpha release blog post as appropriate to new directory under content/blog/new-release-tor-browser-$(TOR_BROWSER_VERSION)and update with info on release :- 
Update Tor Browser version numbers  - 
Note any ESR rebase  - 
Link to any Firefox security updates from ESR upgrade  - 
Link to any Android-specific security backports  - 
Note any updates to : - tor
 - OpenSSL
 - NoScript
 
 - 
Convert ChangeLog.txt to markdown format used here by : tor-browser-build/tools/changelog-format-blog-post
 
 - 
 - 
Push to origin as new branch, open Draft:MR - 
Remove Draft:from MR once signed-packages are uploaded - 
Merge  - 
Publish after CI passes and website has been updated  
tor-announce mailing list
- 
Send an email to tor-announce@lists.torproject.org, using the same content as the blog post and subject "Tor Browser $version is released".  
Edited  by morgan