Prepare Tor Browser Stable 12.5.3

Explanation of variables

$(BUILD_SERVER) : the server the main builder is using to build a tor-browser release
$(BUILDER) : whomever is building the release on the $(BUILD_SERVER)
- example : pierov
$(STAGING_SERVER) : the server the signer is using to to run the signing process
$(ESR_VERSION) : the Mozilla defined ESR version, used in various places for building tor-browser tags, labels, etc
- example : 91.6.0
$(TOR_BROWSER_MAJOR) : the Tor Browser major version
- example : 11
$(TOR_BROWSER_MINOR) : the Tor Browser minor version
- example : either 0 or 5; Alpha's is always (Stable + 5) % 10
$(TOR_BROWSER_VERSION) : the Tor Browser version in the format
- example : 12.5a3, 12.0.3
$(BUILD_N) : a project's build revision within a its branch; this is separate from the $(TOR_BROWSER_BUILD_N) value; many of the Firefox-related projects have a $(BUILD_N) suffix and may differ between projects even when they contribute to the same build.
- example : build1
$(TOR_BROWSER_BUILD_N) : the tor-browser build revision for a given Tor Browser release; used in tagging git commits
- example : build2
- NOTE : A project's $(BUILD_N) and $(TOR_BROWSER_BUILD_N) may be the same, but it is possible for them to diverge. For example :
  - if we have multiple Tor Browser releases on a given ESR branch the two will become out of sync as the $(BUILD_N) value will increase, while the $(TOR_BROWSER_BUILD_N) value may stay at build1 (but the $(TOR_BROWSER_VERSION) will increase)
  - if we have build failures unrelated to tor-browser, the $(TOR_BROWSER_BUILD_N) value will increase while the $(BUILD_N) will stay the same.
$(TOR_BROWSER_VERSION) : the published Tor Browser version
- example : 11.5a6, 11.0.7
$(TBB_BUILD_TAG) : the tor-browser-build build tag used to build a given Tor Browser version
- example : tbb-12.0.7-build1

NOTE It is assumed that the tor-browser stable rebase and security backport tasks have been completed

Building

tor-browser-build: https://gitlab.torproject.org/tpo/applications/tor-browser-build.git

Tor Browser Stable lives in the various maint-$(TOR_BROWSER_MAJOR).$(TOR_BROWSER_MINOR) (and possibly more specific) branches

Communications

notify stakeholders

email template

  Subject:
  Tor Browser $(TOR_BROWSER_VERION) (Android, Windows, macOS, Linux)

  Body:
  Hello All,

  Unsigned Tor Browser $(TOR_BROWSER_VERSION) release candidate builds are now available for testing:

  - https://tb-build-05.torproject.org/~$(BUILDER)/builds/release/unsigned/$(TOR_BROWSER_VERSION)/

  The full changelog can be found here:

  - https://gitlab.torproject.org/tpo/applications/tor-browser-build/-/blob/$(TBB_BUILD_TAG)/ChangeLog.txt

Email tor-qa mailing list: tor-qa@lists.torproject.org
- (Optional) Additional information:
  - Note any new functionality which needs testing
  - Link to any known issues
Email packagers:
- Recipients:
  - Tails dev mailing list: tails-dev@boum.org
  - Guardian Project: nathan@guardianproject.info
  - torbrowser-launcher: micah@micahflee.com
  - FreeBSD port: freebsd@sysctl.cz
  - OpenBSD port: caspar@schutijser.com
- (Optional) Note any changes which may affect packaging/downstream integration

Signing

signing

Signature verification

Check whether the .exe files got properly signed and timestamped

``` # Point OSSLSIGNCODE to your osslsigncode binary pushd tor-browser-build/{channel}/signed/TORBROWSER_VERSION OSSLSIGNCODE=/path/to/osslsigncode ../../../tools/authenticode_check.sh popd ```

Check whether the MAR files got properly signed

``` # Point NSSDB to your nssdb containing the mar signing certificate # Point SIGNMAR to your signmar binary # Point LD_LIBRARY_PATH to your mar-tools directory pushd tor-browser-build/{channel}/signed/TORBROWSER_VERSION NSSDB=/path/to/nssdb SIGNMAR=/path/to/mar-tools/signmar LD_LIBRARY_PATH=/path/to/mar-tools/ ../../../tools/marsigning_check.sh popd ```

Publishing

website: https://gitlab.torproject.org/tpo/web/tpo.git

databags/versions.ini : Update the downloads versions
- torbrowser-stable/version : sort of a catch-all for latest stable version
- torbrowser-alpha/version : sort of a catch-all for latest stable version
- torbrowser-*-stable/version : platform-specific stable versions
- torbrowser-*-alpha/version : platform-specific alpha versions
- tor-stable,tor-alpha : set by tor devs, do not touch
Push to origin as new branch, open 'Draft :' MR
Remove Draft: from MR once signed-packages are uploaded
Merge
Publish after CI passes and builds are published

blog: https://gitlab.torproject.org/tpo/web/blog.git

tor-announce mailing list

email template

  Subject:
  New Release: Tor Browser $(TOR_BROWSER_VERSION) (Android, Windows, macOS, Linux)

  Body:
  Hi everyone,

  Tor Browser $(TOR_BROWSER_VERSION) has now been published for all platforms. For details please see our blog post:

  - $(BLOG_POST_URL)

Email tor-announce mailing list: tor-announce@lists.torproject.org
- (Optional) Additional information:
  - Link to any known issues

Edited Aug 30, 2023 by morgan

To upload designs, you'll need to enable LFS and have an admin enable hashed storage. More information