Prepare Tor Browser Stable 13.0

Explanation of variables

$(BUILD_SERVER) : the server the main builder is using to build a tor-browser release
$(BUILDER) : whomever is building the release on the $(BUILD_SERVER)
- example : pierov
$(STAGING_SERVER) : the server the signer is using to to run the signing process
$(ESR_VERSION) : the Mozilla defined ESR version, used in various places for building tor-browser tags, labels, etc
- example : 91.6.0
$(TOR_BROWSER_MAJOR) : the Tor Browser major version
- example : 11
$(TOR_BROWSER_MINOR) : the Tor Browser minor version
- example : either 0 or 5; Alpha's is always (Stable + 5) % 10
$(TOR_BROWSER_VERSION) : the Tor Browser version in the format
- example : 12.5a3, 12.0.3
$(BUILD_N) : a project's build revision within a its branch; this is separate from the $(TOR_BROWSER_BUILD_N) value; many of the Firefox-related projects have a $(BUILD_N) suffix and may differ between projects even when they contribute to the same build.
- example : build1
$(TOR_BROWSER_BUILD_N) : the tor-browser build revision for a given Tor Browser release; used in tagging git commits
- example : build2
- NOTE : A project's $(BUILD_N) and $(TOR_BROWSER_BUILD_N) may be the same, but it is possible for them to diverge. For example :
  - if we have multiple Tor Browser releases on a given ESR branch the two will become out of sync as the $(BUILD_N) value will increase, while the $(TOR_BROWSER_BUILD_N) value may stay at build1 (but the $(TOR_BROWSER_VERSION) will increase)
  - if we have build failures unrelated to tor-browser, the $(TOR_BROWSER_BUILD_N) value will increase while the $(BUILD_N) will stay the same.
$(TOR_BROWSER_VERSION) : the published Tor Browser version
- example : 11.5a6, 11.0.7
$(TBB_BUILD_TAG) : the tor-browser-build build tag used to build a given Tor Browser version
- example : tbb-12.5a7-build1

NOTE It is assumed that the tor-browser stable rebase and security backport tasks have been completed NOTE This can/is often done in conjunction with the equivalent Mullvad Browser release prep issue

Building

tor-browser-build: https://gitlab.torproject.org/tpo/applications/tor-browser-build.git

Tor Browser Alpha (and Nightly) are on the main branch

Communications

notify stakeholders

Email tor-qa mailing list: tor-qa@lists.torproject.org

email template

Subject:
Tor Browser $(TOR_BROWSER_VERION) (Android, Windows, macOS, Linux)

Body:
Hello All,

Unsigned Tor Browser $(TOR_BROWSER_VERSION) alpha candidate builds are now available for testing:

- https://tb-build-05.torproject.org/~$(BUILDER)/builds/alpha/unsigned/$(TOR_BROWSER_VERSION)/

The full changelog can be found here:

- https://gitlab.torproject.org/tpo/applications/tor-browser-build/-/raw/$(TBB_BUILD_TAG)/projects/browser/Bundle-Data/Docs-TBB/ChangeLog.txt

(Optional) Additional information:
- Note any new functionality which needs testing
- Link to any known issues

(Optional, only around build/packaging changes) Email packagers:
- Recipients:
  - Tails dev mailing list: tails-dev@boum.org
  - Guardian Project: nathan@guardianproject.info
  - torbrowser-launcher: micah@micahflee.com
  - FreeBSD port: freebsd@sysctl.cz
  - OpenBSD port: caspar@schutijser.com
- Note any changes which may affect packaging/downstream integration
Email external partners:
- (Optional, after ESR migration) Cloudflare: ask-research@cloudflare.com
  - NOTE : We need to provide them with updated user agent string so they can update their internal machinery to prevent Tor Browser users from getting so many CAPTCHAs

Signing

signing

Signature verification

Check whether the .exe files got properly signed and timestamped

# Point OSSLSIGNCODE to your osslsigncode binary
pushd tor-browser-build/${channel}/signed/$TORBROWSER_VERSION
OSSLSIGNCODE=/path/to/osslsigncode
../../../tools/authenticode_check.sh
popd

Check whether the MAR files got properly signed

# Point NSSDB to your nssdb containing the mar signing certificate
# Point SIGNMAR to your signmar binary
# Point LD_LIBRARY_PATH to your mar-tools directory
pushd tor-browser-build/${channel}/signed/$TORBROWSER_VERSION
NSSDB=/path/to/nssdb
SIGNMAR=/path/to/mar-tools/signmar
LD_LIBRARY_PATH=/path/to/mar-tools/
../../../tools/marsigning_check.sh
popd

Publishing

website: https://gitlab.torproject.org/tpo/web/tpo.git

databags/versions.ini : Update the downloads versions
- torbrowser-stable/version : sort of a catch-all for latest stable version
- torbrowser-alpha/version : sort of a catch-all for latest stable version
- torbrowser-*-stable/version : platform-specific stable versions
- torbrowser-*-alpha/version : platform-specific alpha versions
- tor-stable,tor-alpha : set by tor devs, do not touch
Push to origin as new branch, open 'Draft :' MR
Remove Draft: from MR once signed-packages are uploaded
Merge
Publish after CI passes and builds are published

blog: https://gitlab.torproject.org/tpo/web/blog.git

tor-announce mailing list

Email tor-announce mailing list: tor-announce@lists.torproject.org

email template

Subject:
New Release: Tor Browser $(TOR_BROWSER_VERSION) (Android, Windows, macOS, Linux)

Body:
Hi everyone,

Tor Browser $(TOR_BROWSER_VERSION) has now been published for all platforms. For details please see our blog post:

- $(BLOG_POST_URL)

(Optional) Additional information:
- Link to any known issues

Edited Oct 16, 2023 by morgan

To upload designs, you'll need to enable LFS and have an admin enable hashed storage. More information