Prepare Tor Browser Stable 14.0

Explanation of variables

$(BUILD_SERVER) : the server the main builder is using to build a tor-browser release
$(BUILDER) : whomever is building the release on the $(BUILD_SERVER)
- example : pierov
$(STAGING_SERVER) : the server the signer is using to to run the signing process
$(ESR_VERSION) : the Mozilla defined ESR version, used in various places for building tor-browser tags, labels, etc
- example : 91.6.0
$(TOR_BROWSER_MAJOR) : the Tor Browser major version
- example : 11
$(TOR_BROWSER_MINOR) : the Tor Browser minor version
- example : either 0 or 5; Alpha's is always (Stable + 5) % 10
$(TOR_BROWSER_VERSION) : the Tor Browser version in the format
- example : 12.5a3, 12.0.3
$(BUILD_N) : a project's build revision within a its branch; this is separate from the $(TOR_BROWSER_BUILD_N) value; many of the Firefox-related projects have a $(BUILD_N) suffix and may differ between projects even when they contribute to the same build.
- example : build1
$(TOR_BROWSER_BUILD_N) : the tor-browser build revision for a given Tor Browser release; used in tagging git commits
- example : build2
- NOTE : A project's $(BUILD_N) and $(TOR_BROWSER_BUILD_N) may be the same, but it is possible for them to diverge. For example :
  - if we have multiple Tor Browser releases on a given ESR branch the two will become out of sync as the $(BUILD_N) value will increase, while the $(TOR_BROWSER_BUILD_N) value may stay at build1 (but the $(TOR_BROWSER_VERSION) will increase)
  - if we have build failures unrelated to tor-browser, the $(TOR_BROWSER_BUILD_N) value will increase while the $(BUILD_N) will stay the same.
$(TOR_BROWSER_VERSION) : the published Tor Browser version
- example : 11.5a6, 11.0.7
$(TBB_BUILD_TAG) : the tor-browser-build build tag used to build a given Tor Browser version
- example : tbb-12.0.7-build1

NOTE It is assumed that the tor-browser stable rebase and security backport tasks have been completed NOTE This can/is often done in conjunction with the equivalent Mullvad Browser release prep issue

Building

tor-browser-build: https://gitlab.torproject.org/tpo/applications/tor-browser-build.git

Tor Browser Stable lives in the various maint-$(TOR_BROWSER_MAJOR).$(TOR_BROWSER_MINOR) (and possibly more specific) branches.

Communications

notify stakeholders

(Once builds confirmed matching) Email tor-qa mailing list with release information

tor-qa: tor-qa@lists.torproject.org

Subject

Tor Browser $(TOR_BROWSER_VERION) (Android, Windows, macOS, Linux)

Body

Hello,

Unsigned Tor Browser $(TOR_BROWSER_VERSION) release candidate builds are now available for testing:

- https://tb-build-02.torproject.org/~$(BUILDER)/builds/torbrowser/release/unsigned/$(TOR_BROWSER_VERSION)/

The full changelog can be found here:

- https://gitlab.torproject.org/tpo/applications/tor-browser-build/-/raw/$(TBB_BUILD_TAG)/projects/browser/Bundle-Data/Docs-TBB/ChangeLog.txt

Email packagers:
- Tails dev mailing list: tails-dev@boum.org
- Guardian Project: nathan@guardianproject.info
- FreeBSD port: freebsd@sysctl.cz
- OpenBSD port: caspar@schutijser.com
- Note any changes which may affect packaging/downstream integration

Signing

release signing

Signature verification

Check whether the .exe files got properly signed and timestamped

# Point OSSLSIGNCODE to your osslsigncode binary
pushd tor-browser-build/${channel}/signed/$TORBROWSER_VERSION
OSSLSIGNCODE=/path/to/osslsigncode
../../../tools/authenticode_check.sh
popd

Check whether the MAR files got properly signed

# Point NSSDB to your nssdb containing the mar signing certificate
# Point SIGNMAR to your signmar binary
# Point LD_LIBRARY_PATH to your mar-tools directory
pushd tor-browser-build/${channel}/signed/$TORBROWSER_VERSION
NSSDB=/path/to/nssdb
SIGNMAR=/path/to/mar-tools/signmar
LD_LIBRARY_PATH=/path/to/mar-tools/
../../../tools/marsigning_check.sh
popd

Publishing

Google Play: https://play.google.com/apps/publish

Publish APKs to Google Play:
- Select Tor Browser app
- Navigate to Release > Production and click Create new release button:
  - Upload the tor-browser-android-*.apk APKs
  - Update Release Name to Tor Browser version number
  - Update Release Notes
  - Next to 'Release notes', click Copy from a previous release
  - Edit blog post url to point to most recent blog post
- Save, review, and configure rollout percentage
  - 25% rollout when publishing a scheduled update
  - 100% rollout when publishing a security-driven release
- Update rollout percentage to 100% after confirmed no major issues

website: https://gitlab.torproject.org/tpo/web/tpo.git

databags/versions.ini : Update the downloads versions
- torbrowser-stable/version : sort of a catch-all for latest stable version
- torbrowser-alpha/version : sort of a catch-all for latest stable version
- torbrowser-*-stable/version : platform-specific stable versions
- torbrowser-*-alpha/version : platform-specific alpha versions
- tor-stable,tor-alpha : set by tor devs, do not touch
Push to origin as new branch, open 'Draft :' MR
Remove Draft: from MR once signed-packages are accessible on https://dist.torproject.org
Merge
Publish after CI passes and builds are published

blog: https://gitlab.torproject.org/tpo/web/blog.git

Run tools/signing/create-blog-post which should create the new blog post from a template (edit set-config.blog to set you local blog directory)
- Note any ESR update
- Note any updates to dependencies (OpenSSL, zlib, NoScript, tor, etc)
- Thank any users which have contributed patches
Push to origin as new branch, open Draft: MR
Merge once signed-packages are accessible on https://dist.torproject.org
Publish after CI passes and website has been updated

tor-announce mailing list

Email tor-announce mailing list: tor-announce@lists.torproject.org

Subject

New Release: Tor Browser $(TOR_BROWSER_VERSION) (Android, Windows, macOS, Linux)

Body

Hi everyone,

Tor Browser $(TOR_BROWSER_VERSION) has now been published for all platforms. For details please see our blog post:
- $(BLOG_POST_URL)

Changelog:
# paste changleog as quote here

Edited Oct 22, 2024 by morgan

To upload designs, you'll need to enable LFS and have an admin enable hashed storage. More information