Bug 41411: Rework how we include licenses for Tor, its dependencies and PTs

Merge Info

Issues

Resolves

• #41411
• tor-browser#xxxxx
• mullvad-browser#xxxxx

Related

• tor-browser-build#xxxxx
• tor-browser#xxxxx
• mullvad-browser#xxxxx

Merging

Target Branches

• main: esr128-14.5
• maint-14.0: esr128-14.0
• maint-13.5: esr115-13.5

Backporting

Timeline

• No Backport (preferred): patchset for the next major stable
• Immediate: patchset needed as soon as possible
• Next Minor Stable Release: patchset that needs to be verified in nightly before backport
• Eventually: patchset that needs to be verified in alpha before backport

(Optional) Justification

• Emergency security update: patchset fixes CVEs, 0-days, etc
• Censorship event: patchset enables censorship circumvention
• Critical bug-fix: patchset fixes a bug in core-functionality
• Consistency: patchset which would make development easier if it were in both the alpha and release branches; developer tools, build system changes, etc
• Sponsor required: patchset required for sponsor
• Other: please explain

Issue Tracking

• Link resolved issues with appropriate Release Prep issue for changelog generation

Uplifting

• Patchset is a candidate for uplift to upstream projects (e.g. mingw, clang, etc)

Review

Request Reviewer

• Request review from an applications developer depending on modified system:
  • NOTE: if the MR modifies multiple areas, please /cc all the relevant reviewers (since gitlab only allows 1 reviewer)
  • accessibility : henry
  • android : clairehurst, dan
  • build system : boklm
  • extensions : ma1
  • firefox internals (XUL/JS/XPCOM) : jwilde, ma1
  • fonts : pierov
  • frontend (implementation) : henry
  • frontend (review) : donuts, morgan
  • localization : henry, pierov
  • macOS : clairehurst, dan
  • nightly builds : boklm
  • rebases/release-prep : boklm, dan, ma1, morgan, pierov
  • security : jwilde, ma1
  • signing : boklm, morgan
  • updater : pierov
  • windows : jwilde, morgan
  • misc/other : morgan, pierov

Change Description

1. Update conjure
2. create a go-licenses project and run it in the PTs
3. gather the various license files in various projects
4. add these files to tor-expert-bundle
5. copy them from tor-expert bundle also in browser

How Tested

1. Built a Linux testbuild to test everything works as intended: https://tb-build-03.torproject.org/~pierov/testbuild/tor-browser-linux-x86_64-testbuild.tar.xz
2. Built a macOS testbuild to check merging x86_64+aarch64 works (could not test the signature, though): https://tb-build-03.torproject.org/~pierov/testbuild/tor-browser-macos-testbuild.dmg
3. Built tor-expert-bundle for Windows x86_64
4. Built tor-expert-bundle-aar (which handles all Android architectures)

Not tested: Linux and Windows i686, but they usually aren't a surprise.

requested review from @boklm

assigned to @pierov

marked this merge request as draft

Setting as a draft, as I need to check with @cohosh if I can update the hash and drop the patch.

marked this merge request as ready

added 8 commits

• f64165d6...1a3e3774 - 3 commits from branch tpo/applications:main
• a5644464 - Bug 41417: Bump conjure to its current main.
• 22f66dea - Bug 41411: Add a project for go-licenses.
• a7b3394f - Bug 41411: Save licenses in the PT artifacts.
• 0402c6c6 - Bug 41411: Include licenses in tor-expert-bundle.
• 766d9e83 - Bug 41411: Use license files from the expert bundle.

Compare with previous version

It seems the whole file bsbuffer.go has been included with the licenses (in conjure.txt). Not sure if there is something easy we can do to fix that. Otherwise, since the file is small, it's probably not a big deal.

The changes lgtm.

Nice that we'll get licenses from go programs updated automatically!

approved this merge request

resolved all threads

merged