Add CI for Tor Browser

stages:

  - update-container-images

  - lint

  - startup-test

  - update-translations

variables:

  IMAGE_PATH: containers.torproject.org/tpo/applications/tor-browser/base:latest

  LOCAL_REPO_PATH: /srv/apps-repos/tor-browser.git

include:

  - local: '.gitlab/ci/mixins.yml'

  - local: '.gitlab/ci/jobs/lint/lint.yml'

  - local: '.gitlab/ci/jobs/startup-test/startup-test.yml'

  - local: '.gitlab/ci/jobs/update-containers.yml'

  - local: '.gitlab/ci/jobs/update-translations.yml'

# This image is published in containers.torproject.org/tpo/applications/tor-browser/base

#

# Whenever there are changes to this file,

# they are autopublished on merge to the tpo/applications/tor-browser repository.

#

# The image is updated roughly once a monce when the tor-browser repository is rebased.

FROM containers.torproject.org/tpo/tpa/base-images/python:bookworm

RUN apt-get update && apt-get install -y \

        clang \

        curl \

        git \

        libasound2-dev \

        libdbus-glib-1-dev \

        libgtk-3-dev \

        libpango1.0-dev \

        libpulse-dev \

        libx11-xcb-dev \

        libxcomposite-dev \

        libxcursor-dev \

        libxdamage-dev \

        libxi-dev \

        libxrandr-dev \

        libxtst-dev \

        make \

        m4 \

        mercurial \

        nasm \

        pkgconf \

        unzip \

        x11-utils \

        xvfb \

        xz-utils \

        wget && \

    apt-get clean && \

    rm -rf /var/lib/apt/lists/*

WORKDIR /app

COPY taskcluster/docker/recipes/install-node.sh ./install-node.sh

RUN chmod +x install-node.sh

RUN ./install-node.sh

RUN rm ./install-node.sh

COPY taskcluster/kinds/fetch/toolchains.yml ./toolchains.yml

RUN curl https://sh.rustup.rs -sSf | sh -s -- -y --default-toolchain $(grep -oP 'rust-\K[0-9.]+(?=:)' ./toolchains.yml)

RUN $HOME/.cargo/bin/cargo install cbindgen --version $(grep -oP 'cbindgen-\K[0-9.]+(?=:)' ./toolchains.yml)

RUN rm ./toolchains.yml

CMD ["/bin/bash"]

FROM debian:latest

# Base image which includes all* dependencies checked by ./mach configure.

#

# * Actually not all dependencies. WASM sandboxed depencies were left out for now.

# This installs all dependencies checked by `./mach configure --without-wasm-sandboxed-libraries`.

#

# # Building and publishing

#

# Whenever this file changes, the updated Docker image must be built and published _manually_ to

# the tor-browser container registry (https://gitlab.torproject.org/tpo/applications/tor-browser/container_registry/185).

#

# This image copies a script from the taskcluster/ folder, which requires it

# to be built from a folder which is a parent of the taskcluster/ folder.

#

# To build, run:

#

# ```bash

# docker build \

#   -f <PATH_TO_DOCKERFILE> \

#   -t <REGISTRY_URL>/<IMAGE_NAME>:<IMAGE_TAG>

#   .

# ```

#

# For example, when building from the root of this repository to the main tor-browser repository

# and assuming image name to be "base" and tag "latest" -- which is the current terminology:

#

# ```bash

# docker build \

#   -f .gitlab/ci/docker/Dockerfile \

#   -t containers.torproject.org/tpo/applications/tor-browser/base:latest

#   .

# ```

RUN apt-get update && apt-get install -y \

    clang \

    curl \

    git \

    libasound2-dev \

    libdbus-glib-1-dev \

    libgtk-3-dev \

    libpango1.0-dev \

    libpulse-dev \

    libx11-xcb-dev \

    libxcomposite-dev \

    libxcursor-dev \

    libxdamage-dev \

    libxi-dev \

    libxrandr-dev \

    libxtst-dev \

    m4 \

    mercurial \

    nasm \

    pkg-config \

    python3 \

    python3-pip \

    unzip \

    wget

COPY taskcluster/docker/recipes/install-node.sh /scripts/install-node.sh

RUN chmod +x /scripts/install-node.sh

RUN /scripts/install-node.sh

RUN curl https://sh.rustup.rs -sSf | sh -s -- -y

RUN $HOME/.cargo/bin/cargo install cbindgen

WORKDIR /app

CMD ["/bin/bash"]

.base:

  extends: .with-local-repo-bash

  stage: lint

  image: $IMAGE_PATH

  interruptible: true

  variables:

    MOZBUILD_STATE_PATH: "$CI_PROJECT_DIR/.cache/mozbuild"

    # A copy of the repository already is available in the runner.

    GIT_STRATEGY: "none"

  cache:

    paths:

      - node_modules

  tags:

    # Run these jobs in the browser dedicated runners.

    - firefox

  before_script:

    - git init

    - git remote add local "$LOCAL_REPO_PATH"

    - git fetch --depth 500 local

    - git remote add origin "$CI_REPOSITORY_URL"

    - |

      if [ -z "${CI_COMMIT_BRANCH:-$CI_MERGE_REQUEST_SOURCE_BRANCH_NAME}" ]; then

          echo "No branch specified. Stopping the pipeline."

          exit 1

      fi

    - echo "Fetching from remote branch ${CI_COMMIT_BRANCH:-$CI_MERGE_REQUEST_SOURCE_BRANCH_NAME}"

    - git fetch origin "${CI_COMMIT_BRANCH:-$CI_MERGE_REQUEST_SOURCE_BRANCH_NAME}"

    - git checkout origin/${CI_COMMIT_BRANCH:-$CI_MERGE_REQUEST_SOURCE_BRANCH_NAME}

eslint:

  extends: .base

#!/usr/bin/env python3

import argparse

import subprocess

from datetime import datetime, timedelta

PLATFORM_TO_ARCH = {

    "linux": ["x86_64", "i686"],

    "macos": ["x86_64", "aarch64"],

    "windows": ["x86_64", "i686"],

}

class DynamicArchAction(argparse.Action):

    def __call__(self, parser, namespace, values, option_string=None):

        platform = getattr(namespace, "platform", None)

        if not platform:

            raise argparse.ArgumentError(

                self, "The --platform argument must be provided before --arch."

            )

        valid_archs = PLATFORM_TO_ARCH.get(platform, [])

        if values not in valid_archs:

            raise argparse.ArgumentError(

                self,

                f"Invalid architecture '{values}' for platform '{platform}'. "

                f"Valid options are: {', '.join(valid_archs)}",

            )

        setattr(namespace, self.dest, values)

parser = argparse.ArgumentParser(

    description="Downloads and executes yesterday's build of Tor or Mullvad browser nightly."

)

parser.add_argument(

    "--platform",

    required=True,

    help="Specify the platform (linux, macos or windows). Must be provided before --arch.",

    choices=PLATFORM_TO_ARCH.keys(),

)

parser.add_argument(

    "--arch",

    required=True,

    help="Specify the architecture (validated dynamically based on --platform).",

    action=DynamicArchAction,

)

parser.add_argument(

    "--browser",

    required=True,

    choices=["tor", "mullvad"],

    help="Specify the browser (tor or mullvad)",

)

args = parser.parse_args()

arch = f"-{args.arch}"

extra = ""

if args.platform == "linux":

    archive_extension = "tar.xz"

    binary = f"Browser/start-{args.browser}-browser"

elif args.platform == "macos":

    archive_extension = "dmg"

    # The URL doesn't include the architecture for MacOS,

    # because it's a universal build.

    arch = ""

    if args.browser == "tor":

        binary = "Contents/MacOS/firefox"

    else:

        binary = "Contents/MacOS/mullvadbrowser"

elif args.platform == "windows":

    archive_extension = "exe"

    if args.browser == "tor":

        extra = "-portable"

        binary = "Browser/firefox.exe"

    else:

        binary = "mullvadbrowser.exe"

yesterday = (datetime.now() - timedelta(days=1)).strftime("%Y.%m.%d")

download_url_base = (

    "https://nightlies.tbb.torproject.org/nightly-builds/tor-browser-builds"

)

if args.browser == "tor":

    download_url = f"{download_url_base}/tbb-nightly.{yesterday}/nightly-{args.platform}{arch}/{args.browser}-browser-{args.platform}{arch}{extra}-tbb-nightly.{yesterday}.{archive_extension}"

else:

    download_url = f"{download_url_base}/tbb-nightly.{yesterday}/mullvadbrowser-nightly-{args.platform}{arch}/{args.browser}-browser-{args.platform}{arch}-tbb-nightly.{yesterday}.{archive_extension}"

subprocess.run(

    [

        "python3",

        "testing/mozharness/scripts/does_it_crash.py",

        "--run-for",

        "30",

        "--thing-url",

        download_url,

        "--thing-to-run",

        binary,

    ]

)