Review report from last Tor Code Audit Sponsor 30

The auditors sent us the report for the last code audit we have on Sponsor 30. You can read it (if you are logged into nc) at https://nc.torproject.net/f/469333

@micah @richard it needs a review from you two too.

added Next label

assigned to @gaba

added Doing label

removed Next label

@richard Let me know if you are ok with all the issues there. If that is the case I can fill in tickets in gitlab and send a mail to DRL with the report.

added Next label

assigned to @richard and unassigned @gaba

removed Doing label

marked this issue as related to tpo/applications/tor-browser#41763 (closed)

assigned to @gaba and unassigned @richard

marked this issue as related to tpo/applications/tor-browser#41764 (closed)

marked this issue as related to tpo/applications/tor-browser#41765 (closed)

made the issue confidential

@micah @bekeela I'm drafting a mail for DRL in https://pad.riseup.net/p/l2UPz1L-GMki1Q2aqiIK#L1 Can you review it?

looks good to me

marked this issue as related to tpo/applications/tor-browser#41766 (closed)

marked this issue as related to tpo/applications/tor-browser#41767

marked this issue as related to tpo/applications/tor-browser#41768

marked this issue as related to tpo/applications/tor-browser#41769 (closed)

added Doing label and removed Next label

added Next label and removed Doing label

assigned to @micah and unassigned @gaba

@bekeela is sending this mail to DRL about the last code audit report for Tor on this project.

closed

mentioned in issue tpo/applications/tor-browser#41765 (closed)

All the reported bugs rated Low are fixed in 13.0 - latest patch for tpo/applications/tor-browser#41765 (closed) has just been merged in 13.0 stable, to be released early next week.

There were no issues with higher rating.

The remaining open ones are rated Info and don't pose any relevant security/privacy risk worth a rushed fix or, in my opinion, keeping confidential.

If there are no objections, esp. from @richard, we can make them public (except tpo/applications/tor-browser#41765 (closed) maybe, to be deferred after release?)

works for me

From what I can see above, we can remove the confidentiality on this, but I'd prefer if @ma1 or @richard did so as a final check off

made the issue visible to everyone

Everything public now that 13.0 is deployed