[Author Prev][Author Next][Thread Prev][Thread Next][Author Index][Thread Index]

[tor-commits] [Git][tpo/applications/tor-browser-build][main] Updated gitlab alpha build prep templates

Title: GitLab

richard pushed to branch main at The Tor Project / Applications / tor-browser-build

Commits:

  • 600cbac2
    by Richard Pospesel at 2023-09-12T17:36:15+00:00 
    Updated gitlab alpha build prep templates

- fixed formatting
- updated email templates
- updated changelog steps
- updated the build+reproducibility veificaiton workflow
- added explicit list of valid taggers
- added assign step for signers
- added Sponsor 131 label for Mullvad Browser
- various work-flows to match reality

2 changed files:

Changes:

  • .gitlab/issue_templates/Release Prep - Mullvad Browser Alpha.md
    ... ... @@ -27,54 +27,79 @@
    27 27 
     </details>
    28 28
    29 29 
     **NOTE** It is assumed that the `tor-browser` alpha rebase and security backport tasks have been completed
    30 
    +**NOTE** This can/is often done in conjunction with the equivalent Tor Browser release prep issue
    30 31
    31 32 
     <details>
    32 33 
       <summary>Building</summary>
    33 34
    34 
    -### tor-browser-build: https://gitlab.torproject.org/tpo/applications/tor-browser-build.git
    35 
    -Mullvad Browser Alpha (and Nightly) are on the `main` branch
    36 
    -
    37 
    -- [ ] Update `rbm.conf`
    38 
    -  - [ ] `var/torbrowser_version` : update to next version
    39 
    -  - [ ] `var/torbrowser_build` : update to `$(MULLVAD_BROWSER_BUILD_N)`
    40 
    -  - [ ] `var/torbrowser_incremental_from` : update to previous Desktop version
    41 
    -    - **IMPORTANT**: Really *actually* make sure this is the previous Desktop version or else the `make mullvadbrowser-incrementals-*` step will fail
    42 
    -- [ ] Update build configs
    43 
    -  - [ ] Update `projects/firefox/config`
    44 
    -    - [ ] `browser_build` : update to match `mullvad-browser` tag
    45 
    -    - [ ] ***(Optional)*** `var/firefox_platform_version` : update to latest `$(ESR_VERSION)` if rebased
    46 
    -  - [ ] Update `projects/translation/config`:
    47 
    -    - [ ] run `make list_translation_updates-alpha` to get updated hashes
    48 
    -    - [ ] `steps/base-browser/git_hash` : update with `HEAD` commit of project's `base-browser` branch
    49 
    -    - [ ] `steps/mullvad-browser/git_hash` : update with `HEAD` commit of project's `mullvad-browser` branch
    50 
    -- [ ] Update common build configs
    51 
    -  - [ ] Check for NoScript updates here : https://addons.mozilla.org/en-US/firefox/addon/noscript
    52 
    -    - [ ] ***(Optional)*** If new version available, update `noscript` section of `input_files` in `projects/browser/config`
    53 
    -      - [ ] `URL`
    54 
    -      - [ ] `sha256sum`
    55 
    -  - [ ] Check for uBlock-origin updates here : https://addons.mozilla.org/en-US/firefox/addon/ublock-origin/
    56 
    -    - [ ] ***(Optional)*** If new version available, update `ublock-origin` section of `input_files` in `projects/browser/config`
    57 
    -      - [ ] `URL`
    58 
    -      - [ ] `sha256sum`
    59 
    -  - [ ] Check for Mullvad Privacy Companion updates here : https://github.com/mullvad/browser-extension/releases
    60 
    -    - [ ] ***(Optional)*** If new version available, update `mullvad-extension` section of `input_files` in `projects/browser/config`
    61 
    -      - [ ] `URL`
    62 
    -      - [ ] `sha256sum`
    63 
    -- [ ] Open MR with above changes
    64 
    -- [ ] Merge
    65 
    -- [ ] Sign/Tag commit: `make mullvadbrowser-signtag-alpha`
    66 
    -- [ ] Push tag to `origin`
    67 
    -- [ ] Begin build on `$(BUILD_SERVER)` (fix any issues in subsequent MRs)
    68 
    -- [ ] **TODO** Submit build-tag to Mullvad build infra
    69 
    -- [ ] Ensure builders have matching builds
    35 
    +  ### tor-browser-build: https://gitlab.torproject.org/tpo/applications/tor-browser-build.git
    36 
    +  Mullvad Browser Alpha (and Nightly) are on the `main` branch
    37 
    +
    38 
    +  - [ ] Update `rbm.conf`
    39 
    +    - [ ] `var/torbrowser_version` : update to next version
    40 
    +    - [ ] `var/torbrowser_build` : update to `$(MULLVAD_BROWSER_BUILD_N)`
    41 
    +    - [ ] `var/torbrowser_incremental_from` : update to previous Desktop version
    42 
    +      - **NOTE**: We try to build incrementals for the previous 3 desktop versions except in the case of a watershed update
    43 
    +      - **IMPORTANT**: Really *actually* make sure this is the previous Desktop version or else the `make mullvadbrowser-incrementals-*` step will fail
    44 
    +  - [ ] Update build configs
    45 
    +    - [ ] Update `projects/firefox/config`
    46 
    +      - [ ] `browser_build` : update to match `mullvad-browser` tag
    47 
    +      - [ ] ***(Optional)*** `var/firefox_platform_version` : update to latest `$(ESR_VERSION)` if rebased
    48 
    +    - [ ] Update `projects/translation/config`:
    49 
    +      - [ ] run `make list_translation_updates-alpha` to get updated hashes
    50 
    +      - [ ] `steps/base-browser/git_hash` : update with `HEAD` commit of project's `base-browser` branch
    51 
    +      - [ ] `steps/mullvad-browser/git_hash` : update with `HEAD` commit of project's `mullvad-browser` branch
    52 
    +  - [ ] Update common build configs
    53 
    +    - [ ] Check for NoScript updates here : https://addons.mozilla.org/en-US/firefox/addon/noscript
    54 
    +      - [ ] ***(Optional)*** If new version available, update `noscript` section of `input_files` in `projects/browser/config`
    55 
    +        - [ ] `URL`
    56 
    +        - [ ] `sha256sum`
    57 
    +    - [ ] Check for uBlock-origin updates here : https://addons.mozilla.org/en-US/firefox/addon/ublock-origin/
    58 
    +      - [ ] ***(Optional)*** If new version available, update `ublock-origin` section of `input_files` in `projects/browser/config`
    59 
    +        - [ ] `URL`
    60 
    +        - [ ] `sha256sum`
    61 
    +    - [ ] Check for Mullvad Privacy Companion updates here : https://github.com/mullvad/browser-extension/releases
    62 
    +      - [ ] ***(Optional)*** If new version available, update `mullvad-extension` section of `input_files` in `projects/browser/config`
    63 
    +        - [ ] `URL`
    64 
    +        - [ ] `sha256sum`
    65 
    +  - [ ] Update `ChangeLog-MB.txt`
    66 
    +    - [ ] Ensure ChangeLog-MB.txt is sync'd between alpha and stable branches
    67 
    +    - [ ] Check the linked issues: ask people to check if any are missing, remove the not fixed ones
    68 
    +    - [ ] Run `tools/fetch-changelogs.py $(TOR_BROWSER_VERSION)` or `tools/fetch-changelogs.py '#$(ISSUE_NUMBER)'`
    69 
    +      - Make sure you have `requests` installed (e.g., `apt install python3-requests`)
    70 
    +      - The first time you run this script you will need to generate an access token; the script will guide you
    71 
    +    - [ ] Copy the output of the script to the beginning of `ChangeLog-MB.txt` and update its output
    72 
    +      - [ ] Version
    73 
    +      - [ ] Browser Name
    74 
    +      - [ ] Release Date
    75 
    +    - [ ] Under `All Platforms` include any version updates for:
    76 
    +      - NoScript
    77 
    +      - uBlock-origin
    78 
    +      - Mullvad Browser Extension
    79 
    +      - Firefox
    80 
    +  - [ ] Open MR with above changes
    81 
    +  - [ ] Build the MR after initial review on at least two of:
    82 
    +    - [ ] Tor Project build machine
    83 
    +    - [ ] Mullvad build machine
    84 
    +    - [ ] Local developer machine
    85 
    +  - [ ] Ensure builders have matching builds
    86 
    +  - [ ] Merge
    87 
    +  - [ ] Sign+Tag
    88 
    +    - **NOTE** this must be done by one of:
    89 
    +      - boklm
    90 
    +      - dan
    91 
    +      - ma1
    92 
    +      - pierov
    93 
    +      - richard
    94 
    +    - [ ] Run: `make mullvadbrowser-signtag-alpha`
    95 
    +    - [ ] Push tag to `origin`
    70 96
    71 97 
     </details>
    72 98
    73 99 
     <details>
    74 100 
       <summary>QA</summary>
    75 101
    76 
    -### send the build
    77 
    -
    102 
    +  ### send the build
    78 103 
       - [ ] Email Mullvad QA: support@xxxxxxxxxxx, rui@xxxxxxxxxxx
    79 104 
         <details>
    80 105 
           <summary>email template</summary>
    ... ... @@ -83,7 +108,7 @@ Mullvad Browser Alpha (and Nightly) are on the `main` branch
    83 108 
             New build: Mullvad Browser $(MULLVAD_BROWSER_VERION) (unsigned)
    84 109
    85 110 
             Body:
    86 
    -        unsigned builds: https://tb-build-05.torproject.org/~$(BUILDER)/builds/mullvadbrowser/release/unsigned/$(MB_BUILD_TAG)
    111 
    +        unsigned builds: https://tb-build-05.torproject.org/~$(BUILDER)/builds/mullvadbrowser/alpha/unsigned/$(MB_BUILD_TAG)
    87 112
    88 113 
             changelog:
    89 114 
             ...
    ... ... @@ -99,97 +124,106 @@ Mullvad Browser Alpha (and Nightly) are on the `main` branch
    99 124 
     <details>
    100 125 
       <summary>Signing</summary>
    101 126
    102 
    -### signing
    103 
    -- [ ] On `$(STAGING_SERVER)`, ensure updated:
    104 
    -  - [ ]  `tor-browser-build/tools/signing/set-config.hosts`
    105 
    -    - `ssh_host_builder` : ssh hostname of machine with unsigned builds
    106 
    -      - **NOTE** : `tor-browser-build` is expected to be in the `$HOME` directory)
    107 
    -    - `ssh_host_linux_signer` : ssh hostname of linux signing machine
    108 
    -    - `ssh_host_macos_signer` : ssh hostname of macOS signing machine
    109 
    -  - [ ] `tor-browser-build/tools/signing/set-config.macos-notarization`
    110 
    -    - `macos_notarization_user` : the email login for a mullvad notariser Apple Developer account
    111 
    -  - [ ] `set-config.update-responses`
    112 
    -    - `update_responses_repository_dir` : directory where you cloned `git@xxxxxxxxxxxxxxxxxxxxx:tpo/applications/mullvad-browser-update-responses.git`
    113 
    -  - [ ] `tor-browser-build/tools/signing/set-config.tbb-version`
    114 
    -    - `tbb_version` : mullvad browser version string, same as `var/torbrowser_version` in `rbm.conf` (examples: `11.5a12`, `11.0.13`)
    115 
    -    - `tbb_version_build` : the tor-browser-build build number (if `var/torbrowser_build` in `rbm.conf` is `buildN` then this value is `N`)
    116 
    -    - `tbb_version_type` : either `alpha` for alpha releases or `release` for stable releases
    117 
    -- [ ] On `$(STAGING_SERVER)` in a separate `screen` session, run the macOS proxy script:
    118 
    -    - `cd tor-browser-build/tools/signing/`
    119 
    -    - `./macos-signer-proxy`
    120 
    -- [ ] On `$(STAGING_SERVER)` in a separate `screen` session, ensure tor daemon is running with SOCKS5 proxy on the default port 9050
    121 
    -- [ ] run do-all-signing script:
    122 
    -    - `cd tor-browser-build/tools/signing/`
    123 
    -    - `./do-all-signing.mullvadbrowser`
    124 
    -- **NOTE**: at this point the signed binaries should have been copied to `staticiforme`
    125 
    -- [ ] Update `staticiforme.torproject.org`:
    126 
    -  - From `screen` session on `staticiforme.torproject.org`:
    127 
    -  - [ ] Static update components : `static-update-component dist.torproject.org`
    128 
    -  - [ ] Remove old release data from `/srv/dist-master.torproject.org/htdocs/mullvadbrowser`
    129 
    -  - [ ] Static update components (again) : `static-update-component dist.torproject.org`
    127 
    +  ### signing
    128 
    +  - [ ] Assign this issue to the signer, one of:
    129 
    +    - boklm
    130 
    +    - richard
    131 
    +  - [ ] On `$(STAGING_SERVER)`, ensure updated:
    132 
    +    - [ ]  `tor-browser-build/tools/signing/set-config.hosts`
    133 
    +      - `ssh_host_builder` : ssh hostname of machine with unsigned builds
    134 
    +        - **NOTE** : `tor-browser-build` is expected to be in the `$HOME` directory)
    135 
    +      - `ssh_host_linux_signer` : ssh hostname of linux signing machine
    136 
    +      - `ssh_host_macos_signer` : ssh hostname of macOS signing machine
    137 
    +    - [ ] `tor-browser-build/tools/signing/set-config.macos-notarization`
    138 
    +      - `macos_notarization_user` : the email login for a mullvad notariser Apple Developer account
    139 
    +    - [ ] `set-config.update-responses`
    140 
    +      - `update_responses_repository_dir` : directory where you cloned `git@xxxxxxxxxxxxxxxxxxxxx:tpo/applications/mullvad-browser-update-responses.git`
    141 
    +    - [ ] `tor-browser-build/tools/signing/set-config.tbb-version`
    142 
    +      - `tbb_version` : mullvad browser version string, same as `var/torbrowser_version` in `rbm.conf` (examples: `11.5a12`, `11.0.13`)
    143 
    +      - `tbb_version_build` : the tor-browser-build build number (if `var/torbrowser_build` in `rbm.conf` is `buildN` then this value is `N`)
    144 
    +      - `tbb_version_type` : either `alpha` for alpha releases or `release` for stable releases
    145 
    +  - [ ] On `$(STAGING_SERVER)` in a separate `screen` session, run the macOS proxy script:
    146 
    +      - `cd tor-browser-build/tools/signing/`
    147 
    +      - `./macos-signer-proxy`
    148 
    +  - [ ] On `$(STAGING_SERVER)` in a separate `screen` session, ensure tor daemon is running with SOCKS5 proxy on the default port 9050
    149 
    +  - [ ] run do-all-signing script:
    150 
    +      - `cd tor-browser-build/tools/signing/`
    151 
    +      - `./do-all-signing.mullvadbrowser`
    152 
    +  - **NOTE**: at this point the signed binaries should have been copied to `staticiforme`
    153 
    +  - [ ] Update `staticiforme.torproject.org`:
    154 
    +    - From `screen` session on `staticiforme.torproject.org`:
    155 
    +    - [ ] Static update components : `static-update-component dist.torproject.org`
    156 
    +    - [ ] Remove old release data from `/srv/dist-master.torproject.org/htdocs/mullvadbrowser`
    157 
    +    - [ ] Static update components (again) : `static-update-component dist.torproject.org`
    130 158
    131 159 
     </details>
    132 160
    133 161 
     <details>
    134 162 
       <summary>Publishing</summary>
    135 163
    136 
    -### email
    137 
    -
    138 
    -- [ ] Email Mullvad with release information: support@xxxxxxxxxxx, rui@xxxxxxxxxxx
    139 
    -  <details>
    140 
    -    <summary>email template</summary>
    141 
    -
    142 
    -      Subject:
    143 
    -      New build: Mullvad Browser $(MULLVAD_BROWSER_VERION) (signed)
    144 
    -
    145 
    -      Body:
    146 
    -      signed builds: https://dist.torproject.org/mullvadbrowser/$(MULLVAD_BROWSER_VERSION)
    164 
    +  ### mullvad-browser (github): https://github.com/mullvad/mullvad-browser/
    165 
    +  - [ ] Assign this issue to someone with mullvad commit access, one of:
    166 
    +    - richard
    167 
    +  - [ ] Push this release's associated `mullvad-browser.git` branch to github
    168 
    +  - [ ] Push this release's associated tags to github:
    169 
    +    - [ ] Firefox ESR tag
    170 
    +      - **example** : `FIREFOX_102_12_0esr_BUILD1,`
    171 
    +    - [ ] `base-browser` tag
    172 
    +      - **example** : `base-browser-102.12.0esr-12.0-1-build1`
    173 
    +    - [ ] `mullvad-browser` tag
    174 
    +      - **example** : `mullvad-browser-102.12.0esr-12.0-1-build1`
    175 
    +  - [ ] Sign+Tag additionally the `mullvad-browser.git` `firefox` commit used in build:
    176 
    +    - **Tag**: `$(MULLVAD_BROWSER_VERSION)`
    177 
    +      - **example** : `12.5a7`
    178 
    +    - **Message**: `$(ESR_VERSION)esr-based $(MULLVAD_BROWSER_VERSION)`
    179 
    +      - **example** : `102.12.0esr-based 12.5a7`
    180 
    +    - [ ] Push tag to github
    181 
    +
    182 
    +  ### email
    183 
    +  - [ ] Email Mullvad with release information: support@xxxxxxxxxxx, rui@xxxxxxxxxxx
    184 
    +    <details>
    185 
    +      <summary>email template</summary>
    147 186
    148 
    -      update_response hashes: $(MULLVAD_UPDATE_RESPONSES_HASH)
    187 
    +        Subject:
    188 
    +        New build: Mullvad Browser $(MULLVAD_BROWSER_VERION) (signed)
    149 189
    150 
    -      changelog:
    151 
    -      ...
    190 
    +        Body:
    191 
    +        signed builds: https://dist.torproject.org/mullvadbrowser/$(MULLVAD_BROWSER_VERSION)
    152 192
    153 
    -  </details>
    193 
    +        update_response hashes: $(MULLVAD_UPDATE_RESPONSES_HASH)
    154 194
    155 
    -### mullvad-browser (github): https://github.com/mullvad/mullvad-browser/
    156 
    -- [ ] Push this release's associated `mullvad-browser.git` branch to github
    157 
    -- [ ] Push this release's associated tags to github:
    158 
    -  - [ ] Firefox ESR tag
    159 
    -    - **example** : `FIREFOX_102_12_0esr_BUILD1,`
    160 
    -  - [ ] `base-browser` tag
    161 
    -    - **example** : `base-browser-102.12.0esr-12.0-1-build1`
    162 
    -  - [ ] `mullvad-browser` tag
    163 
    -    - **example** : `mullvad-browser-102.12.0esr-12.0-1-build1`
    164 
    -- [ ] Sign+Tag additionally the `mullvad-browser.git` `firefox` commit used in build:
    165 
    -  - **Tag**: `$(MULLVAD_BROWSER_VERSION)`
    166 
    -    - **example** : `12.5a7`
    167 
    -  - **Message**: `$(ESR_VERSION)esr-based $(MULLVAD_BROWSER_VERSION)`
    168 
    -    - **example** : `102.12.0esr-based 12.5a7`
    169 
    -  - [ ] Push tag to github
    195 
    +        changelog:
    196 
    +        ...
    170 197
    198 
    +    </details>
    171 199 
     </details>
    172 200
    173 201 
     <details>
    174 202 
       <summary>Downstream</summary>
    175 203
    176 
    -### notify packagers
    204 
    +  ### notify packagers
    205 
    +
    206 
    +  - [ ] **(Optional, Once Mullvad Updates their Github Releases Page)** Email downstream consumers:
    207 
    +    - **NOTE**: This is an optional step and only necessary close a major release/transition from alpha to stable, or if there are major packing changes these developers need to be aware of
    208 
    +    <details>
    209 
    +      <summary>email template</summary>
    210 
    +
    211 
    +        Hello!
    177 212
    178 
    -- [ ] **(Optional, Once Mullvad Updates their Github Releases Page)** Email downstream consumers:
    179 
    -  <details>
    180 
    -    <summary>email template</summary>
    213 
    +        Mullvad-Browser $(MULLVAD_BROWSER_VERSION) packages are available, so you should all update your respective downstream packages.
    181 214
    182 
    -    ...
    215 
    +        Release builds can be found here:
    183 216
    184 
    -    ...
    217 
    +        - https://github.com/mullvad/mullvad-browser/releases/tag/$(MULLVAD_BROWSER_VERSION)
    185 218
    186 
    -  </details>
    219 
    +    </details>
    187 220
    188 
    -  - **NOTE**: This is an optional step and only necessary close a major release/transition from alpha to stable, or if there are major packing changes these developers need to be aware of
    189 
    -  - [ ] flathub package maintainer: proletarius101@xxxxxxxxxxxxxx
    190 
    -  - [ ] arch package maintainer: bootctl@xxxxxxxxx
    191 
    -  - [ ] nixOS package maintainer: dev@xxxxxxxxxxx
    221 
    +    - flathub package maintainer: proletarius101@xxxxxxxxxxxxxx
    222 
    +    - arch package maintainer: bootctl@xxxxxxxxx
    223 
    +    - nixOS package maintainer: dev@xxxxxxxxxxx
    192 224
    193 225 
     </details>
    194 226
    195 227 
     /label ~"Release Prep"
    228 
    +/label ~"Sponsor 131"
    229 
    +

  • .gitlab/issue_templates/Release Prep - Tor Browser Alpha.md
    ... ... @@ -27,190 +27,208 @@
    27 27 
     </details>
    28 28
    29 29 
     **NOTE** It is assumed that the `tor-browser` stable rebase and security backport tasks have been completed
    30 
    +**NOTE** This can/is often done in conjunction with the equivalent Mullvad Browser release prep issue
    30 31
    31 32 
     <details>
    32 33 
       <summary>Building</summary>
    33 34
    34 
    -### tor-browser-build: https://gitlab.torproject.org/tpo/applications/tor-browser-build.git
    35 
    -Tor Browser Alpha (and Nightly) are on the `main` branch
    36 
    -
    37 
    -- [ ] Update `rbm.conf`
    38 
    -  - [ ] `var/torbrowser_version` : update to next version
    39 
    -  - [ ] `var/torbrowser_build` : update to `$(TOR_BROWSER_BUILD_N)`
    40 
    -  - [ ] ***(Desktop Only)***`var/torbrowser_incremental_from` : update to previous Desktop version
    41 
    -    - **IMPORTANT**: Really *actually* make sure this is the previous Desktop version or else the `make torbrowser-incrementals-*` step will fail
    42 
    -- [ ] Update Desktop-specific build configs
    43 
    -  - [ ] Update `projects/firefox/config`
    44 
    -    - [ ] `browser_build` : update to match `tor-browser` tag
    45 
    -    - [ ] ***(Optional)*** `var/firefox_platform_version` : update to latest `$(ESR_VERSION)` if rebased
    46 
    -  - [ ] Update `projects/translation/config`:
    47 
    -    - [ ] run `make list_translation_updates-alpha` to get updated hashes
    48 
    -    - [ ] `steps/base-browser/git_hash` : update with `HEAD` commit of project's `base-browser` branch
    49 
    -    - [ ] `steps/tor-browser/git_hash` : update with `HEAD` commit of project's `tor-browser` branch
    50 
    -    - [ ] `steps/fenix/git_hash` : update with `HEAD` commit of project's `fenix-torbrowserstringsxml` branch
    51 
    -- [ ] Update Android-specific build configs
    52 
    -  - [ ] Update `projects/geckoview/config`
    53 
    -    - [ ] `browser_build` : update to match `tor-browser` tag
    54 
    -    - [ ] ***(Optional)*** `var/geckoview_version` : update to latest `$(ESR_VERSION)` if rebased
    55 
    -  - [ ] ***(Optional)*** Update `projects/tor-android-service/config`
    56 
    -    - [ ] `git_hash` : update with `HEAD` commit of project's `main` branch
    57 
    -  - [ ] ***(Optional)*** Update `projects/application-services/config`:
    58 
    -    **NOTE** we don't currently have any of our own patches for this project
    59 
    -    - [ ] `git_hash` : update to appropriate git commit associated with `$(ESR_VERSION)`
    60 
    -  - [ ] ***(Optional)*** Update `projects/firefox-android/config`:
    61 
    -    - [ ] `fenix_version` : update to match alpha `firefox-android` build tag
    62 
    -    - [ ] `browser_branch` : update to match alpha `firefox-android` build tag
    63 
    -  - [ ] Update allowed_addons.json by running (from `tor-browser-build` root):
    64 
    -    - `./tools/fetch_allowed_addons.py > projects/browser/allowed_addons.json`
    65 
    -- [ ] Update common build configs
    66 
    -  - [ ] Check for NoScript updates here : https://addons.mozilla.org/en-US/firefox/addon/noscript
    67 
    -    - [ ] ***(Optional)*** If new version available, update `noscript` section of `input_files` in `projects/browser/config`
    68 
    -      - [ ] `URL`
    69 
    -      - [ ] `sha256sum`
    70 
    -  - [ ] Check for OpenSSL updates here : https://www.openssl.org/source/
    71 
    -    - [ ] ***(Optional)*** If new 3.0.X version available, update `projects/openssl/config`
    72 
    -      - [ ] `version` : update to next 3.0.X version
    73 
    -      - [ ] `input_files/sha256sum` : update to sha256 sum of source tarball
    74 
    -  - [ ] Check for zlib updates here: https://github.com/madler/zlib/releases
    75 
    -    - [ ] **(Optional)** If new tag available, update `projects/zlib/config`
    76 
    -      - [ ] `version` : update to next release tag
    77 
    -  - [ ] Check for tor updates here : https://gitlab.torproject.org/tpo/core/tor/-/tags
    78 
    -    - [ ] ***(Optional)*** Update `projects/tor/config`
    79 
    -      - [ ] `version` : update to latest `-alpha` tag or release tag if newer (ping dgoulet or ahf if unsure)
    80 
    -  - [ ] Check for go updates here : https://golang.org/dl
    81 
    -    - **NOTE** : Tor Browser Alpha uses the latest Stable major series go version
    82 
    -    - [ ] ***(Optional)*** Update `projects/go/config`
    83 
    -      - [ ] `version` : update go version
    84 
    -      - [ ] `input_files/sha256sum` for `go` : update sha256sum of archive (sha256 sums are displayed on the go download page)
    85 
    -  - [ ] Check for manual updates by running (from `tor-browser-build` root): `./tools/fetch-manual.py`
    86 
    -    - [ ] ***(Optional)*** If new version is available:
    87 
    -      - [ ] Upload the downloaded `manual_$PIPELINEID.zip` file to people.tpo
    88 
    -      - [ ] Update `projects/manual/config`:
    89 
    -        - [ ] Change the `version` to `$PIPELINEID`
    90 
    -        - [ ] Update `sha256sum` in the `input_files` section
    91 
    -        - [ ] ***(Optional)*** Update the URL if you have uploaded to a different people.tpo home
    92 
    -- [ ] Update `ChangeLog.txt`
    93 
    -  - [ ] Ensure ChangeLog.txt is sync'd between alpha and stable branches
    94 
    -  - [ ] Check the linked issues: ask people to check if any are missing, remove the not fixed ones
    95 
    -  - [ ] Run `tools/fetch-changelogs.py $(TOR_BROWSER_VERSION)` or `tools/fetch-changelogs.py '#$(ISSUE_NUMBER)'`
    96 
    -    - Make sure you have `requests` installed (e.g., `apt install python3-requests`)
    97 
    -    - The first time you run this script you will need to generate an access token; the script will guide you
    98 
    -  - [ ] Copy the output of the script to the beginning of `ChangeLog.txt` and adjust its output
    99 
    -    - **NOTE** : If you used the issue number, you will need to write the Tor Browser version manually
    100 
    -  - [ ] ***(Optional)*** Under `All Platforms` include any version updates for:
    101 
    -    - [ ] Translations
    102 
    -    - [ ] OpenSSL
    103 
    -    - [ ] NoScript
    104 
    -    - [ ] zlib
    105 
    -    - [ ] tor daemon
    106 
    -  - [ ] ***(Optional)*** Under `Windows + macOS + Linux` include updates for:
    107 
    -    - [ ] Firefox
    108 
    -  - [ ] ***(Optional)*** Under `Android`, include updates for:
    109 
    -    - [ ] Geckoview
    110 
    -  - [ ] ***(Optional)*** Under `Build System/All Platforms` include updates for:
    111 
    -    - [ ] Go
    112 
    -- [ ] Open MR with above changes
    113 
    -- [ ] Merge
    114 
    -- [ ] Sign/Tag commit: `make torbrowser-signtag-alpha`
    115 
    -- [ ] Push tag to `origin`
    116 
    -- [ ] Begin build on `$(BUILD_SERVER)` (fix any issues in subsequent MRs)
    117 
    -- [ ] **TODO** Submit build-tag to Mullvad build infra
    118 
    -- [ ] Ensure builders have matching builds
    35 
    +  ### tor-browser-build: https://gitlab.torproject.org/tpo/applications/tor-browser-build.git
    36 
    +  Tor Browser Alpha (and Nightly) are on the `main` branch
    37 
    +
    38 
    +  - [ ] Update `rbm.conf`
    39 
    +    - [ ] `var/torbrowser_version` : update to next version
    40 
    +    - [ ] `var/torbrowser_build` : update to `$(TOR_BROWSER_BUILD_N)`
    41 
    +    - [ ] ***(Desktop Only)***`var/torbrowser_incremental_from` : update to previous Desktop version
    42 
    +      - **NOTE**: We try to build incrementals for the previous 3 desktop versions except in the case of a watershed update
    43 
    +      - **IMPORTANT**: Really *actually* make sure this is the previous Desktop version or else the `make torbrowser-incrementals-*` step will fail
    44 
    +  - [ ] Update Desktop-specific build configs
    45 
    +    - [ ] Update `projects/firefox/config`
    46 
    +      - [ ] `browser_build` : update to match `tor-browser` tag
    47 
    +      - [ ] ***(Optional)*** `var/firefox_platform_version` : update to latest `$(ESR_VERSION)` if rebased
    48 
    +    - [ ] Update `projects/translation/config`:
    49 
    +      - [ ] run `make list_translation_updates-alpha` to get updated hashes
    50 
    +      - [ ] `steps/base-browser/git_hash` : update with `HEAD` commit of project's `base-browser` branch
    51 
    +      - [ ] `steps/tor-browser/git_hash` : update with `HEAD` commit of project's `tor-browser` branch
    52 
    +      - [ ] `steps/fenix/git_hash` : update with `HEAD` commit of project's `fenix-torbrowserstringsxml` branch
    53 
    +  - [ ] Update Android-specific build configs
    54 
    +    - [ ] Update `projects/geckoview/config`
    55 
    +      - [ ] `browser_build` : update to match `tor-browser` tag
    56 
    +      - [ ] ***(Optional)*** `var/geckoview_version` : update to latest `$(ESR_VERSION)` if rebased
    57 
    +    - [ ] ***(Optional)*** Update `projects/tor-android-service/config`
    58 
    +      - [ ] `git_hash` : update with `HEAD` commit of project's `main` branch
    59 
    +    - [ ] ***(Optional)*** Update `projects/application-services/config`:
    60 
    +      **NOTE** we don't currently have any of our own patches for this project
    61 
    +      - [ ] `git_hash` : update to appropriate git commit associated with `$(ESR_VERSION)`
    62 
    +    - [ ] ***(Optional)*** Update `projects/firefox-android/config`:
    63 
    +      - [ ] `fenix_version` : update to match alpha `firefox-android` build tag
    64 
    +      - [ ] `browser_branch` : update to match alpha `firefox-android` build tag
    65 
    +    - [ ] Update allowed_addons.json by running (from `tor-browser-build` root):
    66 
    +      - `./tools/fetch_allowed_addons.py > projects/browser/allowed_addons.json`
    67 
    +  - [ ] Update common build configs
    68 
    +    - [ ] Check for NoScript updates here : https://addons.mozilla.org/en-US/firefox/addon/noscript
    69 
    +      - [ ] ***(Optional)*** If new version available, update `noscript` section of `input_files` in `projects/browser/config`
    70 
    +        - [ ] `URL`
    71 
    +        - [ ] `sha256sum`
    72 
    +    - [ ] Check for OpenSSL updates here : https://www.openssl.org/source/
    73 
    +      - [ ] ***(Optional)*** If new 3.0.X version available, update `projects/openssl/config`
    74 
    +        - [ ] `version` : update to next 3.0.X version
    75 
    +        - [ ] `input_files/sha256sum` : update to sha256 sum of source tarball
    76 
    +    - [ ] Check for zlib updates here: https://github.com/madler/zlib/releases
    77 
    +      - [ ] **(Optional)** If new tag available, update `projects/zlib/config`
    78 
    +        - [ ] `version` : update to next release tag
    79 
    +    - [ ] Check for tor updates here : https://gitlab.torproject.org/tpo/core/tor/-/tags
    80 
    +      - [ ] ***(Optional)*** Update `projects/tor/config`
    81 
    +        - [ ] `version` : update to latest `-alpha` tag or release tag if newer (ping dgoulet or ahf if unsure)
    82 
    +    - [ ] Check for go updates here : https://golang.org/dl
    83 
    +      - **NOTE** : Tor Browser Alpha uses the latest Stable major series go version
    84 
    +      - [ ] ***(Optional)*** Update `projects/go/config`
    85 
    +        - [ ] `version` : update go version
    86 
    +        - [ ] `input_files/sha256sum` for `go` : update sha256sum of archive (sha256 sums are displayed on the go download page)
    87 
    +    - [ ] Check for manual updates by running (from `tor-browser-build` root): `./tools/fetch-manual.py`
    88 
    +      - [ ] ***(Optional)*** If new version is available:
    89 
    +        - [ ] Upload the downloaded `manual_$PIPELINEID.zip` file to people.tpo
    90 
    +        - [ ] Update `projects/manual/config`:
    91 
    +          - [ ] Change the `version` to `$PIPELINEID`
    92 
    +          - [ ] Update `sha256sum` in the `input_files` section
    93 
    +          - [ ] ***(Optional)*** Update the URL if you have uploaded to a different people.tpo home
    94 
    +  - [ ] Update `ChangeLog-TBB.txt`
    95 
    +    - [ ] Ensure ChangeLog-TBB.txt is sync'd between alpha and stable branches
    96 
    +    - [ ] Check the linked issues: ask people to check if any are missing, remove the not fixed ones
    97 
    +    - [ ] Run `tools/fetch-changelogs.py $(TOR_BROWSER_VERSION)` or `tools/fetch-changelogs.py '#$(ISSUE_NUMBER)'`
    98 
    +      - Make sure you have `requests` installed (e.g., `apt install python3-requests`)
    99 
    +      - The first time you run this script you will need to generate an access token; the script will guide you
    100 
    +    - [ ] Copy the output of the script to the beginning of `ChangeLog-TBB.txt` and update its output
    101 
    +      - [ ] Version
    102 
    +      - [ ] Browser Name
    103 
    +      - [ ] Release Date
    104 
    +    - [ ] Under `All Platforms` include any version updates for:
    105 
    +      - NoScript
    106 
    +      - tor
    107 
    +      - OpenSSL
    108 
    +      - lyrebird
    109 
    +      - Snowflake
    110 
    +    - [ ] Under `Windows + macOS + Linux` include any version updates for:
    111 
    +      - Firefox
    112 
    +    - [ ] Under `Android` include any version updates for:
    113 
    +      - Geckoview
    114 
    +    - [ ] Under `Windows + Android` include any version updates for:
    115 
    +      - zlib
    116 
    +    - [ ] Under `Build System/All Platforms` include any version updates for:
    117 
    +      - Go
    118 
    +  - [ ] Open MR with above changes
    119 
    +  - [ ] Build the MR after initial review on at least two of:
    120 
    +    - [ ] Tor Project build machine
    121 
    +    - [ ] Mullvad build machine
    122 
    +    - [ ] Local developer machine
    123 
    +  - [ ] Ensure builders have matching builds
    124 
    +  - [ ] Merge
    125 
    +  - [ ] Sign_Tag
    126 
    +    - **NOTE** this must be done by one of:
    127 
    +      - boklm
    128 
    +      - dan
    129 
    +      - ma1
    130 
    +      - pierov
    131 
    +      - richard
    132 
    +    - [ ] Run: `make torbrowser-signtag-alpha`
    133 
    +    - [ ] Push tag to `origin`
    119 134
    120 135 
     </details>
    121 136
    122 137 
     <details>
    123 138 
       <summary>Communications</summary>
    124 139
    125 
    -### notify stakeholders
    140 
    +  ### notify stakeholders
    126 141
    127 
    -  <details>
    128 
    -    <summary>email template</summary>
    142 
    +  - [ ] Email tor-qa mailing list: tor-qa@xxxxxxxxxxxxxxxxxxxx
    143 
    +    <details>
    144 
    +      <summary>email template</summary>
    129 145
    130 
    -      Subject:
    131 
    -      Tor Browser $(TOR_BROWSER_VERION) (Android, Windows, macOS, Linux)
    146 
    +        Subject:
    147 
    +        Tor Browser $(TOR_BROWSER_VERION) (Android, Windows, macOS, Linux)
    132 148
    133 
    -      Body:
    134 
    -      Hello All,
    149 
    +        Body:
    150 
    +        Hello All,
    135 151
    136 
    -      Unsigned Tor Browser $(TOR_BROWSER_VERSION) alpha candidate builds are now available for testing:
    152 
    +        Unsigned Tor Browser $(TOR_BROWSER_VERSION) alpha candidate builds are now available for testing:
    137 153
    138 
    -      - https://tb-build-05.torproject.org/~$(BUILDER)/builds/release/unsigned/$(TOR_BROWSER_VERSION)/
    154 
    +        - https://tb-build-05.torproject.org/~$(BUILDER)/builds/alpha/unsigned/$(TOR_BROWSER_VERSION)/
    139 155
    140 
    -      The full changelog can be found here:
    156 
    +        The full changelog can be found here:
    141 157
    142 
    -      - https://gitlab.torproject.org/tpo/applications/tor-browser-build/-/blob/$(TBB_BUILD_TAG)/ChangeLog.txt
    158 
    +        - https://gitlab.torproject.org/tpo/applications/tor-browser-build/-/raw/$(TBB_BUILD_TAG)/projects/browser/Bundle-Data/Docs-TBB/ChangeLog.txt
    143 159
    144 
    -  </details>
    160 
    +    </details>
    145 161
    146 
    -- [ ] Email tor-qa mailing list: tor-qa@xxxxxxxxxxxxxxxxxxxx
    147 
    -  - ***(Optional)*** Additional information:
    148 
    -    - [ ] Note any new functionality which needs testing
    149 
    -    - [ ] Link to any known issues
    150 
    -- [ ] ***(Optional, only around build/packaging changes)*** Email packagers:
    151 
    -  - Recipients:
    152 
    -    - Tails dev mailing list: tails-dev@xxxxxxxx
    153 
    -    - Guardian Project: nathan@xxxxxxxxxxxxxxxxxxxx
    154 
    -    - torbrowser-launcher: micah@xxxxxxxxxxxxx
    155 
    -    - FreeBSD port: freebsd@xxxxxxxxx <!-- Gitlab user maxfx -->
    156 
    -    - OpenBSD port: caspar@xxxxxxxxxxxxxx <!-- Gitlab user cschutijser -->
    157 
    -  - [ ] Note any changes which may affect packaging/downstream integration
    158 
    -- [ ] Email external partners:
    159 
    -  - ***(Optional, after ESR migration)*** Cloudflare: ask-research@xxxxxxxxxxxxxx
    160 
    -    - **NOTE** :  We need to provide them with updated user agent string so they can update their internal machinery to prevent Tor Browser users from getting so many CAPTCHAs
    162 
    +    - ***(Optional)*** Additional information:
    163 
    +      - [ ] Note any new functionality which needs testing
    164 
    +      - [ ] Link to any known issues
    165 
    +  - [ ] ***(Optional, only around build/packaging changes)*** Email packagers:
    166 
    +    - Recipients:
    167 
    +      - Tails dev mailing list: tails-dev@xxxxxxxx
    168 
    +      - Guardian Project: nathan@xxxxxxxxxxxxxxxxxxxx
    169 
    +      - torbrowser-launcher: micah@xxxxxxxxxxxxx
    170 
    +      - FreeBSD port: freebsd@xxxxxxxxx <!-- Gitlab user maxfx -->
    171 
    +      - OpenBSD port: caspar@xxxxxxxxxxxxxx <!-- Gitlab user cschutijser -->
    172 
    +    - [ ] Note any changes which may affect packaging/downstream integration
    173 
    +  - [ ] Email external partners:
    174 
    +    - ***(Optional, after ESR migration)*** Cloudflare: ask-research@xxxxxxxxxxxxxx
    175 
    +      - **NOTE** :  We need to provide them with updated user agent string so they can update their internal machinery to prevent Tor Browser users from getting so many CAPTCHAs
    161 176
    162 177 
     </details>
    163 178
    164 179 
     <details>
    165 180 
       <summary>Signing</summary>
    166 181
    167 
    -### signing
    168 
    -- **NOTE** : In practice, it's most efficient to have the blog post and website updates ready to merge, since signing doesn't take very long
    169 
    -- [ ] On `$(STAGING_SERVER)`, ensure updated:
    170 
    -  - [ ] `tor-browser-build` is on the right commit: `git tag -v tbb-$(TOR_BROWSER_VERSION)-$(TOR_BROWSER_BUILD_N) && git checkout tbb-$(TOR_BROWSER_VERSION)-$(TOR_BROWSER_BUILD_N)`
    171 
    -  - [ ]  `tor-browser-build/tools/signing/set-config.hosts`
    172 
    -    - `ssh_host_builder` : ssh hostname of machine with unsigned builds
    173 
    -      - **NOTE** : `tor-browser-build` is expected to be in the `$HOME` directory)
    174 
    -    - `ssh_host_linux_signer` : ssh hostname of linux signing machine
    175 
    -    - `ssh_host_macos_signer` : ssh hostname of macOS signing machine
    176 
    -  - [ ] `tor-browser-build/tools/signing/set-config.macos-notarization`
    177 
    -    - `macos_notarization_user` : the email login for a tor notariser Apple Developer account
    178 
    -  - [ ] `set-config.update-responses`
    179 
    -    - `update_responses_repository_dir` : directory where you cloned `git@xxxxxxxxxxxxxxxxxxxxx:tpo/applications/tor-browser-update-responses.git`
    180 
    -  - [ ] `tor-browser-build/tools/signing/set-config.tbb-version`
    181 
    -    - `tbb_version` : tor browser version string, same as `var/torbrowser_version` in `rbm.conf` (examples: `11.5a12`, `11.0.13`)
    182 
    -    - `tbb_version_build` : the tor-browser-build build number (if `var/torbrowser_build` in `rbm.conf` is `buildN` then this value is `N`)
    183 
    -    - `tbb_version_type` : either `alpha` for alpha releases or `release` for stable releases
    184 
    -- [ ] On `$(STAGING_SERVER)` in a separate `screen` session, run the macOS proxy script:
    185 
    -    - `cd tor-browser-build/tools/signing/`
    186 
    -    - `./macos-signer-proxy`
    187 
    -- [ ] On `$(STAGING_SERVER)` in a separate `screen` session, ensure tor daemon is running with SOCKS5 proxy on the default port 9050
    188 
    -- [ ] run do-all-signing script:
    189 
    -    - `cd tor-browser-build/tools/signing/`
    190 
    -    - `./do-all-signing.torbrowser`
    191 
    -- **NOTE**: at this point the signed binaries should have been copied to `staticiforme`
    192 
    -- [ ] Update `staticiforme.torproject.org`:
    193 
    -  - From `screen` session on `staticiforme.torproject.org`:
    194 
    -  - [ ] Static update components : `static-update-component cdn.torproject.org && static-update-component dist.torproject.org`
    195 
    -  - [ ] Enable update responses : `sudo -u tb-release ./deploy_update_responses-alpha.sh`
    196 
    -  - [ ] Remove old release data from following places:
    197 
    -    - **NOTE** : Skip this step if we need to hold on to older versions for some reason (for example, this is an Andoid or Desktop-only release, or if we need to hold back installers in favor of build-to-build updates if there are signing issues, etc)
    198 
    -    - [ ] `/srv/cdn-master.torproject.org/htdocs/aus1/torbrowser`
    199 
    -    - [ ] `/srv/dist-master.torproject.org/htdocs/torbrowser`
    200 
    -  - [ ] Static update components (again) : `static-update-component cdn.torproject.org && static-update-component dist.torproject.org`
    201 
    -- [ ] Publish APKs to Google Play:
    202 
    -  - Log into https://play.google.com/apps/publish
    203 
    -  - Select `Tor Browser (Alpha)` app
    204 
    -  - Navigate to `Release > Production` and click `Create new release` button:
    205 
    -    - Upload the `*.multi.apk` APKs
    206 
    -    - Update Release Name to Tor Browser version number
    207 
    -    - Update Release Notes
    208 
    -    - Next to 'Release notes', click `Copy from a previous release`
    209 
    -    - Edit blog post url to point to most recent blog post
    210 
    -  - Save, review, and configure rollout percentage
    211 
    -    - [ ] 25% rollout when publishing a scheduled update
    212 
    -    - [ ] 100% rollout when publishing a security-driven release
    213 
    -  - [ ] Update rollout percentage to 100% after confirmed no major issues
    182 
    +  ### signing
    183 
    +  - **NOTE** : In practice, it's most efficient to have the blog post and website updates ready to merge, since signing doesn't take very long
    184 
    +  - [ ] Assign this issue to the signer, one of:
    185 
    +    - boklm
    186 
    +    - richard
    187 
    +  - [ ] On `$(STAGING_SERVER)`, ensure updated:
    188 
    +    - [ ] `tor-browser-build` is on the right commit: `git tag -v tbb-$(TOR_BROWSER_VERSION)-$(TOR_BROWSER_BUILD_N) && git checkout tbb-$(TOR_BROWSER_VERSION)-$(TOR_BROWSER_BUILD_N)`
    189 
    +    - [ ]  `tor-browser-build/tools/signing/set-config.hosts`
    190 
    +      - `ssh_host_builder` : ssh hostname of machine with unsigned builds
    191 
    +        - **NOTE** : `tor-browser-build` is expected to be in the `$HOME` directory)
    192 
    +      - `ssh_host_linux_signer` : ssh hostname of linux signing machine
    193 
    +      - `ssh_host_macos_signer` : ssh hostname of macOS signing machine
    194 
    +    - [ ] `tor-browser-build/tools/signing/set-config.macos-notarization`
    195 
    +      - `macos_notarization_user` : the email login for a tor notariser Apple Developer account
    196 
    +    - [ ] `set-config.update-responses`
    197 
    +      - `update_responses_repository_dir` : directory where you cloned `git@xxxxxxxxxxxxxxxxxxxxx:tpo/applications/tor-browser-update-responses.git`
    198 
    +    - [ ] `tor-browser-build/tools/signing/set-config.tbb-version`
    199 
    +      - `tbb_version` : tor browser version string, same as `var/torbrowser_version` in `rbm.conf` (examples: `11.5a12`, `11.0.13`)
    200 
    +      - `tbb_version_build` : the tor-browser-build build number (if `var/torbrowser_build` in `rbm.conf` is `buildN` then this value is `N`)
    201 
    +      - `tbb_version_type` : either `alpha` for alpha releases or `release` for stable releases
    202 
    +  - [ ] On `$(STAGING_SERVER)` in a separate `screen` session, run the macOS proxy script:
    203 
    +      - `cd tor-browser-build/tools/signing/`
    204 
    +      - `./macos-signer-proxy`
    205 
    +  - [ ] On `$(STAGING_SERVER)` in a separate `screen` session, ensure tor daemon is running with SOCKS5 proxy on the default port 9050
    206 
    +  - [ ] run do-all-signing script:
    207 
    +      - `cd tor-browser-build/tools/signing/`
    208 
    +      - `./do-all-signing.torbrowser`
    209 
    +  - **NOTE**: at this point the signed binaries should have been copied to `staticiforme`
    210 
    +  - [ ] Update `staticiforme.torproject.org`:
    211 
    +    - From `screen` session on `staticiforme.torproject.org`:
    212 
    +    - [ ] Static update components : `static-update-component cdn.torproject.org && static-update-component dist.torproject.org`
    213 
    +    - [ ] Enable update responses : `sudo -u tb-release ./deploy_update_responses-alpha.sh`
    214 
    +    - [ ] Remove old release data from following places:
    215 
    +      - **NOTE** : Skip this step if we need to hold on to older versions for some reason (for example, this is an Andoid or Desktop-only release, or if we need to hold back installers in favor of build-to-build updates if there are signing issues, etc)
    216 
    +      - [ ] `/srv/cdn-master.torproject.org/htdocs/aus1/torbrowser`
    217 
    +      - [ ] `/srv/dist-master.torproject.org/htdocs/torbrowser`
    218 
    +    - [ ] Static update components (again) : `static-update-component cdn.torproject.org && static-update-component dist.torproject.org`
    219 
    +  - [ ] Publish APKs to Google Play:
    220 
    +    - Log into https://play.google.com/apps/publish
    221 
    +    - Select `Tor Browser (Alpha)` app
    222 
    +    - Navigate to `Release > Production` and click `Create new release` button:
    223 
    +      - Upload the `*.multi.apk` APKs
    224 
    +      - Update Release Name to Tor Browser version number
    225 
    +      - Update Release Notes
    226 
    +      - Next to 'Release notes', click `Copy from a previous release`
    227 
    +      - Edit blog post url to point to most recent blog post
    228 
    +    - Save, review, and configure rollout percentage
    229 
    +      - [ ] 25% rollout when publishing a scheduled update
    230 
    +      - [ ] 100% rollout when publishing a security-driven release
    231 
    +    - [ ] Update rollout percentage to 100% after confirmed no major issues
    214 232
    215 233 
     </details>
    216 234
    ... ... @@ -219,83 +237,86 @@ Tor Browser Alpha (and Nightly) are on the `main` branch
    219 237
    220 238 
       <details>
    221 239 
         <summary>Check whether the .exe files got properly signed and timestamped</summary>
    222 
    -    ```
    223 
    -    # Point OSSLSIGNCODE to your osslsigncode binary
    224 
    -    pushd tor-browser-build/${channel}/signed/$TORBROWSER_VERSION
    225 
    -    OSSLSIGNCODE=/path/to/osslsigncode
    226 
    -    ../../../tools/authenticode_check.sh
    227 
    -    popd
    228 
    -    ```
    240 
    +
    241 
    +```bash
    242 
    +# Point OSSLSIGNCODE to your osslsigncode binary
    243 
    +pushd tor-browser-build/${channel}/signed/$TORBROWSER_VERSION
    244 
    +OSSLSIGNCODE=/path/to/osslsigncode
    245 
    +../../../tools/authenticode_check.sh
    246 
    +popd
    247 
    +```
    248 
    +
    229 249 
       </details>
    230 250 
       <details>
    231 251 
         <summary>Check whether the MAR files got properly signed</summary>
    232 
    -    ```
    233 
    -    # Point NSSDB to your nssdb containing the mar signing certificate
    234 
    -    # Point SIGNMAR to your signmar binary
    235 
    -    # Point LD_LIBRARY_PATH to your mar-tools directory
    236 
    -    pushd tor-browser-build/${channel}/signed/$TORBROWSER_VERSION
    237 
    -    NSSDB=/path/to/nssdb
    238 
    -    SIGNMAR=/path/to/mar-tools/signmar
    239 
    -    LD_LIBRARY_PATH=/path/to/mar-tools/
    240 
    -    ../../../tools/marsigning_check.sh
    241 
    -    popd
    242 
    -    ```
    252 
    +
    253 
    +```bash
    254 
    +# Point NSSDB to your nssdb containing the mar signing certificate
    255 
    +# Point SIGNMAR to your signmar binary
    256 
    +# Point LD_LIBRARY_PATH to your mar-tools directory
    257 
    +pushd tor-browser-build/${channel}/signed/$TORBROWSER_VERSION
    258 
    +NSSDB=/path/to/nssdb
    259 
    +SIGNMAR=/path/to/mar-tools/signmar
    260 
    +LD_LIBRARY_PATH=/path/to/mar-tools/
    261 
    +../../../tools/marsigning_check.sh
    262 
    +popd
    263 
    +```
    264 
    +
    243 265 
       </details>
    244 266 
     </details>
    245 267
    246 268 
     <details>
    247 269 
       <summary>Publishing</summary>
    248 270
    249 
    -### website: https://gitlab.torproject.org/tpo/web/tpo.git
    250 
    -- [ ] `databags/versions.ini` : Update the downloads versions
    251 
    -    - `torbrowser-stable/version` : sort of a catch-all for latest stable version
    252 
    -    - `torbrowser-alpha/version` : sort of a catch-all for latest stable version
    253 
    -    - `torbrowser-*-stable/version` : platform-specific stable versions
    254 
    -    - `torbrowser-*-alpha/version` : platform-specific alpha versions
    255 
    -    - `tor-stable`,`tor-alpha` : set by tor devs, do not touch
    256 
    -- [ ] Push to origin as new branch, open 'Draft :' MR
    257 
    -- [ ] Remove `Draft:` from MR once signed-packages are uploaded
    258 
    -- [ ] Merge
    259 
    -- [ ] Publish after CI passes and builds are published
    260 
    -
    261 
    -### blog: https://gitlab.torproject.org/tpo/web/blog.git
    262 
    -
    263 
    -- [ ] Duplicate previous Stable or Alpha release blog post as appropriate to new directory under `content/blog/new-release-tor-browser-$(TOR_BROWSER_VERSION)` and update with info on release :
    264 
    -    - [ ] Run `tools/signing/create-blog-post` which should create the new blog post from a template (edit set-config.blog to set you local blog directory)
    265 
    -    - [ ] Update Tor Browser version numbers
    266 
    -    - [ ] Note any ESR rebase
    267 
    -    - [ ] Link to any Firefox security updates from ESR upgrade
    268 
    -    - [ ] Link to any Android-specific security backports
    269 
    -    - [ ] Note any updates to :
    270 
    -      - tor
    271 
    -      - OpenSSL
    272 
    -      - NoScript
    273 
    -    - [ ] Convert ChangeLog.txt to markdown format used here by :
    274 
    -      - `tor-browser-build/tools/changelog-format-blog-post`
    275 
    -- [ ] Push to origin as new branch, open `Draft:` MR
    276 
    -- [ ] Remove `Draft:` from MR once signed-packages are uploaded
    277 
    -- [ ] Merge
    278 
    -- [ ] Publish after CI passes and website has been updated
    279 
    -
    280 
    -### tor-announce mailing list
    281 
    -  <details>
    282 
    -    <summary>email template</summary>
    283 
    -
    284 
    -      Subject:
    285 
    -      New Release: Tor Browser $(TOR_BROWSER_VERSION) (Android, Windows, macOS, Linux)
    286 
    -
    287 
    -      Body:
    288 
    -      Hi everyone,
    289 
    -
    290 
    -      Tor Browser $(TOR_BROWSER_VERSION) has now been published for all platforms. For details please see our blog post:
    291 
    -
    292 
    -      - $(BLOG_POST_URL)
    293 
    -
    294 
    -  </details>
    295 
    -
    296 
    -- [ ] Email tor-announce mailing list: tor-announce@xxxxxxxxxxxxxxxxxxxx
    297 
    -  - **(Optional)** Additional information:
    298 
    -    - [ ] Link to any known issues
    271 
    +  ### website: https://gitlab.torproject.org/tpo/web/tpo.git
    272 
    +  - [ ] `databags/versions.ini` : Update the downloads versions
    273 
    +      - `torbrowser-stable/version` : sort of a catch-all for latest stable version
    274 
    +      - `torbrowser-alpha/version` : sort of a catch-all for latest stable version
    275 
    +      - `torbrowser-*-stable/version` : platform-specific stable versions
    276 
    +      - `torbrowser-*-alpha/version` : platform-specific alpha versions
    277 
    +      - `tor-stable`,`tor-alpha` : set by tor devs, do not touch
    278 
    +  - [ ] Push to origin as new branch, open 'Draft :' MR
    279 
    +  - [ ] Remove `Draft:` from MR once signed-packages are uploaded
    280 
    +  - [ ] Merge
    281 
    +  - [ ] Publish after CI passes and builds are published
    282 
    +
    283 
    +  ### blog: https://gitlab.torproject.org/tpo/web/blog.git
    284 
    +  - [ ] Duplicate previous Stable or Alpha release blog post as appropriate to new directory under `content/blog/new-release-tor-browser-$(TOR_BROWSER_VERSION)` and update with info on release :
    285 
    +      - [ ] Run `tools/signing/create-blog-post` which should create the new blog post from a template (edit set-config.blog to set you local blog directory)
    286 
    +      - [ ] Update Tor Browser version numbers
    287 
    +      - [ ] Note any ESR rebase
    288 
    +      - [ ] Link to any Firefox security updates from ESR upgrade
    289 
    +      - [ ] Link to any Android-specific security backports
    290 
    +      - [ ] Note any updates to :
    291 
    +        - tor
    292 
    +        - OpenSSL
    293 
    +        - NoScript
    294 
    +      - [ ] Convert ChangeLog-TBB.txt to markdown format used here by :
    295 
    +        - `tor-browser-build/tools/changelog-format-blog-post`
    296 
    +  - [ ] Push to origin as new branch, open `Draft:` MR
    297 
    +  - [ ] Remove `Draft:` from MR once signed-packages are uploaded
    298 
    +  - [ ] Merge
    299 
    +  - [ ] Publish after CI passes and website has been updated
    300 
    +
    301 
    +  ### tor-announce mailing list
    302 
    +  - [ ] Email tor-announce mailing list: tor-announce@xxxxxxxxxxxxxxxxxxxx
    303 
    +    <details>
    304 
    +      <summary>email template</summary>
    305 
    +
    306 
    +        Subject:
    307 
    +        New Release: Tor Browser $(TOR_BROWSER_VERSION) (Android, Windows, macOS, Linux)
    308 
    +
    309 
    +        Body:
    310 
    +        Hi everyone,
    311 
    +
    312 
    +        Tor Browser $(TOR_BROWSER_VERSION) has now been published for all platforms. For details please see our blog post:
    313 
    +
    314 
    +        - $(BLOG_POST_URL)
    315 
    +
    316 
    +    </details>
    317 
    +
    318 
    +    - **(Optional)** Additional information:
    319 
    +      - [ ] Link to any known issues
    299 320
    300 321 
     </details>
    301 322

    • —
    View it on GitLab.
    You're receiving this email because of your account on gitlab.torproject.org. Manage all notifications · Help 

    _______________________________________________
tor-commits mailing list
tor-commits@xxxxxxxxxxxxxxxxxxxx
https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-commits