[Author Prev][Author Next][Thread Prev][Thread Next][Author Index][Thread Index]

[tor-commits] [Git][tpo/applications/tor-browser][tor-browser-102.10.0esr-12.5-1] fixup! Bug 41649: Create rebase and security backport gitlab issue templates

Title: GitLab

Richard Pospesel pushed to branch tor-browser-102.10.0esr-12.5-1 at The Tor Project / Applications / Tor Browser

Commits:

  • 0db7a4bd
    by Richard Pospesel at 2023-04-23T11:51:30+00:00 
    fixup! Bug 41649: Create rebase and security backport gitlab issue templates

3 changed files:

Changes:

  • .gitlab/issue_templates/Backport Android Security Fixes.md
    ... ... @@ -4,6 +4,7 @@
    4 4 
       - example : `102.8.0`
    5 5 
     - `$(RR_VERSION)` : the Mozilla defined Rapid-Release version; Tor Browser for Android is based off of the `$(ESR_VERSION)`, but Mozilla's Firefox for Android is based off of the `$(RR_VERSION)` so we need to keep track of security vulnerabilities to backport from the monthly Rapid-Release train and our frozen ESR train.
    6 6 
       - example: `110`
    7 
    +- `$(PROJECT_NAME)` : the name of the browser project, either `base-browser` or `tor-browser`
    7 8 
     - `$(TOR_BROWSER_MAJOR)` : the Tor Browser major version
    8 9 
       - example : `12`
    9 10 
     - `$(TOR_BROWSER_MINOR)` : the Tor Browser minor version
    ... ... @@ -12,7 +13,7 @@
    12 13 
       - example : `build1`
    13 14 
     </details>
    14 15
    15 
    -**NOTE:** It is assumed the `tor-browser` rebase has already happened and there exists a `build1` build tag for both `base-browser` and `tor-browser`
    16 
    +**NOTE:** It is assumed the `tor-browser` rebase (stable and alpha) has already happened and there exists a `build1` build tags for both `base-browser` and `tor-browser` (stable and alpha)
    16 17
    17 18 
     ### **Bookkeeping**
    18 19
    ... ... @@ -36,26 +37,53 @@
    36 37 
       - Create link to the CVE on [mozilla.org](https://www.mozilla.org/en-US/security/advisories/)
    37 38 
         - example: https://www.mozilla.org/en-US/security/advisories/mfsa2023-05/#CVE-2023-25740
    38 39 
       - Create link to the associated Bugzilla issues (found in the CVE description)
    39 
    -  - Create a link to the relevant `gecko-dev`/other commit hashes which need to be backported OR a brief justification for why the fix does not need to be backported
    40 
    +  - Create links to the relevant `gecko-dev`/other commit hashes which need to be backported OR a brief justification for why the fix does not need to be backported
    40 41 
         - To find the `gecko-dev` version of a `mozilla-central`, search for a unique string in the relevant `mozilla-central` commit message in the `gecko-dev/release` branch log.
    41 42 
         - **NOTE:** This process is unfortunately somewhat poorly defined/ad-hoc given the general variation in how Bugzilla issues are labeled and resolved. In general this is going to involve a bit of hunting to identify needed commits or determining whether or not the fix is relevant.
    42 43
    44 
    +### CVEs
    45 
    +
    46 
    +<!-- CVE Resolution Template, foreach CVE to investigate add an entry in the form:
    47 
    +- [ ] https://www.mozilla.org/en-US/security/advisories/mfsaYYYY-NN/#CVE-YYYY-XXXXX // CVE description
    48 
    +  - https://bugzilla.mozilla.org/show_bug.cgi?id=NNNNNN // Bugzilla issue
    49 
    +  - **Note** : Any relevant info about this fix, justification for why it is not necessary, etc
    50 
    +  - **Patches**
    51 
    +    - firefox-android : https://link.to/relevant/patch
    52 
    +    - firefox : https://link.to/relevant/patch
    53 
    + -->
    43 54
    44 55 
     ### **tor-browser** : https://gitlab.torproject.org/tpo/applications/tor-browser.git
    45 56 
     - [ ] Backport any Android-specific security fixes from Firefox rapid-release
    46 
    -  - [ ] Sign/Tag commit:
    47 
    -    - Tag : `tor-browser-$(ESR_VERSION)-$(TOR_BROWSER_MAJOR).$(TOR_BROWSER_MINOR)-1-$(BUILD_N)`
    57 
    +  - [ ] Backport patches to `tor-browser` stable branch
    58 
    +  - [ ] Open MR
    59 
    +  - [ ] Merge
    60 
    +  - [ ] Rebase patches onto:
    61 
    +    - [ ] `base-browser` stable
    62 
    +    - [ ] `tor-browser` alpha
    63 
    +    - [ ] `base-browser` alpha
    64 
    +  - [ ] Sign/Tag commits:
    65 
    +    - Tag : `$(PROJECT_NAME)-$(ESR_VERSION)-$(TOR_BROWSER_MAJOR).$(TOR_BROWSER_MINOR)-1-$(BUILD_N)`
    48 66 
         - Message: `Tagging $(BUILD_N) for $(ESR_VERSION)-based alpha)`
    49 
    -  - [ ] Push tag to `origin`
    67 
    +    - [ ] `base-browser` stable
    68 
    +    - [ ] `tor-browser` stable
    69 
    +    - [ ] `base-browser` alpha
    70 
    +    - [ ] `tor-browser` alpha
    71 
    +  - [ ] Push tags to `origin`
    50 72 
     **OR**
    51 73 
     - [ ] No backports
    52 74
    53 75 
     ### **application-services** : *TODO: we will need to setup a gitlab copy of this repo that we can apply security backports to if there are ever any security issues here*
    54 76 
     - [ ] Backport any Android-specific security fixes from Firefox rapid-release
    55 
    -  - [ ] Sign/Tag commit:
    77 
    +  - [ ] Backport patches to `application-services` stable branch
    78 
    +  - [ ] Open MR
    79 
    +  - [ ] Merge
    80 
    +  - [ ] Rebase patches onto `application-services` alpha
    81 
    +  - [ ] Sign/Tag commits:
    56 82 
         - Tag : `application-services-$(ESR_VERSION)-$(TOR_BROWSER_MAJOR).$(TOR_BROWSER_MINOR)-1-$(BUILD_N)`
    57 83 
         - Message: `Tagging $(BUILD_N) for $(ESR_VERSION)-based alpha`
    58 
    -  - [ ] Push tag to `origin`
    84 
    +    - [ ] `application-services` stable
    85 
    +    - [ ] `application-services` alpha
    86 
    +  - [ ] Push tags to `origin`
    59 87 
       **OR**
    60 88 
     - [ ] No backports
    61 89
    ... ... @@ -63,10 +91,16 @@
    63 91 
     ### **android-components** : https://gitlab.torproject.org/tpo/applications/android-components.git
    64 92 
     - [ ] Backport any Android-specific security fixes from Firefox rapid-release
    65 93 
       - **NOTE**: Since November 2022, this repo has been merged with `fenix` into a singular `firefox-android` repo: https://github.com/mozilla-mobile/firefox-android. Any backport will require a patch rewrite to apply to our legacy `android-components` project.
    66 
    -  - [ ] Sign/Tag commit:
    94 
    +  - [ ] Backport patches to `android-components` stable branch
    95 
    +  - [ ] Open MR
    96 
    +  - [ ] Merge
    97 
    +  - [ ] Rebase patches onto `android-components` alpha
    98 
    +  - [ ] Sign/Tag commits:
    67 99 
         - Tag : `android-components-$(ESR_VERSION)-$(TOR_BROWSER_MAJOR).$(TOR_BROWSER_MINOR)-1-$(BUILD_N)`
    68 100 
         - Message: `Tagging $(BUILD_N) for $(ESR_VERSION)-based alpha)`
    69 
    -  - [ ] Push tag to `origin`
    101 
    +    - [ ] `android-components` stable
    102 
    +    - [ ] `android-components` alpha
    103 
    +  - [ ] Push tags to `origin`
    70 104 
     **OR**
    71 105 
     - [ ] No backports
    72 106
    ... ... @@ -74,15 +108,17 @@
    74 108 
     ### **fenix** : https://gitlab.torproject.org/tpo/applications/fenix.git
    75 109 
     - [ ] Backport any Android-specific security fixes from Firefox rapid-release
    76 110 
       - **NOTE**: Since February 2023, this repo has been merged with `android-components` into a singular `firefox-android` repo: https://github.com/mozilla-mobile/firefox-android. Any backport will require a patch rewrite to apply to our legacy `fenix` project.
    77 
    -  - [ ] Sign/Tag commit:
    111 
    +  - [ ] Backport patches to `fenix` stable branch
    112 
    +  - [ ] Open MR
    113 
    +  - [ ] Merge
    114 
    +  - [ ] Rebase patches onto `fenix` alpha
    115 
    +  - [ ] Sign/Tag commits:
    78 116 
         - Tag : `tor-browser-$(ESR_VERSION)-$(TOR_BROWSER_MAJOR).$(TOR_BROWSER_MINOR)-1-$(BUILD_N)`
    79 117 
         - Message: `Tagging $(BUILD_N) for $(ESR_VERSION)-based alpha)`
    80 
    -  - [ ] Push tag to `origin`
    118 
    +    - [ ] `fenix` stable
    119 
    +    - [ ] `fenix` alpha
    120 
    +  - [ ] Push tags to `origin`
    81 121 
     **OR**
    82 122 
     - [ ] No backports
    83 123
    84 
    -### CVEs
    85 
    -
    86 
    -<!-- Create CVE resolution here -->
    87 
    -
    88 124 
     /confidential

  • .gitlab/issue_templates/Rebase Browser - Alpha.md
    ... ... @@ -27,14 +27,46 @@
    27 27
    28 28 
     - [ ] Link this issue to the appropriate [Release Prep](https://gitlab.torproject.org/tpo/applications/tor-browser-build/-/issues/?sort=updated_desc&state=opened&label_name%5B%5D=Release%20Prep) issue.
    29 29
    30 
    +### Update Branch Protection Rules
    31 
    +
    32 
    +- [ ] In [Repository Settings](https://gitlab.torproject.org/tpo/applications/tor-browser/-/settings/repository):
    33 
    +  - [ ] Remove previous alpha `base-browser` and `tor-browser` branch protection rules (this will prevent pushing new changes to the branches being rebased)
    34 
    +  - [ ] Create new `base-browser` and `tor-browser` branch protection rule:
    35 
    +    - **Branch**: `*-$(ESR_VERSION)esr-$(BROWSER_MAJOR).$(BROWSER_MINOR)-1*`
    36 
    +      - example: `*-102.8.0esr-12.5-1*`
    37 
    +    - **Allowed to merge**: `Maintainers`
    38 
    +    - **Allowed to push and merge**: `Maintainers`
    39 
    +    - **Allowed to force push**: `false`
    40 
    +
    41 
    +### **Create New Branches**
    42 
    +
    43 
    +- [ ] Create new alpha `base-browser` branch from Firefox mercurial tag (found during the stable rebase)
    44 
    +  - branch name in the form: `base-browser-$(ESR_VERSION)esr-$(BROWSER_MAJOR).$(BROWSER_MINOR)-1`
    45 
    +  - example: `base-browser-102.8.0esr-12.5-1`
    46 
    +- [ ] Create new alpha `tor-browser` branch from Firefox mercurial tag
    47 
    +  - branch name in the form: `tor-browser-$(ESR_VERSION)esr-$(BROWSER_MAJOR).$(BROWSER_MINOR)-1`
    48 
    +  - example: `tor-browser-102.8.0esr-12.5-1`
    49 
    +- [ ] Push new `base-browser` branch to `origin`
    50 
    +- [ ] Push new `tor-browser` branch to `origin`
    51 
    +
    30 52 
     ### **Rebase base-browser**
    31 53
    32 
    -- [ ] Checkout a new branch for the `base-browser` rebase
    54 
    +- [ ] Checkout a new local branch for the `base-browser` rebase
    33 55 
       - example: `git branch base-browser-rebase FIREFOX_102_8_0esr_BUILD1`
    34 56 
     - [ ] Cherry-pick the previous `base-browser` commits up to `base-browser`'s `build1` tag onto new `base-browser` rebase branch
    35 57 
       - example: `git cherry-pick FIREFOX_102_7_0esr_BUILD1..base-browser-102.7.0esr-12.5-1-build1`
    36 58 
     - [ ] Rebase and autosquash these cherry-picked commits
    37 59 
       - example: `git rebase --autosquash --interactive FIREFOX_102_8_0esr_BUILD1 HEAD`
    60 
    +  - [ ] **(Optional)** Patch reordering
    61 
    +    - Relocate new `base-browser` patches in the patch-set to enforce this rough thematic ordering:
    62 
    +      - **MOZILLA BACKPORTS** - official Firefox patches we have backported to our ESR branch: Android-specific security updates, critical bug fixes, worthwhile features, etc
    63 
    +      - **MOZILLA REVERTS** - revert commits of official Firefox patches
    64 
    +      - **UPLIFT CANDIDATES** - patches which stand on their own and should be uplifted to `mozilla-central`
    65 
    +      - **BUILD CONFIGURATION** - tools/scripts, gitlab templates, etc
    66 
    +      - **BROWSER CONFIGURATION** - branding, mozconfigs, preference overrides, etc
    67 
    +      - **SECURITY PATCHES** - security improvements, hardening, etc
    68 
    +      - **PRIVACY PATCHES** - fingerprinting, linkability, proxy bypass, etc
    69 
    +      - **FEATURES** - new functionality: updater, UX, letterboxing, security level, add-on integration, etc
    38 70 
     - [ ] Cherry-pick remainder of patches after the `build1` tag
    39 71 
       - example: `git cherry-pick base-browser-102.7.0esr-12.5-1-build1 origin/base-browser-102.7.0esr-12.5-1`
    40 72 
     - [ ] Compare patch sets to ensure nothing *weird* happened during conflict resolution:
    ... ... @@ -61,15 +93,30 @@
    61 93 
       - example: `git cherry-pick base-browser-102.7.0esr-12.5-1-build1..tor-browser-102.7.0esr-12.5-1-build1`
    62 94 
     - [ ] Rebase and autosquash these cherry-picked commits (from the last new `base-browser` commit to `HEAD`)
    63 95 
       - example: `git rebase --autosquash --interactive base-browser-102.8.0esr-12.5-1-build1 HEAD`
    96 
    +  - [ ] **(Optional)** Patch reordering
    97 
    +    - Relocate new `tor-browser` patches in the patch-set to enforce this rough thematic ordering:
    98 
    +      - **BUILD CONFIGURATION** - tools/scripts, gitlab templates, etc
    99 
    +      - **BROWSER CONFIGURATION** - branding, mozconfigs, preference overrides, etc
    100 
    +      - **UPDATER PATCHES** - updater tweaks, signing keys, etc
    101 
    +      - **SECURITY PATCHES** - non tor-dependent security improvements, hardening, etc
    102 
    +      - **PRIVACY PATCHES** - non tor-dependent fingerprinting, linkability, proxy bypass, etc
    103 
    +      - **FEAURES** - non tor-dependent features
    104 
    +      - **TOR INTEGRATION** - legacy tor-launcher/torbutton, tor modules, bootstrapping, etc
    105 
    +      - **TOR SECURITY PATCHES** - tor-specific security improvements
    106 
    +      - **TOR PRIVACY PATCHES** - tor-specific privacy improvements
    107 
    +      - **TOR FEATURES** - new tor-specific functionality: manual, onion-location, onion service client auth, etc
    64 108 
     - [ ] Cherry-pick remainder of patches after the last `buildN` tag
    65 109 
       - example: `git cherry-pick base-browser-102.7.0esr-12.5-1-build1..origin/tor-browser-102.7.0esr-12.5-1`
    110 
    +- [ ] Rebase and autosquash again (from the last new `base-browser` commit to `HEAD`), this time replacing all `fixup` and `squash` commands with `pick`. The goal here is to have all of the `fixup` and `squash` commits beside the commit which they modify.
    111 
    +  - example: `git rebase --autosquash --interactive base-browser-102.8.0esr-12.5-1-build1 HEAD`
    112 
    +  - **NOTE**: Do not allow `fixup` or `squash` commands here!
    66 113 
     - [ ] Compare patch sets to ensure nothing *weird* happened during conflict resolution:
    67 114 
       - [ ] diff of diffs:
    68 115 
         -  Do the diff between `current_patchset.diff` and `rebased_patchset.diff` with your preferred difftool and look at differences on lines that starts with + or -
    69 116 
         - `git diff $(ESR_TAG_PREV)..$(BROWSER_BRANCH_PREV) > current_patchset.diff`
    70 117 
         - `git diff $(ESR_TAG)..$(BROWSER_BRANCH) > rebased_patchset.diff`
    71 118 
         - diff `current_patchset.diff` and `rebased_patchset.diff`
    72 
    -      - If everything went correctly, the only lines which should differ should be the lines starting with `index abc123...def456`
    119 
    +      - If everything went correctly, the only lines which should differ should be the lines starting with `index abc123...def456` (unless the previous `base-browser` branch includes changes not included in the previous `tor-browser` branch)
    73 120 
       - [ ] rangediff: `git range-diff $(ESR_TAG_PREV)..$(TOR_BROWSER_BRANCH_PREV) $(ESR_TAG)..HEAD`
    74 121 
         - example: `git range-dif FIREFOX_102_7_0esr_BUILD1..origin/tor-browser-102.7.0esr-12.5-1 FIREFOX_102_8_0esr_BUILD1..HEAD`
    75 122 
     - [ ] Open MR for the `tor-browser` rebase

  • .gitlab/issue_templates/Rebase Browser - Stable.md
    ... ... @@ -25,6 +25,17 @@
    25 25
    26 26 
     - [ ] Link this issue to the appropriate [Release Prep](https://gitlab.torproject.org/tpo/applications/tor-browser-build/-/issues/?sort=updated_desc&state=opened&label_name%5B%5D=Release%20Prep) issue.
    27 27
    28 
    +### Update Branch Protection Rules
    29 
    +
    30 
    +- [ ] In [Repository Settings](https://gitlab.torproject.org/tpo/applications/tor-browser/-/settings/repository):
    31 
    +  - [ ] Remove previous stable `base-browser` and `tor-browser` branch protection rules (this will prevent pushing new changes to the branches being rebased)
    32 
    +  - [ ] Create new `base-browser` and `tor-browser` branch protection rule:
    33 
    +    - **Branch**: `*-$(ESR_VERSION)esr-$(BROWSER_MAJOR).$(BROWSER_MINOR)-1*`
    34 
    +      - example: `*-102.8.0esr-12.0-1*`
    35 
    +    - **Allowed to merge**: `Maintainers`
    36 
    +    - **Allowed to push and merge**: `Maintainers`
    37 
    +    - **Allowed to force push**: `false`
    38 
    +
    28 39 
     ### **Identify the Firefox Tagged Commit and Create New Branches**
    29 40
    30 41 
     - [ ] Find the Firefox mercurial tag here : https://hg.mozilla.org/releases/mozilla-esr102/tags
    ... ... @@ -48,7 +59,7 @@
    48 59
    49 60 
     ### **Rebase base-browser**
    50 61
    51 
    -- [ ] Checkout a new branch for the `base-browser` rebase
    62 
    +- [ ] Checkout a new local branch for the `base-browser` rebase
    52 63 
       - example: `git branch base-browser-rebase FIREFOX_102_8_0esr_BUILD1`
    53 64 
     - [ ] Cherry-pick the previous `base-browser` commits up to `base-browser`'s `build1` tag onto new `base-browser` rebase branch
    54 65 
       - example: `git cherry-pick FIREFOX_102_7_0esr_BUILD1..base-browser-102.7.0esr-12.0-1-build1`
    ... ... @@ -72,6 +83,7 @@
    72 83 
       - Message : `Tagging build1 for $(ESR_VERSION)esr-based stable`
    73 84 
     - [ ] Push tag to `origin`
    74 85
    86 
    +
    75 87 
     ### **Rebase tor-browser**
    76 88
    77 89 
     - [ ] Checkout a new branch for the `tor-browser` rebase starting from the `base-browser` `build1` tag
    ... ... @@ -88,7 +100,7 @@
    88 100 
         - `git diff $(ESR_TAG_PREV)..$(BROWSER_BRANCH_PREV) > current_patchset.diff`
    89 101 
         - `git diff $(ESR_TAG)..$(BROWSER_BRANCH) > rebased_patchset.diff`
    90 102 
         - diff `current_patchset.diff` and `rebased_patchset.diff`
    91 
    -      - If everything went correctly, the only lines which should differ should be the lines starting with `index abc123...def456`
    103 
    +      - If everything went correctly, the only lines which should differ should be the lines starting with `index abc123...def456` (unless the previous `base-browser` branch includes changes not included in the previous `tor-browser` branch)
    92 104 
       - [ ] rangediff: `git range-diff $(ESR_TAG_PREV)..$(TOR_BROWSER_BRANCH_PREV) $(ESR_TAG)..HEAD`
    93 105 
         - example: `git range-dif FIREFOX_102_7_0esr_BUILD1..origin/tor-browser-102.7.0esr-12.0-1 FIREFOX_102_8_0esr_BUILD1..HEAD`
    94 106 
     - [ ] Open MR for the `tor-browser` rebase
    ... ... @@ -97,4 +109,3 @@
    97 109 
       - Tag : `tor-browser-$(ESR_VERSION)esr-$(BROWSER_MAJOR).$(BROWSER_MINOR)-1-build1`
    98 110 
       - Message : `Tagging build1 for $(ESR_VERSION)esr-based stable`
    99 111 
     - [ ] Push tag to `origin`
    100 
    -

    • —
    View it on GitLab.
    You're receiving this email because of your account on gitlab.torproject.org. Manage all notifications · Help 

    _______________________________________________
tor-commits mailing list
tor-commits@xxxxxxxxxxxxxxxxxxxx
https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-commits