[Author Prev][Author Next][Thread Prev][Thread Next][Author Index][Thread Index]

[tor-commits] [Git][tpo/applications/tor-browser-build][main] Update Mullvad and Tor Browser Release Prep issue templates

Title: GitLab

richard pushed to branch main at The Tor Project / Applications / tor-browser-build

Commits:

  • f1811496
    by Richard Pospesel at 2024-02-21T11:55:05+00:00 
    Update Mullvad and Tor Browser Release Prep issue templates

4 changed files:

Changes:

  • .gitlab/issue_templates/Release Prep - Mullvad Browser Alpha.md
    ... ... @@ -27,172 +27,178 @@
    27 27 
     </details>
    28 28
    29 29 
     **NOTE** It is assumed that the `tor-browser` alpha rebase and security backport tasks have been completed
    30 
    +
    30 31 
     **NOTE** This can/is often done in conjunction with the equivalent Tor Browser release prep issue
    31 32
    32 33 
     <details>
    33 34 
       <summary>Building</summary>
    34 35
    35 
    -  ### tor-browser-build: https://gitlab.torproject.org/tpo/applications/tor-browser-build.git
    36 
    -  Mullvad Browser Alpha (and Nightly) are on the `main` branch
    37 
    -
    38 
    -  - [ ] Update `rbm.conf`
    39 
    -    - [ ] `var/torbrowser_version` : update to next version
    40 
    -    - [ ] `var/torbrowser_build` : update to `$(MULLVAD_BROWSER_BUILD_N)`
    41 
    -    - [ ] `var/torbrowser_incremental_from` : update to previous Desktop version
    42 
    -      - **NOTE**: We try to build incrementals for the previous 3 desktop versions except in the case of a watershed update
    43 
    -      - **IMPORTANT**: Really *actually* make sure this is the previous Desktop version or else the `make mullvadbrowser-incrementals-*` step will fail
    44 
    -  - [ ] Update build configs
    45 
    -    - [ ] Update `projects/firefox/config`
    46 
    -      - [ ] `browser_build` : update to match `mullvad-browser` tag
    47 
    -      - [ ] ***(Optional)*** `var/firefox_platform_version` : update to latest `$(ESR_VERSION)` if rebased
    48 
    -    - [ ] Update `projects/translation/config`:
    49 
    -      - [ ] run `make list_translation_updates-alpha` to get updated hashes
    50 
    -      - [ ] `steps/base-browser/git_hash` : update with `HEAD` commit of project's `base-browser` branch
    51 
    -      - [ ] `steps/mullvad-browser/git_hash` : update with `HEAD` commit of project's `mullvad-browser` branch
    52 
    -  - [ ] Update common build configs
    53 
    -    - [ ] Check for NoScript updates here : https://addons.mozilla.org/en-US/firefox/addon/noscript
    54 
    -      - [ ] ***(Optional)*** If new version available, update `noscript` section of `input_files` in `projects/browser/config`
    55 
    -        - [ ] `URL`
    56 
    -        - [ ] `sha256sum`
    57 
    -    - [ ] Check for uBlock-origin updates here : https://addons.mozilla.org/en-US/firefox/addon/ublock-origin/
    58 
    -      - [ ] ***(Optional)*** If new version available, update `ublock-origin` section of `input_files` in `projects/browser/config`
    59 
    -        - [ ] `URL`
    60 
    -        - [ ] `sha256sum`
    61 
    -    - [ ] Check for Mullvad Privacy Companion updates here : https://github.com/mullvad/browser-extension/releases
    62 
    -      - [ ] ***(Optional)*** If new version available, update `mullvad-extension` section of `input_files` in `projects/browser/config`
    63 
    -        - [ ] `URL`
    64 
    -        - [ ] `sha256sum`
    65 
    -    - [ ] Update `ChangeLog-MB.txt`
    66 
    -      - [ ] Ensure `ChangeLog-MB.txt` is sync'd between alpha and stable branches
    67 
    -      - [ ] Check the linked issues: ask people to check if any are missing, remove the not fixed ones
    68 
    -      - [ ] Run `tools/fetch-changelogs.py $(ISSUE_NUMBER) --date $date $updateArgs`
    69 
    -        - Make sure you have `requests` installed (e.g., `apt install python3-requests`)
    70 
    -        - The first time you run this script you will need to generate an access token; the script will guide you
    71 
    -        - `$updateArgs` should be these arguments, depending on what you actually updated:
    72 
    -          - [ ] `--firefox`
    73 
    -          - [ ] `--no-script`
    74 
    -          - [ ] `--ublock`
    75 
    -          - E.g., `tools/fetch-changelogs.py 41029 --date 'December 19 2023' --firefox 115.6.0esr --no-script 11.4.29 --ublock 1.54.0`
    76 
    -        - `--date $date` is optional, if omitted it will be the date on which you run the command
    77 
    -      - [ ] Copy the output of the script to the beginning of `ChangeLog-MB.txt` and adjust its output
    78 
    -  - [ ] Open MR with above changes, using the template for release preparations
    79 
    -  - [ ] Merge
    80 
    -  - [ ] Sign+Tag
    81 
    -    - **NOTE** this must be done by one of:
    82 
    -      - boklm
    83 
    -      - dan
    84 
    -      - ma1
    85 
    -      - pierov
    86 
    -      - richard
    87 
    -    - [ ] Run: `make mullvadbrowser-signtag-alpha`
    88 
    -    - [ ] Push tag to `upstream`
    89 
    -  - [ ] Build the tag on at least one of:
    90 
    -    - Run `make mullvadbrowser-alpha && make mullvadbrowser-incrementals-alpha`
    36 
    +### tor-browser-build: https://gitlab.torproject.org/tpo/applications/tor-browser-build.git
    37 
    +Mullvad Browser Alpha (and Nightly) are on the `main` branch
    38 
    +
    39 
    +- [ ] Update `rbm.conf`
    40 
    +  - [ ] `var/torbrowser_version` : update to next version
    41 
    +  - [ ] `var/torbrowser_build` : update to `$(MULLVAD_BROWSER_BUILD_N)`
    42 
    +  - [ ] `var/torbrowser_incremental_from` : update to previous Desktop version
    43 
    +    - **NOTE**: We try to build incrementals for the previous 3 desktop versions except in the case of a watershed update
    44 
    +    - **IMPORTANT**: Really *actually* make sure this is the previous Desktop version or else the `make mullvadbrowser-incrementals-*` step will fail
    45 
    +- [ ] Update build configs
    46 
    +  - [ ] Update `projects/firefox/config`
    47 
    +    - [ ] `browser_build` : update to match `mullvad-browser` tag
    48 
    +    - [ ] ***(Optional)*** `var/firefox_platform_version` : update to latest `$(ESR_VERSION)` if rebased
    49 
    +  - [ ] Update `projects/translation/config`:
    50 
    +    - [ ] run `make list_translation_updates-alpha` to get updated hashes
    51 
    +    - [ ] `steps/base-browser/git_hash` : update with `HEAD` commit of project's `base-browser` branch
    52 
    +    - [ ] `steps/mullvad-browser/git_hash` : update with `HEAD` commit of project's `mullvad-browser` branch
    53 
    +- [ ] Update common build configs
    54 
    +  - [ ] Check for NoScript updates here : https://addons.mozilla.org/en-US/firefox/addon/noscript
    55 
    +    - [ ] ***(Optional)*** If new version available, update `noscript` section of `input_files` in `projects/browser/config`
    56 
    +      - [ ] `URL`
    57 
    +      - [ ] `sha256sum`
    58 
    +  - [ ] Check for uBlock-origin updates here : https://addons.mozilla.org/en-US/firefox/addon/ublock-origin/
    59 
    +    - [ ] ***(Optional)*** If new version available, update `ublock-origin` section of `input_files` in `projects/browser/config`
    60 
    +      - [ ] `URL`
    61 
    +      - [ ] `sha256sum`
    62 
    +  - [ ] Check for Mullvad Browser Extension updates here : https://github.com/mullvad/browser-extension/releases
    63 
    +    - [ ] ***(Optional)*** If new version available, update `mullvad-extension` section of `input_files` in `projects/browser/config`
    64 
    +      - [ ] `URL`
    65 
    +      - [ ] `sha256sum`
    66 
    +- [ ] Update `ChangeLog-MB.txt`
    67 
    +  - [ ] Ensure `ChangeLog-MB.txt` is sync'd between alpha and stable branches
    68 
    +  - [ ] Check the linked issues: ask people to check if any are missing, remove the not fixed ones
    69 
    +  - [ ] Run `tools/fetch-changelogs.py $(ISSUE_NUMBER) --date $date $updateArgs`
    70 
    +    - Make sure you have `requests` installed (e.g., `apt install python3-requests`)
    71 
    +    - The first time you run this script you will need to generate an access token; the script will guide you
    72 
    +    - `$updateArgs` should be these arguments, depending on what you actually updated:
    73 
    +      - [ ] `--firefox` (be sure to include esr at the end if needed, which is usually the case)
    74 
    +      - [ ] `--no-script`
    75 
    +      - [ ] `--ublock`
    76 
    +      - E.g., `tools/fetch-changelogs.py 41029 --date 'December 19 2023' --firefox 115.6.0esr --no-script 11.4.29 --ublock 1.54.0`
    77 
    +    - `--date $date` is optional, if omitted it will be the date on which you run the command
    78 
    +  - [ ] Copy the output of the script to the beginning of `ChangeLog-MB.txt` and adjust its output
    79 
    +- [ ] Open MR with above changes, using the template for release preparations
    80 
    +- [ ] Merge
    81 
    +- [ ] Sign+Tag
    82 
    +  - **NOTE** this must be done by one of:
    83 
    +    - boklm
    84 
    +    - dan
    85 
    +    - ma1
    86 
    +    - pierov
    87 
    +    - richard
    88 
    +  - [ ] Run: `make mullvadbrowser-signtag-alpha`
    89 
    +  - [ ] Push tag to `upstream`
    90 
    +- [ ] Build the tag:
    91 
    +  - Run `make mullvadbrowser-alpha && make mullvadbrowser-incrementals-alpha` on:
    91 92 
         - [ ] Tor Project build machine
    92 93 
         - [ ] Local developer machine
    93 94 
       - [ ] Submit build request to Mullvad infrastructure:
    94 95 
         - **NOTE** this requires a devmole authentication token
    95 96 
         - Run `make mullvadbrowser-kick-devmole-build`
    96 
    -  - [ ] Ensure builders have matching builds
    97 
    +- [ ] Ensure builders have matching builds
    97 98
    98 99 
     </details>
    99 100
    100 101 
     <details>
    101 102 
       <summary>Signing</summary>
    102 103
    103 
    -  ### signing
    104 
    -  - [ ] Assign this issue to the signer, one of:
    105 
    -    - boklm
    106 
    -    - richard
    107 
    -  - [ ] On `$(STAGING_SERVER)`, ensure updated:
    108 
    -    - [ ]  `tor-browser-build/tools/signing/set-config.hosts`
    109 
    -      - `ssh_host_builder` : ssh hostname of machine with unsigned builds
    110 
    -        - **NOTE** : `tor-browser-build` is expected to be in the `$HOME` directory)
    111 
    -      - `ssh_host_linux_signer` : ssh hostname of linux signing machine
    112 
    -    - [ ] `tor-browser-build/tools/signing/set-config.rcodesign-appstoreconnect`
    113 
    -      - `appstoreconnect_api_key_path` : path to json file containing appstoreconnect api key infos
    114 
    -    - [ ] `set-config.update-responses`
    115 
    -      - `update_responses_repository_dir` : directory where you cloned `git@xxxxxxxxxxxxxxxxxxxxx:tpo/applications/mullvad-browser-update-responses.git`
    116 
    -    - [ ] `tor-browser-build/tools/signing/set-config.tbb-version`
    117 
    -      - `tbb_version` : mullvad browser version string, same as `var/torbrowser_version` in `rbm.conf` (examples: `11.5a12`, `11.0.13`)
    118 
    -      - `tbb_version_build` : the tor-browser-build build number (if `var/torbrowser_build` in `rbm.conf` is `buildN` then this value is `N`)
    119 
    -      - `tbb_version_type` : either `alpha` for alpha releases or `release` for stable releases
    120 
    -  - [ ] On `$(STAGING_SERVER)` in a separate `screen` session, ensure tor daemon is running with SOCKS5 proxy on the default port 9050
    121 
    -  - [ ] run do-all-signing script:
    122 
    -      - `cd tor-browser-build/tools/signing/`
    123 
    -      - `./do-all-signing.mullvadbrowser`
    124 
    -  - **NOTE**: at this point the signed binaries should have been copied to `staticiforme`
    125 
    -  - [ ] Update `staticiforme.torproject.org`:
    126 
    -    - From `screen` session on `staticiforme.torproject.org`:
    127 
    -    - [ ] Static update components : `static-update-component dist.torproject.org`
    128 
    -    - [ ] Remove old release data from `/srv/dist-master.torproject.org/htdocs/mullvadbrowser`
    129 
    -    - [ ] Static update components (again) : `static-update-component dist.torproject.org`
    104 
    +### release signing
    105 
    +- [ ] Assign this issue to the signer, one of:
    106 
    +  - boklm
    107 
    +  - richard
    108 
    +- [ ] On `$(STAGING_SERVER)`, ensure updated:
    109 
    +  - [ ] `tor-browser-build` is on the right commit: `git tag -v tbb-$(MULLVAD_BROWSER_VERSION)-$(MULLVAD_BROWSER_BUILD_N) && git checkout tbb-$(MULLVAD_BROWSER_VERSION)-$(MULLVAD_BROWSER_BUILD_N)`
    110 
    +  - [ ] `tor-browser-build/tools/signing/set-config.hosts`
    111 
    +    - `ssh_host_builder` : ssh hostname of machine with unsigned builds
    112 
    +      - **NOTE** : `tor-browser-build` is expected to be in the `$HOME` directory)
    113 
    +    - `ssh_host_linux_signer` : ssh hostname of linux signing machine
    114 
    +  - [ ] `tor-browser-build/tools/signing/set-config.rcodesign-appstoreconnect`
    115 
    +    - `appstoreconnect_api_key_path` : path to json file containing appstoreconnect api key infos
    116 
    +  - [ ] `set-config.update-responses`
    117 
    +    - `update_responses_repository_dir` : directory where you cloned `git@xxxxxxxxxxxxxxxxxxxxx:tpo/applications/mullvad-browser-update-responses.git`
    118 
    +  - [ ] `tor-browser-build/tools/signing/set-config.tbb-version`
    119 
    +    - `tbb_version` : mullvad browser version string, same as `var/torbrowser_version` in `rbm.conf` (examples: `11.5a12`, `11.0.13`)
    120 
    +    - `tbb_version_build` : the tor-browser-build build number (if `var/torbrowser_build` in `rbm.conf` is `buildN` then this value is `N`)
    121 
    +    - `tbb_version_type` : either `alpha` for alpha releases or `release` for stable releases
    122 
    +- [ ] On `$(STAGING_SERVER)` in a separate `screen` session, ensure tor daemon is running with SOCKS5 proxy on the default port 9050
    123 
    +- [ ] On `$(STAGING_SERVER)` in a separate `screen` session, run do-all-signing script:
    124 
    +  - `cd tor-browser-build/tools/signing/`
    125 
    +  - `./do-all-signing.mullvadbrowser`
    126 
    +- **NOTE**: at this point the signed binaries should have been copied to `staticiforme`
    127 
    +- [ ] Update `staticiforme.torproject.org`:
    128 
    +  - From `screen` session on `staticiforme.torproject.org`:
    129 
    +  - [ ] Remove old release data from `/srv/dist-master.torproject.org/htdocs/mullvadbrowser`
    130 
    +  - [ ] Static update components (again) : `static-update-component dist.torproject.org`
    130 131
    131 132 
     </details>
    132 133
    133 134 
     <details>
    134 135 
       <summary>Publishing</summary>
    135 136
    136 
    -  ### mullvad-browser (github): https://github.com/mullvad/mullvad-browser/
    137 
    -  - [ ] Assign this issue to someone with mullvad commit access, one of:
    137 
    +### mullvad-browser (GitHub): https://github.com/mullvad/mullvad-browser/
    138 
    +- [ ] Assign this issue to someone with mullvad commit access, one of:
    138 139 
         - richard
    139 
    -  - [ ] Push this release's associated `mullvad-browser.git` branch to github
    140 
    -  - [ ] Push this release's associated tags to github:
    141 
    -    - [ ] Firefox ESR tag
    142 
    -      - **example** : `FIREFOX_102_12_0esr_BUILD1,`
    143 
    -    - [ ] `base-browser` tag
    144 
    -      - **example** : `base-browser-102.12.0esr-12.0-1-build1`
    145 
    -    - [ ] `mullvad-browser` tag
    146 
    -      - **example** : `mullvad-browser-102.12.0esr-12.0-1-build1`
    147 
    -  - [ ] Sign+Tag additionally the `mullvad-browser.git` `firefox` commit used in build:
    148 
    -    - **Tag**: `$(MULLVAD_BROWSER_VERSION)`
    149 
    -      - **example** : `12.5a7`
    150 
    -    - **Message**: `$(ESR_VERSION)esr-based $(MULLVAD_BROWSER_VERSION)`
    151 
    -      - **example** : `102.12.0esr-based 12.5a7`
    152 
    -    - [ ] Push tag to github
    153 
    -
    154 
    -  ### email
    155 
    -  - [ ] Email Mullvad with release information: support@xxxxxxxxxxx, rui@xxxxxxxxxxx
    156 
    -    <details>
    157 
    -      <summary>email template</summary>
    158 
    -
    159 
    -        Subject:
    160 
    -        New build: Mullvad Browser $(MULLVAD_BROWSER_VERION) (signed)
    161 
    -
    162 
    -        Body:
    163 
    -        signed builds: https://dist.torproject.org/mullvadbrowser/$(MULLVAD_BROWSER_VERSION)
    164 
    -
    165 
    -        update_response hashes: $(MULLVAD_UPDATE_RESPONSES_HASH)
    166 
    -
    167 
    -        changelog:
    168 
    -        ...
    169 
    -
    170 
    -    </details>
    140 
    +- [ ] Push this release's associated `mullvad-browser.git` branch to github
    141 
    +- [ ] Push this release's associated tags to github:
    142 
    +  - [ ] Firefox ESR tag
    143 
    +    - **example** : `FIREFOX_102_12_0esr_BUILD1`
    144 
    +  - [ ] `base-browser` tag
    145 
    +    - **example** : `base-browser-102.12.0esr-12.0-1-build1`
    146 
    +  - [ ] `mullvad-browser` tag
    147 
    +    - **example** : `mullvad-browser-102.12.0esr-12.0-1-build1`
    148 
    +- [ ] Sign+Tag additionally the `mullvad-browser.git` `firefox` commit used in build:
    149 
    +  - **Tag**: `$(MULLVAD_BROWSER_VERSION)`
    150 
    +    - **example** : `12.5a7`
    151 
    +  - **Message**: `$(ESR_VERSION)esr-based $(MULLVAD_BROWSER_VERSION)`
    152 
    +    - **example** : `102.12.0esr-based 12.5a7`
    153 
    +  - [ ] Push tag to github
    154 
    +
    155 
    +### email
    156 
    +- [ ] **(Once branch+tags pushed to GitHub)** Email Mullvad with release information:
    157 
    +  - [ ] support alias: support@xxxxxxxxxxxxxx
    158 
    +  - [ ] Rui: rui@xxxxxxxxxxx
    159 
    +  - **Subject**
    160 
    +    ```
    161 
    +    New build: Mullvad Browser $(MULLVAD_BROWSER_VERION) (signed)
    162 
    +    ```
    163 
    +  - **Body**
    164 
    +    ```
    165 
    +    Hello,
    166 
    +
    167 
    +    Branch+Tags have been pushed to Mullvad's GitHub repo.
    168 
    +
    169 
    +    - signed builds: https://dist.torproject.org/mullvadbrowser/$(MULLVAD_BROWSER_VERSION)
    170 
    +    - update_response hashes: $(MULLVAD_UPDATE_RESPONSES_HASH)
    171 
    +
    172 
    +    changelog:
    173 
    +    ...
    174 
    +    ```
    175 
    +
    171 176 
     </details>
    172 177
    173 178 
     <details>
    174 179 
       <summary>Downstream</summary>
    175 180
    176 
    -  ### notify packagers
    177 
    -
    178 
    -  - [ ] **(Optional, Once Mullvad Updates their Github Releases Page)** Email downstream consumers:
    179 
    -    - **NOTE**: This is an optional step and only necessary close a major release/transition from alpha to stable, or if there are major packing changes these developers need to be aware of
    180 
    -    <details>
    181 
    -      <summary>email template</summary>
    182 
    -
    183 
    -        Hello!
    184 
    -
    185 
    -        Mullvad-Browser $(MULLVAD_BROWSER_VERSION) packages are available, so you should all update your respective downstream packages.
    186 
    -
    187 
    -        Release builds can be found here:
    188 
    -
    189 
    -        - https://github.com/mullvad/mullvad-browser/releases/tag/$(MULLVAD_BROWSER_VERSION)
    190 
    -
    191 
    -    </details>
    192 
    -
    193 
    -    - flathub package maintainer: proletarius101@xxxxxxxxxxxxxx
    194 
    -    - arch package maintainer: bootctl@xxxxxxxxx
    195 
    -    - nixOS package maintainer: dev@xxxxxxxxxxx
    181 
    +### notify packagers
    182 
    +These steps depend on Mullvad having updated their [GitHub Releases](https://github.com/mullvad/mullvad-browser/releases/) page with the latest release
    183 
    +- [ ] **(Optional)** Email downstream consumers:
    184 
    +  - **NOTE**: This is an optional step and only necessary close a major release/transition from alpha to stable, or if there are major packing changes these developers need to be aware of
    185 
    +  - [ ] flathub package maintainer: proletarius101@xxxxxxxxxxxxxx
    186 
    +  - [ ] arch package maintainer: bootctl@xxxxxxxxx
    187 
    +  - [ ] nixOS package maintainer: dev@xxxxxxxxxxx
    188 
    +  - **Subject**
    189 
    +    ```
    190 
    +    Mullvad Browser $(MULLVAD_BROWSER_VERSION) released
    191 
    +    ```
    192 
    +  - **Body**
    193 
    +    ```
    194 
    +    Hello!
    195 
    +
    196 
    +    This is a major alpha release which may require changes in your respective downstream packages once it stabilises.
    197 
    +
    198 
    +    The latest alpha builds can be found here:
    199 
    +
    200 
    +    - https://github.com/mullvad/mullvad-browser/releases?q=prerelease%3Atrue
    201 
    +    ```
    196 202
    197 203 
     </details>
    198 204

  • .gitlab/issue_templates/Release Prep - Mullvad Browser Stable.md
    ... ... @@ -28,6 +28,8 @@
    28 28
    29 29 
     **NOTE** It is assumed that the `tor-browser` stable rebase and security backport tasks have been completed
    30 30
    31 
    +**NOTE** This can/is often done in conjunction with the equivalent Tor Browser release prep issue
    32 
    +
    31 33 
     <details>
    32 34 
       <summary>Building</summary>
    33 35
    ... ... @@ -38,6 +40,7 @@ Mullvad Browser Stable lives in the various `maint-$(MULLVAD_BROWSER_MAJOR).$(MU
    38 40 
       - [ ] `var/torbrowser_version` : update to next version
    39 41 
       - [ ] `var/torbrowser_build` : update to `$(MULLVAD_BROWSER_BUILD_N)`
    40 42 
       - [ ] `var/torbrowser_incremental_from` : update to previous Desktop version
    43 
    +    - **NOTE**: We try to build incrementals for the previous 3 desktop versions except in the case of a watershed update
    41 44 
         - **IMPORTANT**: Really *actually* make sure this is the previous Desktop version or else the `make mullvadbrowser-incrementals-*` step will fail
    42 45 
     - [ ] Update build configs
    43 46 
       - [ ] Update `projects/firefox/config`
    ... ... @@ -46,7 +49,7 @@ Mullvad Browser Stable lives in the various `maint-$(MULLVAD_BROWSER_MAJOR).$(MU
    46 49 
       - [ ] Update `projects/translation/config`:
    47 50 
         - [ ] run `make list_translation_updates-release` to get updated hashes
    48 51 
         - [ ] `steps/base-browser/git_hash` : update with `HEAD` commit of project's `base-browser` branch
    49 
    -    - [ ] `steps/base-browser-fluent/git_hash` : update with `HEAD` commit of project's `basebrowser-newidentityftl` branch
    52 
    +    - [ ] `steps/mullvad-browser/git_hash` : update with `HEAD` commit of project's `mullvad-browser` branch
    50 53 
     - [ ] Update common build configs
    51 54 
       - [ ] Check for NoScript updates here : https://addons.mozilla.org/en-US/firefox/addon/noscript
    52 55 
         - [ ] ***(Optional)*** If new version available, update `noscript` section of `input_files` in `projects/browser/config`
    ... ... @@ -56,7 +59,7 @@ Mullvad Browser Stable lives in the various `maint-$(MULLVAD_BROWSER_MAJOR).$(MU
    56 59 
         - [ ] ***(Optional)*** If new version available, update `ublock-origin` section of `input_files` in `projects/browser/config`
    57 60 
           - [ ] `URL`
    58 61 
           - [ ] `sha256sum`
    59 
    -  - [ ] Check for Mullvad Privacy Companion updates here : https://github.com/mullvad/browser-extension/releases
    62 
    +  - [ ] Check for Mullvad Browser Extension updates here : https://github.com/mullvad/browser-extension/releases
    60 63 
         - [ ] ***(Optional)*** If new version available, update `mullvad-extension` section of `input_files` in `projects/browser/config`
    61 64 
           - [ ] `URL`
    62 65 
           - [ ] `sha256sum`
    ... ... @@ -67,39 +70,43 @@ Mullvad Browser Stable lives in the various `maint-$(MULLVAD_BROWSER_MAJOR).$(MU
    67 70 
         - Make sure you have `requests` installed (e.g., `apt install python3-requests`)
    68 71 
         - The first time you run this script you will need to generate an access token; the script will guide you
    69 72 
         - `$updateArgs` should be these arguments, depending on what you actually updated:
    70 
    -      - [ ] `--firefox`
    73 
    +      - [ ] `--firefox` (be sure to include esr at the end if needed, which is usually the case)
    71 74 
           - [ ] `--no-script`
    72 75 
           - [ ] `--ublock`
    73 76 
           - E.g., `tools/fetch-changelogs.py 41029 --date 'December 19 2023' --firefox 115.6.0esr --no-script 11.4.29 --ublock 1.54.0`
    74 77 
         - `--date $date` is optional, if omitted it will be the date on which you run the command
    75 78 
       - [ ] Copy the output of the script to the beginning of `ChangeLog-MB.txt` and adjust its output
    76 
    -  - [ ] Open MR with above changes, using the template for release preparations
    77 
    -  - [ ] Merge
    78 
    -  - [ ] Sign+Tag
    79 
    -    - **NOTE** this must be done by one of:
    80 
    -      - boklm
    81 
    -      - dan
    82 
    -      - ma1
    83 
    -      - pierov
    84 
    -      - richard
    85 
    -    - [ ] Run: `make mullvadbrowser-signtag-release`
    86 
    -    - [ ] Push tag to `upstream`
    87 
    -  - [ ] Build on at least one of:
    88 
    -    - Run `make mullvadbrowser-release && make mullvadbrowser-incrementals-release`
    79 
    +- [ ] Open MR with above changes, using the template for release preparations
    80 
    +- [ ] Merge
    81 
    +- [ ] Sign+Tag
    82 
    +  - **NOTE** this must be done by one of:
    83 
    +    - boklm
    84 
    +    - dan
    85 
    +    - ma1
    86 
    +    - pierov
    87 
    +    - richard
    88 
    +  - [ ] Run: `make mullvadbrowser-signtag-release`
    89 
    +  - [ ] Push tag to `upstream`
    90 
    +- [ ] Build the tag:
    91 
    +  - Run `make mullvadbrowser-release && make mullvadbrowser-incrementals-release`
    89 92 
         - [ ] Tor Project build machine
    90 93 
         - [ ] Local developer machine
    91 94 
       - [ ] Submit build request to Mullvad infrastructure:
    92 95 
         - **NOTE** this requires a devmole authentication token
    93 96 
         - Run `make mullvadbrowser-kick-devmole-build`
    94 
    -  - [ ] Ensure builders have matching builds
    97 
    +- [ ] Ensure builders have matching builds
    95 98
    96 99 
     </details>
    97 100
    98 101 
     <details>
    99 102 
       <summary>Signing</summary>
    100 103
    101 
    -### signing
    104 
    +### release signing
    105 
    +- [ ] Assign this issue to the signer, one of:
    106 
    +  - boklm
    107 
    +  - richard
    102 108 
     - [ ] On `$(STAGING_SERVER)`, ensure updated:
    109 
    +  - [ ] `tor-browser-build` is on the right commit: `git tag -v tbb-$(MULLVAD_BROWSER_VERSION)-$(MULLVAD_BROWSER_BUILD_N) && git checkout tbb-$(MULLVAD_BROWSER_VERSION)-$(MULLVAD_BROWSER_BUILD_N)`
    103 110 
       - [ ]  `tor-browser-build/tools/signing/set-config.hosts`
    104 111 
         - `ssh_host_builder` : ssh hostname of machine with unsigned builds
    105 112 
           - **NOTE** : `tor-browser-build` is expected to be in the `$HOME` directory)
    ... ... @@ -113,13 +120,12 @@ Mullvad Browser Stable lives in the various `maint-$(MULLVAD_BROWSER_MAJOR).$(MU
    113 120 
         - `tbb_version_build` : the tor-browser-build build number (if `var/torbrowser_build` in `rbm.conf` is `buildN` then this value is `N`)
    114 121 
         - `tbb_version_type` : either `alpha` for alpha releases or `release` for stable releases
    115 122 
     - [ ] On `$(STAGING_SERVER)` in a separate `screen` session, ensure tor daemon is running with SOCKS5 proxy on the default port 9050
    116 
    -- [ ] run do-all-signing script:
    117 
    -    - `cd tor-browser-build/tools/signing/`
    118 
    -    - `./do-all-signing.mullvadbrowser`
    123 
    +- [ ] On `$(STAGING_SERVER)` in a separate `screen` session, run do-all-signing script:
    124 
    +  - `cd tor-browser-build/tools/signing/`
    125 
    +  - `./do-all-signing.mullvadbrowser`
    119 126 
     - **NOTE**: at this point the signed binaries should have been copied to `staticiforme`
    120 127 
     - [ ] Update `staticiforme.torproject.org`:
    121 128 
       - From `screen` session on `staticiforme.torproject.org`:
    122 
    -  - [ ] Static update components : `static-update-component dist.torproject.org`
    123 129 
       - [ ] Remove old release data from `/srv/dist-master.torproject.org/htdocs/mullvadbrowser`
    124 130 
       - [ ] Static update components (again) : `static-update-component dist.torproject.org`
    125 131
    ... ... @@ -128,30 +134,13 @@ Mullvad Browser Stable lives in the various `maint-$(MULLVAD_BROWSER_MAJOR).$(MU
    128 134 
     <details>
    129 135 
       <summary>Publishing</summary>
    130 136
    131 
    -### email
    132 
    -
    133 
    -- [ ] Email Mullvad with release information: support@xxxxxxxxxxx, rui@xxxxxxxxxxx
    134 
    -  <details>
    135 
    -    <summary>email template</summary>
    136 
    -
    137 
    -      Subject:
    138 
    -      New build: Mullvad Browser $(MULLVAD_BROWSER_VERION) (signed)
    139 
    -
    140 
    -      Body:
    141 
    -      signed builds: https://dist.torproject.org/mullvadbrowser/$(MULLVAD_BROWSER_VERSION)
    142 
    -
    143 
    -      update_response hashes: $(MULLVAD_UPDATE_RESPONSES_HASH)
    144 
    -
    145 
    -      changelog:
    146 
    -      ...
    147 
    -
    148 
    -  </details>
    149 
    -
    150 
    -### mullvad-browser (github): https://github.com/mullvad/mullvad-browser/
    137 
    +### mullvad-browser (GitHub): https://github.com/mullvad/mullvad-browser/
    138 
    +- [ ] Assign this issue to someone with mullvad commit access, one of:
    139 
    +    - richard
    151 140 
     - [ ] Push this release's associated `mullvad-browser.git` branch to github
    152 141 
     - [ ] Push this release's associated tags to github:
    153 142 
       - [ ] Firefox ESR tag
    154 
    -    - **example** : `FIREFOX_102_12_0esr_BUILD1,`
    143 
    +    - **example** : `FIREFOX_102_12_0esr_BUILD1`
    155 144 
       - [ ] `base-browser` tag
    156 145 
         - **example** : `base-browser-102.12.0esr-12.0-1-build1`
    157 146 
       - [ ] `mullvad-browser` tag
    ... ... @@ -163,32 +152,59 @@ Mullvad Browser Stable lives in the various `maint-$(MULLVAD_BROWSER_MAJOR).$(MU
    163 152 
         - **example** : `102.12.0esr-based 12.0.7`
    164 153 
       - [ ] Push tag to github
    165 154
    155 
    +### email
    156 
    +- [ ] **(Once branch+tags pushed to GitHub)** Email Mullvad with release information:
    157 
    +  - [ ] support alias: support@xxxxxxxxxxxxxx
    158 
    +  - [ ] Rui: rui@xxxxxxxxxxx
    159 
    +  - **Subject**
    160 
    +    ```
    161 
    +    New build: Mullvad Browser $(MULLVAD_BROWSER_VERION) (signed)
    162 
    +    ```
    163 
    +  - **Body**
    164 
    +    ```
    165 
    +    Hello,
    166 
    +
    167 
    +    Branch+Tags have been pushed to Mullvad's GitHub repo.
    168 
    +
    169 
    +    - signed builds: https://dist.torproject.org/mullvadbrowser/$(MULLVAD_BROWSER_VERSION)
    170 
    +    - update_response hashes: $(MULLVAD_UPDATE_RESPONSES_HASH)
    171 
    +
    172 
    +    changelog:
    173 
    +    ...
    174 
    +    ```
    175 
    +
    166 176 
     </details>
    167 177
    168 178 
     <details>
    169 179 
       <summary>Downstream</summary>
    170 180
    171 181 
     ### notify packagers
    172 
    -
    173 
    -- [ ] **(Once Mullvad Updates their Github Releases Page)** Email downstream consumers:
    174 
    -  <details>
    175 
    -    <summary>email template</summary>
    176 
    -
    177 
    -    ...
    178 
    -
    179 
    -    ...
    180 
    -
    181 
    -  </details>
    182 
    -
    182 
    +These steps depend on Mullvad having updated their [GitHub Releases](https://github.com/mullvad/mullvad-browser/releases/) page with the latest release
    183 
    +- [ ] Email downstream consumers:
    183 184 
       - [ ] flathub package maintainer: proletarius101@xxxxxxxxxxxxxx
    184 185 
       - [ ] arch package maintainer: bootctl@xxxxxxxxx
    185 186 
       - [ ] nixOS package maintainer: dev@xxxxxxxxxxx
    187 
    +  - **Subject**
    188 
    +    ```
    189 
    +    Mullvad Browser $(MULLVAD_BROWSER_VERSION) released
    190 
    +    ```
    191 
    +  - **Body**
    192 
    +    ```
    193 
    +    Hello!
    186 194
    187 
    -### merge requests
    195 
    +    Mullvad-Browser packages are available, so you should update your respective downstream packages.
    196 
    +
    197 
    +    The latest release builds can be found here:
    188 198
    189 
    -- [ ] homebrew: https://github.com/Homebrew/homebrew-cask/blob/master/Casks/mullvad-browser.rb
    190 
    -  - **NOTE**: should just need to update the version to latest
    199 
    +    - https://github.com/mullvad/mullvad-browser/releases?q=prerelease%3Afalse
    200 
    +    ```
    201 
    +
    202 
    +### merge requests
    203 
    +- [ ] homebrew: https://github.com/Homebrew/homebrew-cask/blob/master/Casks/m/mullvad-browser.rb
    204 
    +  - **NOTE**: should just need to update `version` and `sha256` to latest
    191 205
    192 206 
     </details>
    193 207
    194 
    -/label ~"Release Prep" ~"Sponsor 131"
    208 
    +/label ~"Release Prep"
    209 
    +/label  ~"Sponsor 131"
    210 
    +

  • .gitlab/issue_templates/Release Prep - Tor Browser Alpha.md
    ... ... @@ -32,197 +32,176 @@
    32 32 
     <details>
    33 33 
       <summary>Building</summary>
    34 34
    35 
    -  ### tor-browser-build: https://gitlab.torproject.org/tpo/applications/tor-browser-build.git
    36 
    -  Tor Browser Alpha (and Nightly) are on the `main` branch
    37 
    -
    38 
    -  - [ ] Update `rbm.conf`
    39 
    -    - [ ] `var/torbrowser_version` : update to next version
    40 
    -    - [ ] `var/torbrowser_build` : update to `$(TOR_BROWSER_BUILD_N)`
    41 
    -    - [ ] ***(Desktop Only)***`var/torbrowser_incremental_from` : update to previous Desktop version
    42 
    -      - **NOTE**: We try to build incrementals for the previous 3 desktop versions except in the case of a watershed update
    43 
    -      - **IMPORTANT**: Really *actually* make sure this is the previous Desktop version or else the `make torbrowser-incrementals-*` step will fail
    44 
    -  - [ ] Update Desktop-specific build configs
    45 
    -    - [ ] Update `projects/firefox/config`
    46 
    -      - [ ] `browser_build` : update to match `tor-browser` tag
    47 
    -      - [ ] ***(Optional)*** `var/firefox_platform_version` : update to latest `$(ESR_VERSION)` if rebased
    48 
    -    - [ ] Update `projects/translation/config`:
    49 
    -      - [ ] run `make list_translation_updates-alpha` to get updated hashes
    50 
    -      - [ ] `steps/base-browser/git_hash` : update with `HEAD` commit of project's `base-browser` branch
    51 
    -      - [ ] `steps/tor-browser/git_hash` : update with `HEAD` commit of project's `tor-browser` branch
    52 
    -      - [ ] `steps/fenix/git_hash` : update with `HEAD` commit of project's `fenix-torbrowserstringsxml` branch
    53 
    -  - [ ] Update Android-specific build configs
    54 
    -    - [ ] Update `projects/geckoview/config`
    55 
    -      - [ ] `browser_build` : update to match `tor-browser` tag
    56 
    -      - [ ] ***(Optional)*** `var/geckoview_version` : update to latest `$(ESR_VERSION)` if rebased
    57 
    -    - [ ] ***(Optional)*** Update `projects/tor-android-service/config`
    58 
    -      - [ ] `git_hash` : update with `HEAD` commit of project's `main` branch
    59 
    -    - [ ] ***(Optional)*** Update `projects/application-services/config`:
    60 
    -      **NOTE** we don't currently have any of our own patches for this project
    61 
    -      - [ ] `git_hash` : update to appropriate git commit associated with `$(ESR_VERSION)`
    62 
    -    - [ ] ***(Optional)*** Update `projects/firefox-android/config`:
    63 
    -      - [ ] `fenix_version` : update to match alpha `firefox-android` build tag
    64 
    -      - [ ] `browser_branch` : update to match alpha `firefox-android` build tag
    65 
    -    - [ ] Update allowed_addons.json by running (from `tor-browser-build` root):
    66 
    -      - `./tools/fetch_allowed_addons.py > projects/browser/allowed_addons.json`
    67 
    -  - [ ] Update common build configs
    68 
    -    - [ ] Check for NoScript updates here : https://addons.mozilla.org/en-US/firefox/addon/noscript
    69 
    -      - [ ] ***(Optional)*** If new version available, update `noscript` section of `input_files` in `projects/browser/config`
    70 
    -        - [ ] `URL`
    71 
    -        - [ ] `sha256sum`
    72 
    -    - [ ] Check for OpenSSL updates here : https://www.openssl.org/source/
    73 
    -      - [ ] ***(Optional)*** If new 3.0.X version available, update `projects/openssl/config`
    74 
    -        - [ ] `version` : update to next 3.0.X version
    75 
    -        - [ ] `input_files/sha256sum` : update to sha256 sum of source tarball
    76 
    -    - [ ] Check for zlib updates here: https://github.com/madler/zlib/releases
    77 
    -      - [ ] **(Optional)** If new tag available, update `projects/zlib/config`
    78 
    -        - [ ] `version` : update to next release tag
    79 
    -    - [ ] Check for tor updates here : https://gitlab.torproject.org/tpo/core/tor/-/tags
    80 
    -      - [ ] ***(Optional)*** Update `projects/tor/config`
    81 
    -        - [ ] `version` : update to latest `-alpha` tag or release tag if newer (ping dgoulet or ahf if unsure)
    82 
    -    - [ ] Check for go updates here : https://golang.org/dl
    83 
    -      - **NOTE** : Tor Browser Alpha uses the latest Stable major series go version
    84 
    -      - [ ] ***(Optional)*** Update `projects/go/config`
    85 
    -        - [ ] `version` : update go version
    86 
    -        - [ ] `input_files/sha256sum` for `go` : update sha256sum of archive (sha256 sums are displayed on the go download page)
    87 
    -    - [ ] Check for manual updates by running (from `tor-browser-build` root): `./tools/fetch-manual.py`
    88 
    -      - [ ] ***(Optional)*** If new version is available:
    89 
    -        - [ ] Upload the downloaded `manual_$PIPELINEID.zip` file to `tb-build-02.torproject.org`
    90 
    -        - [ ] Deploy to `tb-builder`'s `public_html` directory:
    91 
    -          - `sudo -u tb-builder cp manual_$PIPELINEID.zip ~/../tb-builder/public_html/.`
    92 
    -        - [ ] Update `projects/manual/config`:
    93 
    -          - [ ] Change the `version` to `$PIPELINEID`
    94 
    -          - [ ] Update `sha256sum` in the `input_files` section
    95 
    -  - [ ] Update `ChangeLog-TBB.txt`
    96 
    -    - [ ] Ensure `ChangeLog-TBB.txt` is sync'd between alpha and stable branches
    97 
    -    - [ ] Check the linked issues: ask people to check if any are missing, remove the not fixed ones
    98 
    -    - [ ] Run `tools/fetch-changelogs.py $(ISSUE_NUMBER) --date $date $updateArgs`
    99 
    -      - Make sure you have `requests` installed (e.g., `apt install python3-requests`)
    100 
    -      - The first time you run this script you will need to generate an access token; the script will guide you
    101 
    -      - `$updateArgs` should be these arguments, depending on what you actually updated:
    102 
    -          - [ ] `--firefox` (be sure to include esr at the end if needed, which is usually the case)
    103 
    -          - [ ] `--tor`
    104 
    -          - [ ] `--no-script`
    105 
    -          - [ ] `--openssl`
    106 
    -          - [ ] `--zlib`
    107 
    -          - [ ] `--go`
    108 
    -          - E.g., `tools/fetch-changelogs.py 41028 --date 'December 19 2023' --firefox 115.6.0esr --tor 0.4.8.10 --no-script 11.4.29 --zlib 1.3 --go 1.21.5 --openssl 3.0.12`
    109 
    -        - `--date $date` is optional, if omitted it will be the date on which you run the command
    110 
    -      - [ ] Copy the output of the script to the beginning of `ChangeLog-TBB.txt` and adjust its output
    111 
    -  - [ ] Open MR with above changes, using the template for release preparations
    112 
    -  - [ ] Merge
    113 
    -  - [ ] Sign+Tag
    114 
    -    - **NOTE** this must be done by one of:
    115 
    -      - boklm
    116 
    -      - dan
    117 
    -      - ma1
    118 
    -      - pierov
    119 
    -      - richard
    120 
    -    - [ ] Run: `make torbrowser-signtag-alpha`
    121 
    -    - [ ] Push tag to `upstream`
    122 
    -  - [ ] Build on at least one of:
    123 
    -    - Run `make torbrowser-alpha && make torbrowser-incrementals-alpha`
    35 
    +### tor-browser-build: https://gitlab.torproject.org/tpo/applications/tor-browser-build.git
    36 
    +Tor Browser Alpha (and Nightly) are on the `main` branch
    37 
    +
    38 
    +- [ ] Update `rbm.conf`
    39 
    +  - [ ] `var/torbrowser_version` : update to next version
    40 
    +  - [ ] `var/torbrowser_build` : update to `$(TOR_BROWSER_BUILD_N)`
    41 
    +  - [ ] ***(Desktop Only)***`var/torbrowser_incremental_from` : update to previous Desktop version
    42 
    +    - **NOTE**: We try to build incrementals for the previous 3 desktop versions except in the case of a watershed update
    43 
    +    - **IMPORTANT**: Really *actually* make sure this is the previous Desktop version or else the `make torbrowser-incrementals-*` step will fail
    44 
    +- [ ] Update Desktop-specific build configs
    45 
    +  - [ ] Update `projects/firefox/config`
    46 
    +    - [ ] `browser_build` : update to match `tor-browser` tag
    47 
    +    - [ ] ***(Optional)*** `var/firefox_platform_version` : update to latest `$(ESR_VERSION)` if rebased
    48 
    +- [ ] Update Android-specific build configs
    49 
    +  - [ ] Update `projects/geckoview/config`
    50 
    +    - [ ] `browser_build` : update to match `tor-browser` tag
    51 
    +    - [ ] ***(Optional)*** `var/geckoview_version` : update to latest `$(ESR_VERSION)` if rebased
    52 
    +  - [ ] ***(Optional)*** Update `projects/tor-android-service/config`
    53 
    +    - [ ] `git_hash` : update with `HEAD` commit of project's `main` branch
    54 
    +  - [ ] ***(Optional)*** Update `projects/application-services/config`:
    55 
    +    **NOTE** we don't currently have any of our own patches for this project
    56 
    +    - [ ] `git_hash` : update to appropriate git commit associated with `$(ESR_VERSION)`
    57 
    +  - [ ] ***(Optional)*** Update `projects/firefox-android/config`:
    58 
    +    - [ ] `fenix_version` : update to match alpha `firefox-android` build tag
    59 
    +    - [ ] `browser_branch` : update to match alpha `firefox-android` build tag
    60 
    +  - [ ] Update allowed_addons.json by running (from `tor-browser-build` root):
    61 
    +    - `./tools/fetch_allowed_addons.py > projects/browser/allowed_addons.json`
    62 
    +- [ ] Update `projects/translation/config`:
    63 
    +  - [ ] run `make list_translation_updates-alpha` to get updated hashes
    64 
    +  - [ ] `steps/base-browser/git_hash` : update with `HEAD` commit of project's `base-browser` branch
    65 
    +  - [ ] `steps/tor-browser/git_hash` : update with `HEAD` commit of project's `tor-browser` branch
    66 
    +  - [ ] `steps/fenix/git_hash` : update with `HEAD` commit of project's `fenix-torbrowserstringsxml` branch
    67 
    +- [ ] Update common build configs
    68 
    +  - [ ] Check for NoScript updates here : https://addons.mozilla.org/en-US/firefox/addon/noscript
    69 
    +    - [ ] ***(Optional)*** If new version available, update `noscript` section of `input_files` in `projects/browser/config`
    70 
    +      - [ ] `URL`
    71 
    +      - [ ] `sha256sum`
    72 
    +  - [ ] Check for OpenSSL updates here : https://www.openssl.org/source/
    73 
    +    - [ ] ***(Optional)*** If new 3.0.X version available, update `projects/openssl/config`
    74 
    +      - [ ] `version` : update to next 3.0.X version
    75 
    +      - [ ] `input_files/sha256sum` : update to sha256 sum of source tarball
    76 
    +  - [ ] Check for zlib updates here: https://github.com/madler/zlib/releases
    77 
    +    - [ ] **(Optional)** If new tag available, update `projects/zlib/config`
    78 
    +      - [ ] `version` : update to next release tag
    79 
    +  - [ ] Check for tor updates here : https://gitlab.torproject.org/tpo/core/tor/-/tags
    80 
    +    - [ ] ***(Optional)*** Update `projects/tor/config`
    81 
    +      - [ ] `version` : update to latest `-alpha` tag or release tag if newer (ping dgoulet or ahf if unsure)
    82 
    +  - [ ] Check for go updates here : https://go.dev/dl
    83 
    +    - **NOTE** : In general, Tor Browser Alpha uses the latest Stable major series Go version, but there are sometimes exceptions. Check with the anti-censorship team before doing a major version update in case there is incompatibilities.
    84 
    +    - [ ] ***(Optional)*** Update `projects/go/config`
    85 
    +      - [ ] `version` : update go version
    86 
    +      - [ ] `input_files/sha256sum` for `go` : update sha256sum of archive (sha256 sums are displayed on the go download page)
    87 
    +  - [ ] Check for manual updates by running (from `tor-browser-build` root): `./tools/fetch-manual.py`
    88 
    +    - [ ] ***(Optional)*** If new version is available:
    89 
    +      - [ ] Upload the downloaded `manual_$PIPELINEID.zip` file to `tb-build-02.torproject.org`
    90 
    +      - [ ] Deploy to `tb-builder`'s `public_html` directory:
    91 
    +        - `sudo -u tb-builder cp manual_$PIPELINEID.zip ~tb-builder/public_html/.`
    92 
    +      - [ ] Update `projects/manual/config`:
    93 
    +        - [ ] Change the `version` to `$PIPELINEID`
    94 
    +        - [ ] Update `sha256sum` in the `input_files` section
    95 
    +- [ ] Update `ChangeLog-TBB.txt`
    96 
    +  - [ ] Ensure `ChangeLog-TBB.txt` is sync'd between alpha and stable branches
    97 
    +  - [ ] Check the linked issues: ask people to check if any are missing, remove the not fixed ones
    98 
    +  - [ ] Run `tools/fetch-changelogs.py $(ISSUE_NUMBER) --date $date $updateArgs`
    99 
    +    - Make sure you have `requests` installed (e.g., `apt install python3-requests`)
    100 
    +    - The first time you run this script you will need to generate an access token; the script will guide you
    101 
    +    - `$updateArgs` should be these arguments, depending on what you actually updated:
    102 
    +      - [ ] `--firefox` (be sure to include esr at the end if needed, which is usually the case)
    103 
    +      - [ ] `--tor`
    104 
    +      - [ ] `--no-script`
    105 
    +      - [ ] `--openssl`
    106 
    +      - [ ] `--zlib`
    107 
    +      - [ ] `--go`
    108 
    +      - E.g., `tools/fetch-changelogs.py 41028 --date 'December 19 2023' --firefox 115.6.0esr --tor 0.4.8.10 --no-script 11.4.29 --zlib 1.3 --go 1.21.5 --openssl 3.0.12`
    109 
    +    - `--date $date` is optional, if omitted it will be the date on which you run the command
    110 
    +  - [ ] Copy the output of the script to the beginning of `ChangeLog-TBB.txt` and adjust its output
    111 
    +- [ ] Open MR with above changes, using the template for release preparations
    112 
    +- [ ] Merge
    113 
    +- [ ] Sign+Tag
    114 
    +  - **NOTE** this must be done by one of:
    115 
    +    - boklm
    116 
    +    - dan
    117 
    +    - ma1
    118 
    +    - pierov
    119 
    +    - richard
    120 
    +  - [ ] Run: `make torbrowser-signtag-alpha`
    121 
    +  - [ ] Push tag to `upstream`
    122 
    +- [ ] Build the tag:
    123 
    +  - Run `make torbrowser-alpha && make torbrowser-incrementals-alpha`
    124 124 
         - [ ] Tor Project build machine
    125 125 
         - [ ] Local developer machine
    126 126 
       - [ ] Submit build request to Mullvad infrastructure:
    127 127 
         - **NOTE** this requires a devmole authentication token
    128 128 
         - Run `make torbrowser-kick-devmole-build`
    129 
    -  - [ ] Ensure builders have matching builds
    129 
    +- [ ] Ensure builders have matching builds
    130 130
    131 131 
     </details>
    132 132
    133 133 
     <details>
    134 134 
       <summary>Communications</summary>
    135 135
    136 
    -  ### notify stakeholders
    137 
    -
    138 
    -  - [ ] Email tor-qa mailing list: tor-qa@xxxxxxxxxxxxxxxxxxxx
    139 
    -    <details>
    140 
    -      <summary>email template</summary>
    141 
    -
    142 
    -        Subject:
    143 
    -        Tor Browser $(TOR_BROWSER_VERION) (Android, Windows, macOS, Linux)
    144 
    -
    145 
    -        Body:
    146 
    -        Hello All,
    147 
    -
    148 
    -        Unsigned Tor Browser $(TOR_BROWSER_VERSION) alpha candidate builds are now available for testing:
    149 
    -
    150 
    -        - https://tb-build-05.torproject.org/~$(BUILDER)/builds/alpha/unsigned/$(TOR_BROWSER_VERSION)/
    151 
    -
    152 
    -        The full changelog can be found here:
    153 
    -
    154 
    -        - https://gitlab.torproject.org/tpo/applications/tor-browser-build/-/raw/$(TBB_BUILD_TAG)/projects/browser/Bundle-Data/Docs-TBB/ChangeLog.txt
    155 
    -
    156 
    -    </details>
    157 
    -
    158 
    -    - ***(Optional)*** Additional information:
    159 
    -      - [ ] Note any new functionality which needs testing
    160 
    -      - [ ] Link to any known issues
    161 
    -  - [ ] ***(Optional, only around build/packaging changes)*** Email packagers:
    162 
    -    - Recipients:
    163 
    -      - Tails dev mailing list: tails-dev@xxxxxxxx
    164 
    -      - Guardian Project: nathan@xxxxxxxxxxxxxxxxxxxx
    165 
    -      - torbrowser-launcher: micah@xxxxxxxxxxxxx
    166 
    -      - FreeBSD port: freebsd@xxxxxxxxx <!-- Gitlab user maxfx -->
    167 
    -      - OpenBSD port: caspar@xxxxxxxxxxxxxx <!-- Gitlab user cschutijser -->
    168 
    -    - [ ] Note any changes which may affect packaging/downstream integration
    169 
    -  - [ ] Email external partners:
    170 
    -    - ***(Optional, after ESR migration)*** Cloudflare: ask-research@xxxxxxxxxxxxxx
    171 
    -      - **NOTE** :  We need to provide them with updated user agent string so they can update their internal machinery to prevent Tor Browser users from getting so many CAPTCHAs
    172 
    -    - ***(Optional, after ESR migration)*** Startpage: admin@xxxxxxxxxxxxx
    173 
    -      - **NOTE** : Startpage also needs the updated user-agent string for better experience on their onion service sites.
    136 
    +### notify stakeholders
    137 
    +- [ ] **(Once builds confirmed matching)** Email tor-qa mailing list with release information
    138 
    +  - [ ] tor-qa: tor-qa@xxxxxxxxxxxxxxxxxxxx
    139 
    +  - **Subject**
    140 
    +    ```
    141 
    +    Tor Browser $(TOR_BROWSER_VERION) (Android, Windows, macOS, Linux)
    142 
    +    ```
    143 
    +  - **Body**
    144 
    +    ```
    145 
    +    Hello,
    146 
    +
    147 
    +    Unsigned Tor Browser $(TOR_BROWSER_VERSION) alpha candidate builds are now available for testing:
    148 
    +
    149 
    +    - https://tb-build-02.torproject.org/~$(BUILDER)/builds/alpha/unsigned/$(TOR_BROWSER_VERSION)/
    150 
    +
    151 
    +    The full changelog can be found here:
    152 
    +
    153 
    +    - https://gitlab.torproject.org/tpo/applications/tor-browser-build/-/raw/$(TBB_BUILD_TAG)/projects/browser/Bundle-Data/Docs-TBB/ChangeLog.txt
    154 
    +    ```
    155 
    +- [ ] ***(Optional, only around build/packaging changes)*** Email packagers:
    156 
    +  - [ ] Tails dev mailing list: tails-dev@xxxxxxxx
    157 
    +  - [ ] Guardian Project: nathan@xxxxxxxxxxxxxxxxxxxx
    158 
    +  - [ ] FreeBSD port: freebsd@xxxxxxxxx <!-- Gitlab user maxfx -->
    159 
    +  - [ ] OpenBSD port: caspar@xxxxxxxxxxxxxx <!-- Gitlab user cschutijser -->
    160 
    +  - [ ] Note any changes which may affect packaging/downstream integration
    161 
    +- [ ] ***(Optional, after ESR migration)*** Email external partners:
    162 
    +  - [ ] Cloudflare: ask-research@xxxxxxxxxxxxxx
    163 
    +    - **NOTE** :  We need to provide them with updated user agent string so they can update their internal machinery to prevent Tor Browser users from getting so many CAPTCHAs
    164 
    +  - [ ]  Startpage: admin@xxxxxxxxxxxxx
    165 
    +    - **NOTE** : Startpage also needs the updated user-agent string for better experience on their onion service sites.
    174 166
    175 167 
     </details>
    176 168
    177 169 
     <details>
    178 170 
       <summary>Signing</summary>
    179 171
    180 
    -  ### signing
    181 
    -  - **NOTE** : In practice, it's most efficient to have the blog post and website updates ready to merge, since signing doesn't take very long
    182 
    -  - [ ] Assign this issue to the signer, one of:
    183 
    -    - boklm
    184 
    -    - richard
    185 
    -  - [ ] On `$(STAGING_SERVER)`, ensure updated:
    186 
    -    - [ ] `tor-browser-build` is on the right commit: `git tag -v tbb-$(TOR_BROWSER_VERSION)-$(TOR_BROWSER_BUILD_N) && git checkout tbb-$(TOR_BROWSER_VERSION)-$(TOR_BROWSER_BUILD_N)`
    187 
    -    - [ ]  `tor-browser-build/tools/signing/set-config.hosts`
    188 
    -      - `ssh_host_builder` : ssh hostname of machine with unsigned builds
    189 
    -        - **NOTE** : `tor-browser-build` is expected to be in the `$HOME` directory)
    190 
    -      - `ssh_host_linux_signer` : ssh hostname of linux signing machine
    191 
    -    - [ ] `tor-browser-build/tools/signing/set-config.rcodesign-appstoreconnect`
    192 
    -      - `appstoreconnect_api_key_path` : path to json file containing appstoreconnect api key infos
    193 
    -    - [ ] `set-config.update-responses`
    194 
    -      - `update_responses_repository_dir` : directory where you cloned `git@xxxxxxxxxxxxxxxxxxxxx:tpo/applications/tor-browser-update-responses.git`
    195 
    -    - [ ] `tor-browser-build/tools/signing/set-config.tbb-version`
    196 
    -      - `tbb_version` : tor browser version string, same as `var/torbrowser_version` in `rbm.conf` (examples: `11.5a12`, `11.0.13`)
    197 
    -      - `tbb_version_build` : the tor-browser-build build number (if `var/torbrowser_build` in `rbm.conf` is `buildN` then this value is `N`)
    198 
    -      - `tbb_version_type` : either `alpha` for alpha releases or `release` for stable releases
    199 
    -  - [ ] On `$(STAGING_SERVER)` in a separate `screen` session, ensure tor daemon is running with SOCKS5 proxy on the default port 9050
    200 
    -  - [ ] run do-all-signing script:
    201 
    -      - `cd tor-browser-build/tools/signing/`
    202 
    -      - `./do-all-signing.torbrowser`
    203 
    -  - **NOTE**: at this point the signed binaries should have been copied to `staticiforme`
    204 
    -  - [ ] Update `staticiforme.torproject.org`:
    205 
    -    - From `screen` session on `staticiforme.torproject.org`:
    206 
    -    - [ ] Static update components : `static-update-component cdn.torproject.org && static-update-component dist.torproject.org`
    207 
    -    - [ ] Enable update responses : `sudo -u tb-release ./deploy_update_responses-alpha.sh`
    208 
    -    - [ ] Remove old release data from following places:
    209 
    -      - **NOTE** : Skip this step if we need to hold on to older versions for some reason (for example, this is an Andoid or Desktop-only release, or if we need to hold back installers in favor of build-to-build updates if there are signing issues, etc)
    210 
    -      - [ ] `/srv/cdn-master.torproject.org/htdocs/aus1/torbrowser`
    211 
    -      - [ ] `/srv/dist-master.torproject.org/htdocs/torbrowser`
    212 
    -    - [ ] Static update components (again) : `static-update-component cdn.torproject.org && static-update-component dist.torproject.org`
    213 
    -  - [ ] Publish APKs to Google Play:
    214 
    -    - Log into https://play.google.com/apps/publish
    215 
    -    - Select `Tor Browser (Alpha)` app
    216 
    -    - Navigate to `Release > Production` and click `Create new release` button:
    217 
    -      - Upload the `tor-browser-android-*.apk` APKs
    218 
    -      - Update Release Name to Tor Browser version number
    219 
    -      - Update Release Notes
    220 
    -      - Next to 'Release notes', click `Copy from a previous release`
    221 
    -      - Edit blog post url to point to most recent blog post
    222 
    -    - Save, review, and configure rollout percentage
    223 
    -      - [ ] 25% rollout when publishing a scheduled update
    224 
    -      - [ ] 100% rollout when publishing a security-driven release
    225 
    -    - [ ] Update rollout percentage to 100% after confirmed no major issues
    172 
    +### release signing
    173 
    +- **NOTE** : In practice, it's most efficient to have the blog post and website updates ready to merge, since signing doesn't take very long
    174 
    +- [ ] Assign this issue to the signer, one of:
    175 
    +  - boklm
    176 
    +  - richard
    177 
    +- [ ] On `$(STAGING_SERVER)`, ensure updated:
    178 
    +  - [ ] `tor-browser-build` is on the right commit: `git tag -v tbb-$(TOR_BROWSER_VERSION)-$(TOR_BROWSER_BUILD_N) && git checkout tbb-$(TOR_BROWSER_VERSION)-$(TOR_BROWSER_BUILD_N)`
    179 
    +  - [ ] `tor-browser-build/tools/signing/set-config.hosts`
    180 
    +    - `ssh_host_builder` : ssh hostname of machine with unsigned builds
    181 
    +      - **NOTE** : `tor-browser-build` is expected to be in the `$HOME` directory)
    182 
    +    - `ssh_host_linux_signer` : ssh hostname of linux signing machine
    183 
    +  - [ ] `tor-browser-build/tools/signing/set-config.rcodesign-appstoreconnect`
    184 
    +    - `appstoreconnect_api_key_path` : path to json file containing appstoreconnect api key infos
    185 
    +  - [ ] `set-config.update-responses`
    186 
    +    - `update_responses_repository_dir` : directory where you cloned `git@xxxxxxxxxxxxxxxxxxxxx:tpo/applications/tor-browser-update-responses.git`
    187 
    +  - [ ] `tor-browser-build/tools/signing/set-config.tbb-version`
    188 
    +    - `tbb_version` : tor browser version string, same as `var/torbrowser_version` in `rbm.conf` (examples: `11.5a12`, `11.0.13`)
    189 
    +    - `tbb_version_build` : the tor-browser-build build number (if `var/torbrowser_build` in `rbm.conf` is `buildN` then this value is `N`)
    190 
    +    - `tbb_version_type` : either `alpha` for alpha releases or `release` for stable releases
    191 
    +- [ ] On `$(STAGING_SERVER)` in a separate `screen` session, ensure tor daemon is running with SOCKS5 proxy on the default port 9050
    192 
    +- [ ] On `$(STAGING_SERVER)` in a separate `screen` session, run do-all-signing script:
    193 
    +  - `cd tor-browser-build/tools/signing/`
    194 
    +  - `./do-all-signing.torbrowser`
    195 
    +- **NOTE**: at this point the signed binaries should have been copied to `staticiforme`
    196 
    +- [ ] Update `staticiforme.torproject.org`:
    197 
    +  - From `screen` session on `staticiforme.torproject.org`:
    198 
    +  - [ ] Static update components : `static-update-component cdn.torproject.org && static-update-component dist.torproject.org`
    199 
    +  - [ ] Enable update responses : `sudo -u tb-release ./deploy_update_responses-alpha.sh`
    200 
    +  - [ ] Remove old release data from following places:
    201 
    +    - **NOTE** : Skip this step if we need to hold on to older versions for some reason (for example, this is an Andoid or Desktop-only release, or if we need to hold back installers in favor of build-to-build updates if there are signing issues, etc)
    202 
    +    - [ ] `/srv/cdn-master.torproject.org/htdocs/aus1/torbrowser`
    203 
    +    - [ ] `/srv/dist-master.torproject.org/htdocs/torbrowser`
    204 
    +  - [ ] Static update components (again) : `static-update-component cdn.torproject.org && static-update-component dist.torproject.org`
    226 205
    227 206 
     </details>
    228 207
    ... ... @@ -262,55 +241,58 @@ popd
    262 241 
     <details>
    263 242 
       <summary>Publishing</summary>
    264 243
    265 
    -  ### website: https://gitlab.torproject.org/tpo/web/tpo.git
    266 
    -  - [ ] `databags/versions.ini` : Update the downloads versions
    267 
    -      - `torbrowser-stable/version` : sort of a catch-all for latest stable version
    268 
    -      - `torbrowser-alpha/version` : sort of a catch-all for latest stable version
    269 
    -      - `torbrowser-*-stable/version` : platform-specific stable versions
    270 
    -      - `torbrowser-*-alpha/version` : platform-specific alpha versions
    271 
    -      - `tor-stable`,`tor-alpha` : set by tor devs, do not touch
    272 
    -  - [ ] Push to origin as new branch, open 'Draft :' MR
    273 
    -  - [ ] Remove `Draft:` from MR once signed-packages are uploaded
    274 
    -  - [ ] Merge
    275 
    -  - [ ] Publish after CI passes and builds are published
    276 
    -
    277 
    -  ### blog: https://gitlab.torproject.org/tpo/web/blog.git
    278 
    -  - [ ] Duplicate previous Stable or Alpha release blog post as appropriate to new directory under `content/blog/new-release-tor-browser-$(TOR_BROWSER_VERSION)` and update with info on release :
    279 
    -      - [ ] Run `tools/signing/create-blog-post` which should create the new blog post from a template (edit set-config.blog to set you local blog directory)
    280 
    -      - [ ] Update Tor Browser version numbers
    281 
    -      - [ ] Note any ESR rebase
    282 
    -      - [ ] Link to any Firefox security updates from ESR upgrade
    283 
    -      - [ ] Link to any Android-specific security backports
    284 
    -      - [ ] Note any updates to :
    285 
    -        - tor
    286 
    -        - OpenSSL
    287 
    -        - NoScript
    288 
    -      - [ ] Convert ChangeLog-TBB.txt to markdown format used here by :
    289 
    -        - `tor-browser-build/tools/changelog-format-blog-post`
    290 
    -  - [ ] Push to origin as new branch, open `Draft:` MR
    291 
    -  - [ ] Remove `Draft:` from MR once signed-packages are uploaded
    292 
    -  - [ ] Merge
    293 
    -  - [ ] Publish after CI passes and website has been updated
    294 
    -
    295 
    -  ### tor-announce mailing list
    296 
    -  - [ ] Email tor-announce mailing list: tor-announce@xxxxxxxxxxxxxxxxxxxx
    297 
    -    <details>
    298 
    -      <summary>email template</summary>
    299 
    -
    300 
    -        Subject:
    301 
    -        New Release: Tor Browser $(TOR_BROWSER_VERSION) (Android, Windows, macOS, Linux)
    302 
    -
    303 
    -        Body:
    304 
    -        Hi everyone,
    305 
    -
    306 
    -        Tor Browser $(TOR_BROWSER_VERSION) has now been published for all platforms. For details please see our blog post:
    307 
    -
    308 
    -        - $(BLOG_POST_URL)
    309 
    -
    310 
    -    </details>
    311 
    -
    312 
    -    - **(Optional)** Additional information:
    313 
    -      - [ ] Link to any known issues
    244 
    +### Google Play: https://play.google.com/apps/publish
    245 
    +- [ ] Publish APKs to Google Play:
    246 
    +  - Select `Tor Browser (Alpha)` app
    247 
    +  - Navigate to `Release > Production` and click `Create new release` button:
    248 
    +    - Upload the `tor-browser-android-*.apk` APKs
    249 
    +    - Update Release Name to Tor Browser version number
    250 
    +    - Update Release Notes
    251 
    +    - Next to 'Release notes', click `Copy from a previous release`
    252 
    +    - Edit blog post url to point to most recent blog post
    253 
    +  - Save, review, and configure rollout percentage
    254 
    +    - [ ] 25% rollout when publishing a scheduled update
    255 
    +    - [ ] 100% rollout when publishing a security-driven release
    256 
    +  - [ ] Update rollout percentage to 100% after confirmed no major issues
    257 
    +
    258 
    +### website: https://gitlab.torproject.org/tpo/web/tpo.git
    259 
    +- [ ] `databags/versions.ini` : Update the downloads versions
    260 
    +    - `torbrowser-stable/version` : sort of a catch-all for latest stable version
    261 
    +    - `torbrowser-alpha/version` : sort of a catch-all for latest stable version
    262 
    +    - `torbrowser-*-stable/version` : platform-specific stable versions
    263 
    +    - `torbrowser-*-alpha/version` : platform-specific alpha versions
    264 
    +    - `tor-stable`,`tor-alpha` : set by tor devs, do not touch
    265 
    +- [ ] Push to origin as new branch, open 'Draft :' MR
    266 
    +- [ ] Remove `Draft:` from MR once signed-packages are accessible on https://dist.torproject.org
    267 
    +- [ ] Merge
    268 
    +- [ ] Publish after CI passes and builds are published
    269 
    +
    270 
    +### blog: https://gitlab.torproject.org/tpo/web/blog.git
    271 
    +- [ ] Run `tools/signing/create-blog-post` which should create the new blog post from a template (edit set-config.blog to set you local blog directory)
    272 
    +  - [ ] Note any ESR update
    273 
    +  - [ ] Note any updates to dependencies (OpenSSL, zlib, NoScript, tor, etc)
    274 
    +  - [ ] Thank any users which have contributed patches
    275 
    +  - [ ] **(Optional)** Draft any additional sections for new features which need testing, known issues, etc
    276 
    +- [ ] Push to origin as new branch, open `Draft:` MR
    277 
    +- [ ] Merge once signed-packages are accessible on https://dist.torproject.org
    278 
    +- [ ] Publish after CI passes and website has been updated
    279 
    +
    280 
    +### tor-announce mailing list
    281 
    +- [ ] Email tor-announce mailing list: tor-announce@xxxxxxxxxxxxxxxxxxxx
    282 
    +  - **Subject**
    283 
    +    ```
    284 
    +    New Release: Tor Browser $(TOR_BROWSER_VERSION) (Android, Windows, macOS, Linux)
    285 
    +    ```
    286 
    +  - **Body**
    287 
    +    ```
    288 
    +    Hi everyone,
    289 
    +
    290 
    +    Tor Browser $(TOR_BROWSER_VERSION) has now been published for all platforms. For details please see our blog post:
    291 
    +    - $(BLOG_POST_URL)
    292 
    +
    293 
    +    Changelog:
    294 
    +    # paste changleog as quote here
    295 
    +    ```
    314 296
    315 297 
     </details>
    316 298

  • .gitlab/issue_templates/Release Prep - Tor Browser Stable.md
    ... ... @@ -27,29 +27,24 @@
    27 27 
     </details>
    28 28
    29 29 
     **NOTE** It is assumed that the `tor-browser` stable rebase and security backport tasks have been completed
    30 
    +**NOTE** This can/is often done in conjunction with the equivalent Mullvad Browser release prep issue
    30 31
    31 32 
     <details>
    32 33 
       <summary>Building</summary>
    33 34
    34 35 
     ### tor-browser-build: https://gitlab.torproject.org/tpo/applications/tor-browser-build.git
    35 
    -Tor Browser Stable lives in the various `maint-$(TOR_BROWSER_MAJOR).$(TOR_BROWSER_MINOR)` (and possibly more specific) branches
    36 
    +Tor Browser Stable lives in the various `maint-$(TOR_BROWSER_MAJOR).$(TOR_BROWSER_MINOR)` (and possibly more specific) branches.
    36 37
    37 38 
     - [ ] Update `rbm.conf`
    38 39 
       - [ ] `var/torbrowser_version` : update to next version
    39 40 
       - [ ] `var/torbrowser_build` : update to `$(TOR_BROWSER_BUILD_N)`
    40 41 
       - [ ] ***(Desktop Only)***`var/torbrowser_incremental_from` : update to previous Desktop version
    42 
    +    - **NOTE**: We try to build incrementals for the previous 3 desktop versions except in the case of a watershed update
    41 43 
         - **IMPORTANT**: Really *actually* make sure this is the previous Desktop version or else the `make torbrowser-incrementals-*` step will fail
    42 44 
     - [ ] Update Desktop-specific build configs
    43 45 
       - [ ] Update `projects/firefox/config`
    44 46 
         - [ ] `browser_build` : update to match `tor-browser` tag
    45 47 
         - [ ] ***(Optional)*** `var/firefox_platform_version` : update to latest `$(ESR_VERSION)` if rebased
    46 
    -  - [ ] Update `projects/translation/config`:
    47 
    -    - [ ] run `make list_translation_updates-release` to get updated hashes
    48 
    -    - [ ] Update `projects/translation/config`:
    49 
    -      - [ ] run `make list_translation_updates-alpha` to get updated hashes
    50 
    -      - [ ] `steps/base-browser/git_hash` : update with `HEAD` commit of project's `base-browser` branch
    51 
    -      - [ ] `steps/tor-browser/git_hash` : update with `HEAD` commit of project's `tor-browser` branch
    52 
    -      - [ ] `steps/fenix/git_hash` : update with `HEAD` commit of project's `fenix-torbrowserstringsxml` branch
    53 48 
     - [ ] Update Android-specific build configs
    54 49 
       - [ ] Update `projects/geckoview/config`
    55 50 
         - [ ] `browser_build` : update to match `tor-browser` tag
    ... ... @@ -60,27 +55,32 @@ Tor Browser Stable lives in the various `maint-$(TOR_BROWSER_MAJOR).$(TOR_BROWSE
    60 55 
         **NOTE** we don't currently have any of our own patches for this project
    61 56 
         - [ ] `git_hash` : update to appropriate git commit associated with `$(ESR_VERSION)`
    62 57 
       - [ ] ***(Optional)*** Update `projects/firefox-android/config`:
    63 
    -      - [ ] `fenix_version` : update to match alpha `firefox-android` build tag
    64 
    -      - [ ] `browser_branch` : update to match alpha `firefox-android` build tag
    58 
    +    - [ ] `fenix_version` : update to match alpha `firefox-android` build tag
    59 
    +    - [ ] `browser_branch` : update to match alpha `firefox-android` build tag
    65 60 
       - [ ] Update allowed_addons.json by running (from `tor-browser-build` root):
    66 61 
         - `./tools/fetch_allowed_addons.py > projects/browser/allowed_addons.json`
    62 
    +- [ ] Update `projects/translation/config`:
    63 
    +  - [ ] run `make list_translation_updates-release` to get updated hashes
    64 
    +  - [ ] `steps/base-browser/git_hash` : update with `HEAD` commit of project's `base-browser` branch
    65 
    +  - [ ] `steps/tor-browser/git_hash` : update with `HEAD` commit of project's `tor-browser` branch
    66 
    +  - [ ] `steps/fenix/git_hash` : update with `HEAD` commit of project's `fenix-torbrowserstringsxml` branch
    67 67 
     - [ ] Update common build configs
    68 68 
       - [ ] Check for NoScript updates here : https://addons.mozilla.org/en-US/firefox/addon/noscript
    69 69 
         - [ ] ***(Optional)*** If new version available, update `noscript` section of `input_files` in `projects/browser/config`
    70 70 
           - [ ] `URL`
    71 71 
           - [ ] `sha256sum`
    72 72 
       - [ ] Check for OpenSSL updates here : https://www.openssl.org/source/
    73 
    -    - [ ] ***(Optional)*** If new 1.X.Y version available, update `projects/openssl/config`
    74 
    -      - [ ] `version` : update to next 1.X.Y version
    73 
    +    - [ ] ***(Optional)*** If new 3.0.X version available, update `projects/openssl/config`
    74 
    +      - [ ] `version` : update to next 3.0.X version
    75 75 
           - [ ] `input_files/sha256sum` : update to sha256 sum of source tarball
    76 76 
       - [ ] Check for zlib updates here: https://github.com/madler/zlib/releases
    77 77 
         - [ ] **(Optional)** If new tag available, update `projects/zlib/config`
    78 78 
           - [ ] `version` : update to next release tag
    79 79 
       - [ ] Check for tor updates here : https://gitlab.torproject.org/tpo/core/tor/-/tags
    80 
    -    - [ ] ***(Optional)*** Update `projects/tor/config`
    80 
    +    - [ ] ***(Optional)*** Update `projects/tor/config`
    81 81 
           - [ ] `version` : update to latest non `-alpha` tag (ping dgoulet or ahf if unsure)
    82 82 
       - [ ] Check for go updates here : https://go.dev/dl
    83 
    -    - **NOTE** : Tor Browser Stable uses the latest of the *previous* Stable major series go version (apart from the transition phase from Tor Browser Alpha to Stable, in which case Tor Browser Stable may use the latest major series go version)
    83 
    +    - **NOTE** : In general, Tor Browser Stable uses the latest of the *previous* Stable major series Go version, but there are sometimes exceptions. Check with the anti-censorship team before doing a major version update in case there is incompatibilities.
    84 84 
         - [ ] ***(Optional)*** Update `projects/go/config`
    85 85 
           - [ ] `version` : update go version
    86 86 
           - [ ] `input_files/sha256sum` for `go` : update sha256sum of archive (sha256 sums are displayed on the go download page)
    ... ... @@ -88,7 +88,7 @@ Tor Browser Stable lives in the various `maint-$(TOR_BROWSER_MAJOR).$(TOR_BROWSE
    88 88 
         - [ ] ***(Optional)*** If new version is available:
    89 89 
           - [ ] Upload the downloaded `manual_$PIPELINEID.zip` file to `tb-build-02.torproject.org`
    90 90 
           - [ ] Deploy to `tb-builder`'s `public_html` directory:
    91 
    -        - `sudo -u tb-builder cp manual_$PIPELINEID.zip ~/../tb-builder/public_html/.`
    91 
    +        - `sudo -u tb-builder cp manual_$PIPELINEID.zip ~tb-builder/public_html/.`
    92 92 
           - [ ] Update `projects/manual/config`:
    93 93 
             - [ ] Change the `version` to `$PIPELINEID`
    94 94 
             - [ ] Update `sha256sum` in the `input_files` section
    ... ... @@ -108,25 +108,25 @@ Tor Browser Stable lives in the various `maint-$(TOR_BROWSER_MAJOR).$(TOR_BROWSE
    108 108 
           - E.g., `tools/fetch-changelogs.py 41028 --date 'December 19 2023' --firefox 115.6.0esr --tor 0.4.8.10 --no-script 11.4.29 --zlib 1.3 --go 1.21.5 --openssl 3.0.12`
    109 109 
         - `--date $date` is optional, if omitted it will be the date on which you run the command
    110 110 
       - [ ] Copy the output of the script to the beginning of `ChangeLog-TBB.txt` and adjust its output
    111 
    -  - [ ] Open MR with above changes, using the template for release preparations
    112 
    -  - [ ] Merge
    113 
    -  - [ ] Sign+Tag
    114 
    -    - **NOTE** this must be done by one of:
    115 
    -      - boklm
    116 
    -      - dan
    117 
    -      - ma1
    118 
    -      - pierov
    119 
    -      - richard
    120 
    -    - [ ] Run: `make torbrowser-signtag-release`
    121 
    -    - [ ] Push tag to `upstream`
    122 
    -  - [ ] Build on at least one of:
    123 
    -    - Run `make torbrowser-release && make torbrowser-incrementals-release`
    111 
    +- [ ] Open MR with above changes, using the template for release preparations
    112 
    +- [ ] Merge
    113 
    +- [ ] Sign+Tag
    114 
    +  - **NOTE** this must be done by one of:
    115 
    +    - boklm
    116 
    +    - dan
    117 
    +    - ma1
    118 
    +    - pierov
    119 
    +    - richard
    120 
    +  - [ ] Run: `make torbrowser-signtag-release`
    121 
    +  - [ ] Push tag to `upstream`
    122 
    +- [ ] Build the tag:
    123 
    +  - Run `make torbrowser-release && make torbrowser-incrementals-release`
    124 124 
         - [ ] Tor Project build machine
    125 125 
         - [ ] Local developer machine
    126 126 
       - [ ] Submit build request to Mullvad infrastructure:
    127 127 
         - **NOTE** this requires a devmole authentication token
    128 128 
         - Run `make torbrowser-kick-devmole-build`
    129 
    -  - [ ] Ensure builders have matching builds
    129 
    +- [ ] Ensure builders have matching builds
    130 130
    131 131 
     </details>
    132 132
    ... ... @@ -134,49 +134,44 @@ Tor Browser Stable lives in the various `maint-$(TOR_BROWSER_MAJOR).$(TOR_BROWSE
    134 134 
       <summary>Communications</summary>
    135 135
    136 136 
     ### notify stakeholders
    137 
    +- [ ] **(Once builds confirmed matching)** Email tor-qa mailing list with release information
    138 
    +  - [ ] tor-qa: tor-qa@xxxxxxxxxxxxxxxxxxxx
    139 
    +  - **Subject**
    140 
    +    ```
    141 
    +    Tor Browser $(TOR_BROWSER_VERION) (Android, Windows, macOS, Linux)
    142 
    +    ```
    143 
    +  - **Body**
    144 
    +    ```
    145 
    +    Hello,
    137 146
    138 
    -  <details>
    139 
    -    <summary>email template</summary>
    140 
    -
    141 
    -      Subject:
    142 
    -      Tor Browser $(TOR_BROWSER_VERION) (Android, Windows, macOS, Linux)
    143 
    -
    144 
    -      Body:
    145 
    -      Hello All,
    146 
    -
    147 
    -      Unsigned Tor Browser $(TOR_BROWSER_VERSION) release candidate builds are now available for testing:
    148 
    -
    149 
    -      - https://tb-build-05.torproject.org/~$(BUILDER)/builds/release/unsigned/$(TOR_BROWSER_VERSION)/
    150 
    -
    151 
    -      The full changelog can be found here:
    147 
    +    Unsigned Tor Browser $(TOR_BROWSER_VERSION) release candidate builds are now available for testing:
    152 148
    153 
    -      - https://gitlab.torproject.org/tpo/applications/tor-browser-build/-/blob/$(TBB_BUILD_TAG)/ChangeLog.txt
    149 
    +    - https://tb-build-02.torproject.org/~$(BUILDER)/builds/release/unsigned/$(TOR_BROWSER_VERSION)/
    154 150
    155 
    -  </details>
    151 
    +    The full changelog can be found here:
    156 152
    157 
    -- [ ] Email tor-qa mailing list: tor-qa@xxxxxxxxxxxxxxxxxxxx
    158 
    -  - ***(Optional)*** Additional information:
    159 
    -    - [ ] Note any new functionality which needs testing
    160 
    -    - [ ] Link to any known issues
    153 
    +    - https://gitlab.torproject.org/tpo/applications/tor-browser-build/-/raw/$(TBB_BUILD_TAG)/projects/browser/Bundle-Data/Docs-TBB/ChangeLog.txt
    154 
    +    ```
    161 155 
     - [ ] Email packagers:
    162 
    -  - Recipients:
    163 
    -    - Tails dev mailing list: tails-dev@xxxxxxxx
    164 
    -    - Guardian Project: nathan@xxxxxxxxxxxxxxxxxxxx
    165 
    -    - torbrowser-launcher: micah@xxxxxxxxxxxxx
    166 
    -    - FreeBSD port: freebsd@xxxxxxxxx <!-- Gitlab user maxfx -->
    167 
    -    - OpenBSD port: caspar@xxxxxxxxxxxxxx <!-- Gitlab user cschutijser -->
    168 
    -  - [ ] ***(Optional)*** Note any changes which may affect packaging/downstream integration
    156 
    +  - [ ] Tails dev mailing list: tails-dev@xxxxxxxx
    157 
    +  - [ ] Guardian Project: nathan@xxxxxxxxxxxxxxxxxxxx
    158 
    +  - [ ] FreeBSD port: freebsd@xxxxxxxxx <!-- Gitlab user maxfx -->
    159 
    +  - [ ] OpenBSD port: caspar@xxxxxxxxxxxxxx <!-- Gitlab user cschutijser -->
    160 
    +  - [ ] Note any changes which may affect packaging/downstream integration
    169 161
    170 162 
     </details>
    171 163
    172 164 
     <details>
    173 165 
       <summary>Signing</summary>
    174 166
    175 
    -### signing
    167 
    +### release signing
    176 168 
     - **NOTE** : In practice, it's most efficient to have the blog post and website updates ready to merge, since signing doesn't take very long
    169 
    +- [ ] Assign this issue to the signer, one of:
    170 
    +  - boklm
    171 
    +  - richard
    177 172 
     - [ ] On `$(STAGING_SERVER)`, ensure updated:
    178 173 
       - [ ] `tor-browser-build` is on the right commit: `git tag -v tbb-$(TOR_BROWSER_VERSION)-$(TOR_BROWSER_BUILD_N) && git checkout tbb-$(TOR_BROWSER_VERSION)-$(TOR_BROWSER_BUILD_N)`
    179 
    -  - [ ]  `tor-browser-build/tools/signing/set-config.hosts`
    174 
    +  - [ ] `tor-browser-build/tools/signing/set-config.hosts`
    180 175 
         - `ssh_host_builder` : ssh hostname of machine with unsigned builds
    181 176 
           - **NOTE** : `tor-browser-build` is expected to be in the `$HOME` directory)
    182 177 
         - `ssh_host_linux_signer` : ssh hostname of linux signing machine
    ... ... @@ -189,9 +184,9 @@ Tor Browser Stable lives in the various `maint-$(TOR_BROWSER_MAJOR).$(TOR_BROWSE
    189 184 
         - `tbb_version_build` : the tor-browser-build build number (if `var/torbrowser_build` in `rbm.conf` is `buildN` then this value is `N`)
    190 185 
         - `tbb_version_type` : either `alpha` for alpha releases or `release` for stable releases
    191 186 
     - [ ] On `$(STAGING_SERVER)` in a separate `screen` session, ensure tor daemon is running with SOCKS5 proxy on the default port 9050
    192 
    -- [ ] run do-all-signing script:
    193 
    -    - `cd tor-browser-build/tools/signing/`
    194 
    -    - `./do-all-signing.torbrowser`
    187 
    +- [ ] On `$(STAGING_SERVER)` in a separate `screen` session, run do-all-signing script:
    188 
    +  - `cd tor-browser-build/tools/signing/`
    189 
    +  - `./do-all-signing.torbrowser`
    195 190 
     - **NOTE**: at this point the signed binaries should have been copied to `staticiforme`
    196 191 
     - [ ] Update `staticiforme.torproject.org`:
    197 192 
       - From `screen` session on `staticiforme.torproject.org`:
    ... ... @@ -201,20 +196,7 @@ Tor Browser Stable lives in the various `maint-$(TOR_BROWSER_MAJOR).$(TOR_BROWSE
    201 196 
         - **NOTE** : Skip this step if we need to hold on to older versions for some reason (for example, this is an Andoid or Desktop-only release, or if we need to hold back installers in favor of build-to-build updates if there are signing issues, etc)
    202 197 
         - [ ] `/srv/cdn-master.torproject.org/htdocs/aus1/torbrowser`
    203 198 
         - [ ] `/srv/dist-master.torproject.org/htdocs/torbrowser`
    204 
    -- [ ] Static update components (again) : `static-update-component cdn.torproject.org && static-update-component dist.torproject.org`
    205 
    -- [ ] Publish APKs to Google Play:
    206 
    -  - Log into https://play.google.com/apps/publish
    207 
    -  - Select `Tor Browser` app
    208 
    -  - Navigate to `Release > Production` and click `Create new release` button:
    209 
    -    - Upload the `tor-browser-android-*.apk` APKs
    210 
    -    - Update Release Name to Tor Browser version number
    211 
    -    - Update Release Notes
    212 
    -    - Next to 'Release notes', click `Copy from a previous release`
    213 
    -    - Edit blog post url to point to most recent blog post
    214 
    -  - Save, review, and configure rollout percentage
    215 
    -    - [ ] 25% rollout when publishing a scheduled update
    216 
    -    - [ ] 100% rollout when publishing a security-driven release
    217 
    -  - [ ] Update rollout percentage to 100% after confirmed no major issues
    199 
    +  - [ ] Static update components (again) : `static-update-component cdn.torproject.org && static-update-component dist.torproject.org`
    218 200
    219 201 
     </details>
    220 202
    ... ... @@ -223,33 +205,51 @@ Tor Browser Stable lives in the various `maint-$(TOR_BROWSER_MAJOR).$(TOR_BROWSE
    223 205
    224 206 
       <details>
    225 207 
         <summary>Check whether the .exe files got properly signed and timestamped</summary>
    226 
    -    ```
    227 
    -    # Point OSSLSIGNCODE to your osslsigncode binary
    228 
    -    pushd tor-browser-build/${channel}/signed/$TORBROWSER_VERSION
    229 
    -    OSSLSIGNCODE=/path/to/osslsigncode
    230 
    -    ../../../tools/authenticode_check.sh
    231 
    -    popd
    232 
    -    ```
    208 
    +
    209 
    +```bash
    210 
    +# Point OSSLSIGNCODE to your osslsigncode binary
    211 
    +pushd tor-browser-build/${channel}/signed/$TORBROWSER_VERSION
    212 
    +OSSLSIGNCODE=/path/to/osslsigncode
    213 
    +../../../tools/authenticode_check.sh
    214 
    +popd
    215 
    +```
    216 
    +
    233 217 
       </details>
    234 218 
       <details>
    235 219 
         <summary>Check whether the MAR files got properly signed</summary>
    236 
    -    ```
    237 
    -    # Point NSSDB to your nssdb containing the mar signing certificate
    238 
    -    # Point SIGNMAR to your signmar binary
    239 
    -    # Point LD_LIBRARY_PATH to your mar-tools directory
    240 
    -    pushd tor-browser-build/${channel}/signed/$TORBROWSER_VERSION
    241 
    -    NSSDB=/path/to/nssdb
    242 
    -    SIGNMAR=/path/to/mar-tools/signmar
    243 
    -    LD_LIBRARY_PATH=/path/to/mar-tools/
    244 
    -    ../../../tools/marsigning_check.sh
    245 
    -    popd
    246 
    -    ```
    220 
    +
    221 
    +```bash
    222 
    +# Point NSSDB to your nssdb containing the mar signing certificate
    223 
    +# Point SIGNMAR to your signmar binary
    224 
    +# Point LD_LIBRARY_PATH to your mar-tools directory
    225 
    +pushd tor-browser-build/${channel}/signed/$TORBROWSER_VERSION
    226 
    +NSSDB=/path/to/nssdb
    227 
    +SIGNMAR=/path/to/mar-tools/signmar
    228 
    +LD_LIBRARY_PATH=/path/to/mar-tools/
    229 
    +../../../tools/marsigning_check.sh
    230 
    +popd
    231 
    +```
    232 
    +
    247 233 
       </details>
    248 234 
     </details>
    249 235
    250 236 
     <details>
    251 237 
       <summary>Publishing</summary>
    252 238
    239 
    +### Google Play: https://play.google.com/apps/publish
    240 
    +- [ ] Publish APKs to Google Play:
    241 
    +  - Select `Tor Browser` app
    242 
    +  - Navigate to `Release > Production` and click `Create new release` button:
    243 
    +    - Upload the `tor-browser-android-*.apk` APKs
    244 
    +    - Update Release Name to Tor Browser version number
    245 
    +    - Update Release Notes
    246 
    +    - Next to 'Release notes', click `Copy from a previous release`
    247 
    +    - Edit blog post url to point to most recent blog post
    248 
    +  - Save, review, and configure rollout percentage
    249 
    +    - [ ] 25% rollout when publishing a scheduled update
    250 
    +    - [ ] 100% rollout when publishing a security-driven release
    251 
    +  - [ ] Update rollout percentage to 100% after confirmed no major issues
    252 
    +
    253 253 
     ### website: https://gitlab.torproject.org/tpo/web/tpo.git
    254 254 
     - [ ] `databags/versions.ini` : Update the downloads versions
    255 255 
         - `torbrowser-stable/version` : sort of a catch-all for latest stable version
    ... ... @@ -258,49 +258,37 @@ Tor Browser Stable lives in the various `maint-$(TOR_BROWSER_MAJOR).$(TOR_BROWSE
    258 258 
         - `torbrowser-*-alpha/version` : platform-specific alpha versions
    259 259 
         - `tor-stable`,`tor-alpha` : set by tor devs, do not touch
    260 260 
     - [ ] Push to origin as new branch, open 'Draft :' MR
    261 
    -- [ ] Remove `Draft:` from MR once signed-packages are uploaded
    261 
    +- [ ] Remove `Draft:` from MR once signed-packages are accessible on https://dist.torproject.org
    262 262 
     - [ ] Merge
    263 263 
     - [ ] Publish after CI passes and builds are published
    264 264
    265 265 
     ### blog: https://gitlab.torproject.org/tpo/web/blog.git
    266 
    -
    267 
    -- [ ] Duplicate previous Stable or Alpha release blog post as appropriate to new directory under `content/blog/new-release-tor-browser-$(TOR_BROWSER_VERSION)` and update with info on release :
    268 
    -    - [ ] Run `tools/signing/create-blog-post` which should create the new blog post from a template (edit set-config.blog to set you local blog directory)
    269 
    -    - [ ] Update Tor Browser version numbers
    270 
    -    - [ ] Note any ESR rebase
    271 
    -    - [ ] Link to any Firefox security updates from ESR upgrade
    272 
    -    - [ ] Link to any Android-specific security backports
    273 
    -    - [ ] Note any updates to :
    274 
    -      - tor
    275 
    -      - OpenSSL
    276 
    -      - NoScript
    277 
    -    - [ ] Convert ChangeLog.txt to markdown format used here by :
    278 
    -      - `tor-browser-build/tools/changelog-format-blog-post`
    266 
    +- [ ] Run `tools/signing/create-blog-post` which should create the new blog post from a template (edit set-config.blog to set you local blog directory)
    267 
    +  - [ ] Note any ESR update
    268 
    +  - [ ] Note any updates to dependencies (OpenSSL, zlib, NoScript, tor, etc)
    269 
    +  - [ ] Thank any users which have contributed patches
    279 270 
     - [ ] Push to origin as new branch, open `Draft:` MR
    280 
    -- [ ] Remove `Draft:` from MR once signed-packages are uploaded
    281 
    -- [ ] Merge
    271 
    +- [ ] Merge once signed-packages are accessible on https://dist.torproject.org
    282 272 
     - [ ] Publish after CI passes and website has been updated
    283 273
    284 274 
     ### tor-announce mailing list
    285 
    -  <details>
    286 
    -    <summary>email template</summary>
    287 
    -
    288 
    -      Subject:
    289 
    -      New Release: Tor Browser $(TOR_BROWSER_VERSION) (Android, Windows, macOS, Linux)
    290 
    -
    291 
    -      Body:
    292 
    -      Hi everyone,
    293 
    -
    294 
    -      Tor Browser $(TOR_BROWSER_VERSION) has now been published for all platforms. For details please see our blog post:
    295 
    -
    296 
    -      - $(BLOG_POST_URL)
    275 
    +- [ ] Email tor-announce mailing list: tor-announce@xxxxxxxxxxxxxxxxxxxx
    276 
    +  - **Subject**
    277 
    +    ```
    278 
    +    New Release: Tor Browser $(TOR_BROWSER_VERSION) (Android, Windows, macOS, Linux)
    279 
    +    ```
    280 
    +  - **Body**
    281 
    +    ```
    282 
    +    Hi everyone,
    297 283
    298 
    -  </details>
    284 
    +    Tor Browser $(TOR_BROWSER_VERSION) has now been published for all platforms. For details please see our blog post:
    285 
    +    - $(BLOG_POST_URL)
    299 286
    300 
    -- [ ] Email tor-announce mailing list: tor-announce@xxxxxxxxxxxxxxxxxxxx
    301 
    -  - **(Optional)** Additional information:
    302 
    -    - [ ] Link to any known issues
    287 
    +    Changelog:
    288 
    +    # paste changleog as quote here
    289 
    +    ```
    303 290
    304 291 
     </details>
    305 292
    306 293 
     /label ~"Release Prep"
    294 
    +

    • —
    View it on GitLab.
    You're receiving this email because of your account on gitlab.torproject.org. Manage all notifications · Help 

    _______________________________________________
tor-commits mailing list
tor-commits@xxxxxxxxxxxxxxxxxxxx
https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-commits