[tor-commits] [Git][tpo/applications/tor-browser][tor-browser-156.0a1-17.0-2] 12 commits: fixup! Tor Browser localization migration scripts.

Pier Angelo Vendrame pushed to branch tor-browser-156.0a1-17.0-2 at The Tor Project / Applications / Tor Browser

Commits:

60b70f9f

by Henry Wilkes at 2026-11-11T08:59:14+01:00

fixup! Tor Browser localization migration scripts.

TB 45433: Change the script to be more versatile for test runs.

Instead of passing in a python module name for the recipe, you now pass
in the file path to the recipe script.

You can now change the reference directory with the
--reference-directory argument, which is useful for testing scripts
before the changes have reached the translation repository.

b7ea5196

by Henry Wilkes at 2026-11-11T08:59:15+01:00

fixup! Tor Browser localization migration scripts.

TB 45433: Refactor the WeblateMetadata class.

We are stricter about checking the return types from the weblate API,
and making sure it doesn't make requests to unexpected URLs.

We also limit the components to the browser components, and we slightly
alter the `is_translated` public method.

873fe4a3

by Henry Wilkes at 2026-11-11T08:59:15+01:00

fixup! Tor Browser localization migration scripts.

TB 45433: Add type hints to the script.

42d45b17

by Henry Wilkes at 2026-11-11T08:59:15+01:00

fixup! Tor Browser localization migration scripts.

TB 45433: Update the migrate.py documentation.

01dfa930
by hackademix at 2026-11-11T08:59:52+01:00
```
BB 45438: Use OneCRL dump from 153esr
```

ee6f9f1d

by Dana Keeler at 2026-11-11T08:59:54+01:00

Bug 2084311 - ensure OneCRL bundle is loaded at init a=RyanVM

Original Revision: https://phabricator.services.mozilla.com/D335790

Differential Revision: https://phabricator.services.mozilla.com/D335837

a3805da7

by Elena at 2026-11-11T08:59:55+01:00

fixup! TB 40933: Add tor-launcher functionality

TB 45425: Use an actual XPCOM type for status updates.

e77d5e6c

by Elena at 2026-11-11T08:59:55+01:00

fixup! TB 31286: Implementation of bridge, proxy, and firewall settings in about:preferences#connection

TB 45425: Use an actual XPCOM type for status updates.

7ed1acfb

by Elena at 2026-11-11T08:59:55+01:00

fixup! TB 42247: Android helpers for the TorProvider

TB 45425: Use an actual XPCOM type for status updates.

cceebf2f

by Elena at 2026-11-11T08:59:55+01:00

fixup! TB 3455: Add DomainIsolator, for isolating circuit by domain.

TB 45425: Use an actual XPCOM type for provider topics.

96898066

by Pier Angelo Vendrame at 2026-11-11T08:59:56+01:00

fixup! TB 41600: Add a tor circuit display panel.

TB 45425: Use an explicit boolean for bridges in NodeData

bd6af55f

by Dan Ballard at 2026-11-11T08:59:56+01:00

fixup! [android] Override settings

TB 45365: Disable IPProtect for all in nimbus

17 changed files:

browser/components/torcircuit/content/torCircuitPanel.js
browser/components/torpreferences/content/torLogDialog.js
mobile/android/fenix/app/nimbus.fml.yaml
security/manager/ssl/RemoteSecuritySettings.sys.mjs
+ security/manager/ssl/tests/unit/test_onecrl_loads_bundle.js
security/manager/ssl/tests/unit/xpcshell.toml
services/settings/dumps/security-state/onecrl.json
toolkit/components/tor-launcher/TorBootstrapRequest.sys.mjs
toolkit/components/tor-launcher/TorDomainIsolator.sys.mjs
toolkit/components/tor-launcher/TorLauncherUtil.sys.mjs
toolkit/components/tor-launcher/TorProvider.sys.mjs
toolkit/components/tor-launcher/TorProviderBuilder.sys.mjs
toolkit/components/tor-launcher/TorProviderMock.sys.mjs
toolkit/components/tor-launcher/moz.build
+ toolkit/components/tor-launcher/tor-launcher.idl
toolkit/modules/TorAndroidIntegration.sys.mjs
tools/torbrowser/l10n/migrate.py

Changes:

browser/components/torcircuit/content/torCircuitPanel.js

@@ -547,9 +547,9 @@ var gTorCircuitPanel = {
      // bridge, or otherwise a guard.
      document.l10n.setAttributes(
        this._panelElements.newCircuitDescription,
 -      nodes[0].bridgeType === null
 -        ? "tor-circuit-panel-new-button-description-guard"
 -        : "tor-circuit-panel-new-button-description-bridge"
 +      nodes[0].isBridge
 +        ? "tor-circuit-panel-new-button-description-bridge"
 +        : "tor-circuit-panel-new-button-description-guard"
      );
    },
@@ -565,7 +565,7 @@ var gTorCircuitPanel = {
      const nameEl = nodeItem.querySelector(".tor-circuit-node-name");
      let flagSrc = null;
 -    if (node.bridgeType === null) {
 +    if (!node.isBridge) {
        const regionCode = node.regionCode;
        flagSrc = this._regionFlagSrc(regionCode);

browser/components/torpreferences/content/torLogDialog.js

@@ -87,7 +87,13 @@ const gTorLogDialog = {
    observe(subject, topic) {
      if (topic === TorProviderTopics.TorLog) {
 -      this.addLogEntry(subject.wrappedJSObject, false);
 +      let entry;
 +      try {
 +        entry = subject.QueryInterface(Ci.torITorLogEntry);
 +      } catch {
 +        return;
 +      }
 +      this.addLogEntry(entry, false);
+     }
    },
@@ -96,7 +102,7 @@ const gTorLogDialog = {
      timeEl.textContent = logEntry.timestamp;
      timeEl.classList.add("time");
      const messageEl = document.createElement("td");
 -    messageEl.textContent = `[${logEntry.type}] ${logEntry.msg}`;
 +    messageEl.textContent = `[${logEntry.severity}] ${logEntry.message}`;
      messageEl.classList.add("message");
      const row = document.createElement("tr");

mobile/android/fenix/app/nimbus.fml.yaml

@@ -1082,14 +1082,13 @@ features:
      defaults:
        - channel: developer
          value:
 -          enabled: true
 -          allowed-regions: ["XX"]
 +          enabled: false
        - channel: nightly
          value:
 -          enabled: true
 +          enabled: false
        - channel: beta
          value:
 -          enabled: true
 +          enabled: false
    native-share-sheet:
      description: Feature to enable the Native Share Sheet for users on Firefox on Android.

security/manager/ssl/RemoteSecuritySettings.sys.mjs

@@ -259,6 +259,28 @@ export var RemoteSecuritySettings = {
        signerName: SECURITY_STATE_SIGNER,
      });
      this.OneCRLBlocklistClient.on("sync", updateCertBlocklist);
 +    // Ensure the bundled list of revocations is loaded.
 +    this.OneCRLBlocklistClient.get()
 +      .then(records => {
 +        return updateCertBlocklist({
 +          data: {
 +            current: records,
 +            created: records,
 +            updated: [],
 +            deleted: [],
 +          },
 +        });
 +      })
 +      .catch(e => {
 +        lazy.log.error(e);
 +      })
 +      .finally(() => {
 +        // Only used by tests, to know when the bundled list is in cert_storage.
 +        Services.obs.notifyObservers(
 +          null,
 +          "remote-security-settings:onecrl-bundle-loaded"
 +        );
 +      });
      this.IntermediatePreloadsClient = new IntermediatePreloads();

security/manager/ssl/tests/unit/test_onecrl_loads_bundle.js

 +// -*- indent-tabs-mode: nil; js-indent-level: 2 -*-
 +// Any copyright is dedicated to the Public Domain.
 +// http://creativecommons.org/publicdomain/zero/1.0/
++
 +"use strict";
++
 +// Checks that OneCRL loads its remote settings bundle at startup by ensuring
 +// that each of the listed eMudhra intermediate certificates is revoked.
++
 +do_get_profile();
++
 +const { TestUtils } = ChromeUtils.importESModule(
 +  "resource://testing-common/TestUtils.sys.mjs"
 +);
 +const { RemoteSecuritySettings } = ChromeUtils.importESModule(
 +  "resource://gre/modules/psm/RemoteSecuritySettings.sys.mjs"
 +);
++
 +// DER encoding of the issuer name (CN=emSign Root TLS CA - G3), base64.
 +const ISSUER =
 +  "MFYxCzAJBgNVBAYTAklOMSUwIwYDVQQKDBxlTXVkaHJhIFRlY2hub2xvZ2llcyBMaW1pdGVkMSAwHgYDVQQDDBdlbVNpZ24gUm9vdCBUTFMgQ0EgLSBHMw==";
++
 +// Serial numbers are the contents of the DER INTEGER, in hex.
 +const SERIALS = {
 +  "EM DV TLS CA - G3B": "00a4aee678f23362b4c0e460b772f214",
 +  "EM OV TLS CA - G3B": "6cada367fb1c100088120ea202d568",
 +  "EM EV TLS CA - G3B": "00c7c41efe92d825f05eae841a4a82c1",
 +  "EM DV TLS CA - G3C": "588b2e3c2bb8cda13e1a1209254321",
 +  "EM OV TLS CA - G3C": "296926c227a3a1526392b19482a504",
 +  "EM EV TLS CA - G3C": "008009928a64107601af05fa2f19f109",
 +};
++
 +function base64ToBytes(base64) {
 +  return Array.from(atob(base64), c => c.charCodeAt(0));
 +}
++
 +function hexToBytes(hex) {
 +  return hex.match(/../g).map(byte => parseInt(byte, 16));
 +}
++
 +add_task(async function test_emsign_intermediates_are_revoked() {
 +  let loaded = TestUtils.topicObserved(
 +    "remote-security-settings:onecrl-bundle-loaded"
 +  );
 +  RemoteSecuritySettings.init();
 +  await loaded;
++
 +  let certStorage = Cc["@mozilla.org/security/certstorage;1"].getService(
 +    Ci.nsICertStorage
 +  );
 +  let issuer = base64ToBytes(ISSUER);
++
 +  for (let [name, serial] of Object.entries(SERIALS)) {
 +    Assert.equal(
 +      certStorage.getRevocationState(issuer, hexToBytes(serial), [], []),
 +      Ci.nsICertStorage.STATE_ENFORCE,
 +      `${name} should be revoked`
 +    );
 +  }
 +});

security/manager/ssl/tests/unit/xpcshell.toml

@@ -293,6 +293,8 @@ run-sequentially = ["true"] # hardcoded ports
  ["test_ocsp_url.js"]
  run-sequentially = ["true"] # hardcoded ports
 +["test_onecrl_loads_bundle.js"]
++
  ["test_oskeystore.js"]
  skip-if = [
    "os == 'mac' && os_version == '15.30' && arch == 'aarch64'", # Bug 1729538

services/settings/dumps/security-state/onecrl.json

+ {
    "data": [
 +    {
 +      "schema": 1793206881749,
 +      "details": {
 +        "bug": "https://bugzilla.mozilla.org/show_bug.cgi?id=2086683",
 +        "who": "",
 +        "why": "",
 +        "name": "",
 +        "created": ""
 +      },
 +      "enabled": false,
 +      "issuerName": "MIGIMQswCQYDVQQGEwJVUzETMBEGA1UECBMKTmV3IEplcnNleTEUMBIGA1UEBxMLSmVyc2V5IENpdHkxHjAcBgNVBAoTFVRoZSBVU0VSVFJVU1QgTmV0d29yazEuMCwGA1UEAxMlVVNFUlRydXN0IEVDQyBDZXJ0aWZpY2F0aW9uIEF1dGhvcml0eQ==",
 +      "serialNumber": "RB/KBH9VgbnLpOJqZoTyow==",
 +      "id": "7b77a8a9-4ff9-4190-a63d-480067cf8c4e",
 +      "last_modified": 1793208925525
 +    },
 +    {
 +      "schema": 1793206882065,
 +      "details": {
 +        "bug": "https://bugzilla.mozilla.org/show_bug.cgi?id=2086683",
 +        "who": "",
 +        "why": "",
 +        "name": "",
 +        "created": ""
 +      },
 +      "enabled": false,
 +      "issuerName": "MGkxCzAJBgNVBAYTAktSMSYwJAYDVQQKDB1OQVZFUiBCVVNJTkVTUyBQTEFURk9STSBDb3JwLjEyMDAGA1UEAwwpTkFWRVIgR2xvYmFsIFJvb3QgQ2VydGlmaWNhdGlvbiBBdXRob3JpdHk=",
 +      "serialNumber": "FtGXvblx89aS5WAmhklF4wKyzbU=",
 +      "id": "3fdd4f20-8e47-4578-997c-3016911d10a8",
 +      "last_modified": 1793208925522
 +    },
 +    {
 +      "schema": 1793206881998,
 +      "details": {
 +        "bug": "https://bugzilla.mozilla.org/show_bug.cgi?id=2086683",
 +        "who": "",
 +        "why": "",
 +        "name": "",
 +        "created": ""
 +      },
 +      "enabled": false,
 +      "issuerName": "MGkxCzAJBgNVBAYTAktSMSkwJwYDVQQKDCBOQVZFUiBDbG91ZCBUcnVzdCBTZXJ2aWNlcyBDb3JwLjEvMC0GA1UEAwwmTkFWRVIgQ2xvdWQgVHJ1c3QgU2VydmljZXMgRUNDIFJvb3QgRzE=",
 +      "serialNumber": "DfW5xUaZ1oc/RsU7E9mA4Keg9GY=",
 +      "id": "2d970c9e-ca3e-400f-a025-05a74762c688",
 +      "last_modified": 1793208925519
 +    },
 +    {
 +      "schema": 1793206881874,
 +      "details": {
 +        "bug": "https://bugzilla.mozilla.org/show_bug.cgi?id=2086683",
 +        "who": "",
 +        "why": "",
 +        "name": "",
 +        "created": ""
 +      },
 +      "enabled": false,
 +      "issuerName": "MEQxCzAJBgNVBAYTAkRFMQ8wDQYDVQQKEwZBbWF6b24xJDAiBgNVBAMTG0FtYXpvbiBFQ0RTQSAyNTYgUm9vdCBFVSBNMQ==",
 +      "serialNumber": "B8DNf48cn1uAEWyCz2ilx7MfJQ==",
 +      "id": "83ccc9c6-2121-4f62-b284-20d9514d1927",
 +      "last_modified": 1793208925517
 +    },
 +    {
 +      "schema": 1793206881808,
 +      "details": {
 +        "bug": "https://bugzilla.mozilla.org/show_bug.cgi?id=2086683",
 +        "who": "",
 +        "why": "",
 +        "name": "",
 +        "created": ""
 +      },
 +      "enabled": false,
 +      "issuerName": "MD0xCzAJBgNVBAYTAkNOMREwDwYDVQQKDAhVbmlUcnVzdDEbMBkGA1UEAwwSVUNBIEdsb2JhbCBHMiBSb290",
 +      "serialNumber": "YCnHTexdqAT9NNVLh8z2QA==",
 +      "id": "66ad7766-46e5-415b-8950-9d4143d68a47",
 +      "last_modified": 1793208925514
 +    },
 +    {
 +      "schema": 1793206881627,
 +      "details": {
 +        "bug": "https://bugzilla.mozilla.org/show_bug.cgi?id=2086683",
 +        "who": "",
 +        "why": "",
 +        "name": "",
 +        "created": ""
 +      },
 +      "enabled": false,
 +      "issuerName": "MGkxCzAJBgNVBAYTAktSMSYwJAYDVQQKDB1OQVZFUiBCVVNJTkVTUyBQTEFURk9STSBDb3JwLjEyMDAGA1UEAwwpTkFWRVIgR2xvYmFsIFJvb3QgQ2VydGlmaWNhdGlvbiBBdXRob3JpdHk=",
 +      "serialNumber": "FJ5/xhegeJsX13b9RcYLaXVPUwA=",
 +      "id": "a0372f6d-c436-429a-a41e-c16003c01ff0",
 +      "last_modified": 1793208925511
 +    },
 +    {
 +      "schema": 1793206881570,
 +      "details": {
 +        "bug": "https://bugzilla.mozilla.org/show_bug.cgi?id=2086683",
 +        "who": "",
 +        "why": "",
 +        "name": "",
 +        "created": ""
 +      },
 +      "enabled": false,
 +      "issuerName": "MGkxCzAJBgNVBAYTAktSMSkwJwYDVQQKDCBOQVZFUiBDbG91ZCBUcnVzdCBTZXJ2aWNlcyBDb3JwLjEvMC0GA1UEAwwmTkFWRVIgQ2xvdWQgVHJ1c3QgU2VydmljZXMgRUNDIFJvb3QgRzE=",
 +      "serialNumber": "DjfBmWc92Uon9Pg7pj1ojD29WkA=",
 +      "id": "fb78f960-2dd1-438c-a1e5-91f22ffb9aed",
 +      "last_modified": 1793208925508
 +    },
 +    {
 +      "schema": 1793206881509,
 +      "details": {
 +        "bug": "https://bugzilla.mozilla.org/show_bug.cgi?id=2086683",
 +        "who": "",
 +        "why": "",
 +        "name": "",
 +        "created": ""
 +      },
 +      "enabled": false,
 +      "issuerName": "MEQxCzAJBgNVBAYTAkRFMQ8wDQYDVQQKEwZBbWF6b24xJDAiBgNVBAMTG0FtYXpvbiBFQ0RTQSAzODQgUm9vdCBFVSBNMQ==",
 +      "serialNumber": "B8DNf48ffwl2Bnue0WyZT7Yw+w==",
 +      "id": "307e624d-6540-455a-80a5-a3a85c905e06",
 +      "last_modified": 1793208925505
 +    },
 +    {
 +      "schema": 1792622042163,
 +      "details": {
 +        "bug": "https://bugzilla.mozilla.org/show_bug.cgi?id=2086683",
 +        "who": "",
 +        "why": "",
 +        "name": "",
 +        "created": ""
 +      },
 +      "enabled": false,
 +      "issuerName": "MGkxCzAJBgNVBAYTAktSMSkwJwYDVQQKDCBOQVZFUiBDbG91ZCBUcnVzdCBTZXJ2aWNlcyBDb3JwLjEvMC0GA1UEAwwmTkFWRVIgQ2xvdWQgVHJ1c3QgU2VydmljZXMgUlNBIFJvb3QgRzE=",
 +      "serialNumber": "C0Se6VVjeCepnsw2POzjSpEeSk0=",
 +      "id": "beef1c99-a5f4-4bd6-8f9c-aa06e7d524df",
 +      "last_modified": 1793208925502
 +    },
 +    {
 +      "schema": 1793206881933,
 +      "details": {
 +        "bug": "https://bugzilla.mozilla.org/show_bug.cgi?id=2086683",
 +        "who": "",
 +        "why": "",
 +        "name": "",
 +        "created": ""
 +      },
 +      "enabled": false,
 +      "issuerName": "MGkxCzAJBgNVBAYTAktSMSkwJwYDVQQKDCBOQVZFUiBDbG91ZCBUcnVzdCBTZXJ2aWNlcyBDb3JwLjEvMC0GA1UEAwwmTkFWRVIgQ2xvdWQgVHJ1c3QgU2VydmljZXMgUlNBIFJvb3QgRzE=",
 +      "serialNumber": "CuTxpDlw70JyQ/lqZvnIPouNYiQ=",
 +      "id": "9b28e176-0b39-42b1-a4d8-ebb9f85d7558",
 +      "last_modified": 1793208925499
 +    },
 +    {
 +      "schema": 1793206881689,
 +      "details": {
 +        "bug": "https://bugzilla.mozilla.org/show_bug.cgi?id=2086683",
 +        "who": "",
 +        "why": "",
 +        "name": "",
 +        "created": ""
 +      },
 +      "enabled": false,
 +      "issuerName": "MEMxCzAJBgNVBAYTAkRFMQ8wDQYDVQQKEwZBbWF6b24xIzAhBgNVBAMTGkFtYXpvbiBSU0EgMjA0OCBSb290IEVVIE0x",
 +      "serialNumber": "B8DNf48VlBcZv+FGxXhhwHG4iw==",
 +      "id": "c2f70e6e-5a20-421f-8063-61f0854d171b",
 +      "last_modified": 1793208925496
 +    },
 +    {
 +      "schema": 1792621513680,
 +      "details": {
 +        "bug": "https://bugzilla.mozilla.org/show_bug.cgi?id=2083382",
 +        "who": "",
 +        "why": "",
 +        "name": "",
 +        "created": ""
 +      },
 +      "enabled": true,
 +      "subject": "MD8xCzAJBgNVBAYTAk5MMRMwEQYDVQQKDAplTXVkaHJhIEJWMRswGQYDVQQDDBJFTSBEViBUTFMgQ0EgLSBHM0I=",
 +      "pubKeyHash": "6+1kdcLC2A/LGZ8/6N1uazzmC3frFdTkLD3sDG9bUQU=",
 +      "id": "5ed2b441-a5bf-4f8e-89af-d01fa292a9b8",
 +      "last_modified": 1792622041776
 +    },
 +    {
 +      "schema": 1792621487501,
 +      "details": {
 +        "bug": "https://bugzilla.mozilla.org/show_bug.cgi?id=2083382",
 +        "who": "",
 +        "why": "",
 +        "name": "",
 +        "created": ""
 +      },
 +      "enabled": true,
 +      "subject": "MEAxCzAJBgNVBAYTAlVTMRQwEgYDVQQKDAtlTXVkaHJhIEluYzEbMBkGA1UEAwwSRU0gT1YgVExTIENBIC0gRzND",
 +      "pubKeyHash": "Y+zv7kMdSVI7wRNsTnLQIGpHcIbK9gbNXPAlaGwQnPg=",
 +      "id": "f67aff65-7a13-42ef-b818-74bb69053273",
 +      "last_modified": 1792622041773
 +    },
 +    {
 +      "schema": 1792621521702,
 +      "details": {
 +        "bug": "https://bugzilla.mozilla.org/show_bug.cgi?id=2083382",
 +        "who": "",
 +        "why": "",
 +        "name": "",
 +        "created": ""
 +      },
 +      "enabled": true,
 +      "subject": "MEAxCzAJBgNVBAYTAlVTMRQwEgYDVQQKDAtlTXVkaHJhIEluYzEbMBkGA1UEAwwSRU0gRFYgVExTIENBIC0gRzND",
 +      "pubKeyHash": "Sd01PcK5GaN3BkURfQ5gwWEV59G8JZ7v5zSwDqQ0/l8=",
 +      "id": "fb4be101-8280-4d4e-866e-fd0213bc3a02",
 +      "last_modified": 1792622041769
 +    },
 +    {
 +      "schema": 1792621504826,
 +      "details": {
 +        "bug": "https://bugzilla.mozilla.org/show_bug.cgi?id=2083382",
 +        "who": "",
 +        "why": "",
 +        "name": "",
 +        "created": ""
 +      },
 +      "enabled": true,
 +      "subject": "MEAxCzAJBgNVBAYTAlVTMRQwEgYDVQQKDAtlTXVkaHJhIEluYzEbMBkGA1UEAwwSRU0gRVYgVExTIENBIC0gRzND",
 +      "pubKeyHash": "XAZgorFkkQ2P9YnBjhRVLp4Owjfc7+LLc21BpIEfgaA=",
 +      "id": "adaa1e8d-57cb-4cfb-b647-305aa20f1b04",
 +      "last_modified": 1792622041766
 +    },
 +    {
 +      "schema": 1792621495984,
 +      "details": {
 +        "bug": "https://bugzilla.mozilla.org/show_bug.cgi?id=2083382",
 +        "who": "",
 +        "why": "",
 +        "name": "",
 +        "created": ""
 +      },
 +      "enabled": true,
 +      "subject": "MD8xCzAJBgNVBAYTAk5MMRMwEQYDVQQKDAplTXVkaHJhIEJWMRswGQYDVQQDDBJFTSBPViBUTFMgQ0EgLSBHM0I=",
 +      "pubKeyHash": "Q7/6GdbvZRRR9oQeAZkx6W9vLq7/KKtLbxzkV23icXs=",
 +      "id": "3f07ab6b-0d52-41a3-9a7b-de945502a3b8",
 +      "last_modified": 1792622041762
 +    },
 +    {
 +      "schema": 1792274405648,
 +      "details": {
 +        "bug": "https://bugzilla.mozilla.org/show_bug.cgi?id=2083382",
 +        "who": "",
 +        "why": "",
 +        "name": "",
 +        "created": ""
 +      },
 +      "enabled": true,
 +      "subject": "MD8xCzAJBgNVBAYTAk5MMRMwEQYDVQQKDAplTXVkaHJhIEJWMRswGQYDVQQDDBJFTSBFViBUTFMgQ0EgLSBHM0I=",
 +      "pubKeyHash": "4CVMf83CZeLw+KQo2rt1q0rgObSHLWL17lfwh31aikE=",
 +      "id": "5856b9af-5c14-46e7-b660-04d1cc3f2819",
 +      "last_modified": 1792622041759
 +    },
 +    {
 +      "schema": 1792270008816,
 +      "details": {
 +        "bug": "https://bugzilla.mozilla.org/show_bug.cgi?id=2083382",
 +        "who": "",
 +        "why": "",
 +        "name": "",
 +        "created": ""
 +      },
 +      "enabled": true,
 +      "issuerName": "MFYxCzAJBgNVBAYTAklOMSUwIwYDVQQKDBxlTXVkaHJhIFRlY2hub2xvZ2llcyBMaW1pdGVkMSAwHgYDVQQDDBdlbVNpZ24gUm9vdCBUTFMgQ0EgLSBHMw==",
 +      "serialNumber": "WIsuPCu4zaE+GhIJJUMh",
 +      "id": "dfebe454-5411-4f64-bd26-ff0346cad020",
 +      "last_modified": 1792274405312
 +    },
 +    {
 +      "schema": 1792269992087,
 +      "details": {
 +        "bug": "https://bugzilla.mozilla.org/show_bug.cgi?id=2083382",
 +        "who": "",
 +        "why": "",
 +        "name": "",
 +        "created": ""
 +      },
 +      "enabled": true,
 +      "issuerName": "MFYxCzAJBgNVBAYTAklOMSUwIwYDVQQKDBxlTXVkaHJhIFRlY2hub2xvZ2llcyBMaW1pdGVkMSAwHgYDVQQDDBdlbVNpZ24gUm9vdCBUTFMgQ0EgLSBHMw==",
 +      "serialNumber": "AIAJkopkEHYBrwX6LxnxCQ==",
 +      "id": "eefb82bf-3d32-4b7e-9dff-19fd2c21f755",
 +      "last_modified": 1792274405309
 +    },
 +    {
 +      "schema": 1792269983656,
 +      "details": {
 +        "bug": "https://bugzilla.mozilla.org/show_bug.cgi?id=2083382",
 +        "who": "",
 +        "why": "",
 +        "name": "",
 +        "created": ""
 +      },
 +      "enabled": true,
 +      "issuerName": "MFYxCzAJBgNVBAYTAklOMSUwIwYDVQQKDBxlTXVkaHJhIFRlY2hub2xvZ2llcyBMaW1pdGVkMSAwHgYDVQQDDBdlbVNpZ24gUm9vdCBUTFMgQ0EgLSBHMw==",
 +      "serialNumber": "bK2jZ/scEACIEg6iAtVo",
 +      "id": "a0ac0973-ae76-4860-8f9c-eff5fd57bc3b",
 +      "last_modified": 1792274405304
 +    },
 +    {
 +      "schema": 1792269975630,
 +      "details": {
 +        "bug": "https://bugzilla.mozilla.org/show_bug.cgi?id=2083382",
 +        "who": "",
 +        "why": "",
 +        "name": "",
 +        "created": ""
 +      },
 +      "enabled": true,
 +      "issuerName": "MFYxCzAJBgNVBAYTAklOMSUwIwYDVQQKDBxlTXVkaHJhIFRlY2hub2xvZ2llcyBMaW1pdGVkMSAwHgYDVQQDDBdlbVNpZ24gUm9vdCBUTFMgQ0EgLSBHMw==",
 +      "serialNumber": "KWkmwiejoVJjkrGUgqUE",
 +      "id": "c64301a0-888f-469d-86fc-a03bcd6bc407",
 +      "last_modified": 1792274405300
 +    },
 +    {
 +      "schema": 1792195211286,
 +      "details": {
 +        "bug": "https://bugzilla.mozilla.org/show_bug.cgi?id=2083382",
 +        "who": "",
 +        "why": "",
 +        "name": "",
 +        "created": ""
 +      },
 +      "enabled": true,
 +      "issuerName": "MFYxCzAJBgNVBAYTAklOMSUwIwYDVQQKDBxlTXVkaHJhIFRlY2hub2xvZ2llcyBMaW1pdGVkMSAwHgYDVQQDDBdlbVNpZ24gUm9vdCBUTFMgQ0EgLSBHMw==",
 +      "serialNumber": "AMfEHv6S2CXwXq6EGkqCwQ==",
 +      "id": "5fb952e1-b09f-4187-805c-b87a91dad9bb",
 +      "last_modified": 1792274405297
 +    },
 +    {
 +      "schema": 1792269999860,
 +      "details": {
 +        "bug": "https://bugzilla.mozilla.org/show_bug.cgi?id=2083382",
 +        "who": "",
 +        "why": "",
 +        "name": "",
 +        "created": ""
 +      },
 +      "enabled": true,
 +      "issuerName": "MFYxCzAJBgNVBAYTAklOMSUwIwYDVQQKDBxlTXVkaHJhIFRlY2hub2xvZ2llcyBMaW1pdGVkMSAwHgYDVQQDDBdlbVNpZ24gUm9vdCBUTFMgQ0EgLSBHMw==",
 +      "serialNumber": "AKSu5njyM2K0wORgt3LyFA==",
 +      "id": "bd595f9a-0da9-4980-bcc2-ef1e1bf70c7b",
 +      "last_modified": 1792274405294
 +    },
 +    {
 +      "schema": 1791318533037,
 +      "details": {
 +        "bug": "2078851",
 +        "who": "",
 +        "why": "",
 +        "name": "",
 +        "created": ""
 +      },
 +      "enabled": true,
 +      "issuerName": "MDsxCzAJBgNVBAYTAkVTMREwDwYDVQQKDAhGTk1ULVJDTTEZMBcGA1UECwwQQUMgUkFJWiBGTk1ULVJDTQ==",
 +      "serialNumber": "LO0aXgKAW7xd34o67KqYWg==",
 +      "id": "78e1876e-8832-49ee-9bd9-b36e3d53b059",
 +      "last_modified": 1791573428759
 +    },
 +    {
 +      "schema": 1791233394581,
 +      "details": {
 +        "bug": "2078851",
 +        "who": "",
 +        "why": "",
 +        "name": "",
 +        "created": ""
 +      },
 +      "enabled": true,
 +      "issuerName": "MDsxCzAJBgNVBAYTAkVTMREwDwYDVQQKDAhGTk1ULVJDTTEZMBcGA1UECwwQQUMgUkFJWiBGTk1ULVJDTQ==",
 +      "serialNumber": "NIFgxR9e28td34nKtFczkg==",
 +      "id": "2690f159-72d9-4a13-a7e4-ee2d2b5b7e5b",
 +      "last_modified": 1791573428756
 +    },
 +    {
 +      "schema": 1790874064811,
 +      "details": {
 +        "bug": "https://bugzilla.mozilla.org/show_bug.cgi?id=2077222",
 +        "who": "",
 +        "why": "",
 +        "name": "",
 +        "created": ""
 +      },
 +      "enabled": false,
 +      "issuerName": "MGExCzAJBgNVBAYTAkNOMTAwLgYDVQQKDCdDaGluYSBGaW5hbmNpYWwgQ2VydGlmaWNhdGlvbiBBdXRob3JpdHkxIDAeBgNVBAMMF0NGQ0EgR2xvYmFsIFJTQSBST09UIEcy",
 +      "serialNumber": "ePkoIc73UVpF6g==",
 +      "id": "68d677f4-b0d4-4632-aa81-a7409c34b8ee",
 +      "last_modified": 1791233394201
 +    },
 +    {
 +      "schema": 1790874064627,
 +      "details": {
 +        "bug": "https://bugzilla.mozilla.org/show_bug.cgi?id=2077222",
 +        "who": "",
 +        "why": "",
 +        "name": "",
 +        "created": ""
 +      },
 +      "enabled": false,
 +      "issuerName": "MFYxCzAJBgNVBAYTAkNOMTAwLgYDVQQKDCdDaGluYSBGaW5hbmNpYWwgQ2VydGlmaWNhdGlvbiBBdXRob3JpdHkxFTATBgNVBAMMDENGQ0EgRVYgUk9PVA==",
 +      "serialNumber": "V1JfiijGiegkWPH+Fx5j7Q==",
 +      "id": "d5bae32a-daac-403e-a2d0-ca2eb2231041",
 +      "last_modified": 1791233394198
 +    },
 +    {
 +      "schema": 1790874064530,
 +      "details": {
 +        "bug": "https://bugzilla.mozilla.org/show_bug.cgi?id=2077222",
 +        "who": "",
 +        "why": "",
 +        "name": "",
 +        "created": ""
 +      },
 +      "enabled": false,
 +      "issuerName": "MFoxCzAJBgNVBAYTAkpQMSYwJAYDVQQKEx1TRUNPTSBUcnVzdCBTeXN0ZW1zIENvLiwgTHRkLjEjMCEGA1UEAxMaU0VDT00gVExTIEVDQyBSb290IENBIDIwMjQ=",
 +      "serialNumber": "T+az/YRcbK7igx8id+gKnw==",
 +      "id": "cb98a089-ec7a-4e52-bc08-31eb43815728",
 +      "last_modified": 1791233394194
 +    },
 +    {
 +      "schema": 1790874064341,
 +      "details": {
 +        "bug": "https://bugzilla.mozilla.org/show_bug.cgi?id=2077222",
 +        "who": "",
 +        "why": "",
 +        "name": "",
 +        "created": ""
 +      },
 +      "enabled": false,
 +      "issuerName": "MF0xCzAJBgNVBAYTAkpQMSUwIwYDVQQKExxTRUNPTSBUcnVzdCBTeXN0ZW1zIENPLixMVEQuMScwJQYDVQQLEx5TZWN1cml0eSBDb21tdW5pY2F0aW9uIFJvb3RDQTI=",
 +      "serialNumber": "IrmxL00F+e0T",
 +      "id": "a1383d22-e6fd-4f35-8837-15ddb27ef93e",
 +      "last_modified": 1791233394190
 +    },
 +    {
 +      "schema": 1790874064147,
 +      "details": {
 +        "bug": "https://bugzilla.mozilla.org/show_bug.cgi?id=2077222",
 +        "who": "",
 +        "why": "",
 +        "name": "",
 +        "created": ""
 +      },
 +      "enabled": false,
 +      "issuerName": "MF8xCzAJBgNVBAYTAkdCMRgwFgYDVQQKEw9TZWN0aWdvIExpbWl0ZWQxNjA0BgNVBAMTLVNlY3RpZ28gUHVibGljIFNlcnZlciBBdXRoZW50aWNhdGlvbiBSb290IEU0Ng==",
 +      "serialNumber": "AIEKq4YGXjOEvyglU57/P4g=",
 +      "id": "637d67cd-89bf-4c25-90cd-ee7be62a591d",
 +      "last_modified": 1791233394186
 +    },
 +    {
 +      "schema": 1790874064043,
 +      "details": {
 +        "bug": "https://bugzilla.mozilla.org/show_bug.cgi?id=2077222",
 +        "who": "",
 +        "why": "",
 +        "name": "",
 +        "created": ""
 +      },
 +      "enabled": false,
 +      "issuerName": "MFoxCzAJBgNVBAYTAkpQMSYwJAYDVQQKEx1TRUNPTSBUcnVzdCBTeXN0ZW1zIENvLiwgTHRkLjEjMCEGA1UEAxMaU0VDT00gVExTIEVDQyBSb290IENBIDIwMjQ=",
 +      "serialNumber": "T+az/DaNHzV/czSbV8b+SQ==",
 +      "id": "489486f0-960f-4185-8afd-219198f6f558",
 +      "last_modified": 1791233394183
 +    },
 +    {
 +      "schema": 1790874063948,
 +      "details": {
 +        "bug": "https://bugzilla.mozilla.org/show_bug.cgi?id=2077222",
 +        "who": "",
 +        "why": "",
 +        "name": "",
 +        "created": ""
 +      },
 +      "enabled": false,
 +      "issuerName": "MDsxCzAJBgNVBAYTAkVTMREwDwYDVQQKDAhGTk1ULVJDTTEZMBcGA1UECwwQQUMgUkFJWiBGTk1ULVJDTQ==",
 +      "serialNumber": "Pnz9VM3l4W1RzEmOGx7NSA==",
 +      "id": "320d71d5-36a8-4410-9ad4-2124add204ff",
 +      "last_modified": 1791233394178
 +    },
 +    {
 +      "schema": 1790874063852,
 +      "details": {
 +        "bug": "https://bugzilla.mozilla.org/show_bug.cgi?id=2077222",
 +        "who": "",
 +        "why": "",
 +        "name": "",
 +        "created": ""
 +      },
 +      "enabled": false,
 +      "issuerName": "MFoxCzAJBgNVBAYTAkpQMSYwJAYDVQQKEx1TRUNPTSBUcnVzdCBTeXN0ZW1zIENvLiwgTHRkLjEjMCEGA1UEAxMaU0VDT00gVExTIFJTQSBSb290IENBIDIwMjQ=",
 +      "serialNumber": "R6WRK1Xe7A7RwUFO96H4fQ==",
 +      "id": "7891cb25-37db-4dcb-9218-c976cc847eb7",
 +      "last_modified": 1791233394175
 +    },
 +    {
 +      "schema": 1790874063748,
 +      "details": {
 +        "bug": "https://bugzilla.mozilla.org/show_bug.cgi?id=2077222",
 +        "who": "",
 +        "why": "",
 +        "name": "",
 +        "created": ""
 +      },
 +      "enabled": false,
 +      "issuerName": "MEYxCzAJBgNVBAYTAkJFMRkwFwYDVQQKExBHbG9iYWxTaWduIG52LXNhMRwwGgYDVQQDExNHbG9iYWxTaWduIFJvb3QgUjQ2",
 +      "serialNumber": "AIRDWFKkZS7STOWUW1z2GLE=",
 +      "id": "dd420d19-4bce-4fe6-911a-7025430247be",
 +      "last_modified": 1791233394172
 +    },
 +    {
 +      "schema": 1790874064721,
 +      "details": {
 +        "bug": "https://bugzilla.mozilla.org/show_bug.cgi?id=2077222",
 +        "who": "",
 +        "why": "",
 +        "name": "",
 +        "created": ""
 +      },
 +      "enabled": false,
 +      "issuerName": "MF8xCzAJBgNVBAYTAkdCMRgwFgYDVQQKEw9TZWN0aWdvIExpbWl0ZWQxNjA0BgNVBAMTLVNlY3RpZ28gUHVibGljIFNlcnZlciBBdXRoZW50aWNhdGlvbiBSb290IFI0Ng==",
 +      "serialNumber": "VS0Duo3zjBUCApvCbQzk+Q==",
 +      "id": "2823a801-82b1-43f1-858b-f740b601ddb4",
 +      "last_modified": 1791233394168
 +    },
 +    {
 +      "schema": 1790874064246,
 +      "details": {
 +        "bug": "https://bugzilla.mozilla.org/show_bug.cgi?id=2077222",
 +        "who": "",
 +        "why": "",
 +        "name": "",
 +        "created": ""
 +      },
 +      "enabled": false,
 +      "issuerName": "MFYxCzAJBgNVBAYTAkNOMTAwLgYDVQQKDCdDaGluYSBGaW5hbmNpYWwgQ2VydGlmaWNhdGlvbiBBdXRob3JpdHkxFTATBgNVBAMMDENGQ0EgRVYgUk9PVA==",
 +      "serialNumber": "fXSiQkZ5TZ3Exw==",
 +      "id": "0adcd89e-b78e-41c7-b10e-4d4f1ab97cc8",
 +      "last_modified": 1791233394165
 +    },
 +    {
 +      "schema": 1790874064436,
 +      "details": {
 +        "bug": "https://bugzilla.mozilla.org/show_bug.cgi?id=2077222",
 +        "who": "",
 +        "why": "",
 +        "name": "",
 +        "created": ""
 +      },
 +      "enabled": false,
 +      "issuerName": "MEgxCzAJBgNVBAYTAkRFMRUwEwYDVQQKEwxELVRydXN0IEdtYkgxIjAgBgNVBAMTGUQtVFJVU1QgRVYgUm9vdCBDQSAyIDIwMjM=",
 +      "serialNumber": "Uu0msDCRjfC0h03kRtj2Ig==",
 +      "id": "665bdb86-cf5b-451f-bb69-c0518c84b960",
 +      "last_modified": 1791233394162
 +    },
 +    {
 +      "schema": 1790553607419,
 +      "details": {
 +        "bug": "https://bugzilla.mozilla.org/show_bug.cgi?id=2077222",
 +        "who": "",
 +        "why": "",
 +        "name": "",
 +        "created": ""
 +      },
 +      "enabled": false,
 +      "issuerName": "MFoxCzAJBgNVBAYTAkpQMSYwJAYDVQQKEx1TRUNPTSBUcnVzdCBTeXN0ZW1zIENvLiwgTHRkLjEjMCEGA1UEAxMaU0VDT00gVExTIFJTQSBSb290IENBIDIwMjQ=",
 +      "serialNumber": "R6WRKuXIqENrxkAQkNTByQ==",
 +      "id": "94a3e6fb-153b-45e8-b50a-0f212970114d",
 +      "last_modified": 1791233394158
 +    },
+     {
        "schema": 1781802209467,
        "details": {
@@ -28199,5 +28769,5 @@
        "last_modified": 1480349158647
+     }
    ],
 -  "timestamp": 1781825227560
 +  "timestamp": 1793208925525
+ }

toolkit/components/tor-launcher/TorBootstrapRequest.sys.mjs

@@ -7,6 +7,8 @@ ChromeUtils.defineESModuleGetters(lazy, {
      "moz-src:///toolkit/components/tor-launcher/TorProviderBuilder.sys.mjs",
    TorProviderTopics:
      "moz-src:///toolkit/components/tor-launcher/TorProviderBuilder.sys.mjs",
 +  TorBootstrapError:
 +    "moz-src:///toolkit/components/tor-launcher/TorProviderBuilder.sys.mjs",
  });
  const log = console.createInstance({
@@ -35,12 +37,18 @@ export class TorBootstrapRequest {
    #timeoutID = null;
    observe(subject, topic) {
 -    const obj = subject?.wrappedJSObject;
      switch (topic) {
        case lazy.TorProviderTopics.BootstrapStatus: {
 -        const progress = obj.PROGRESS;
 +        let obj;
 +        try {
 +          obj = subject.QueryInterface(Ci.torITorBootstrapStatus);
 +        } catch (e) {
 +          log.warn("BootstrapStatus with an unexpected subject", e, subject);
 +          break;
 +        }
 +        const progress = obj.progress;
          if (this.onbootstrapstatus) {
 -          const status = obj.TAG;
 +          const status = obj.tag;
            this.onbootstrapstatus(progress, status);
+         }
          if (progress === 100) {
@@ -55,8 +63,21 @@ export class TorBootstrapRequest {
          break;
+       }
        case lazy.TorProviderTopics.BootstrapError: {
 +        let obj;
 +        try {
 +          obj = subject.QueryInterface(Ci.torITorBootstrapStatus);
 +        } catch (e) {
 +          log.warn("TorBootstrapError with an unexpected subject", e, subject);
 +          break;
 +        }
          log.info("TorBootstrapRequest: observerd TorBootstrapError", obj);
 -        this.#stop(obj);
 +        this.#stop(
 +          new lazy.TorBootstrapError({
 +            phase: obj.tag,
 +            summary: obj.summary,
 +            reason: obj.reason,
 +          })
 +        );
          break;
+       }
+     }

toolkit/components/tor-launcher/TorDomainIsolator.sys.mjs

@@ -288,8 +288,34 @@ class TorDomainIsolatorImpl {
          // TODO: What UX to use here? See tor-browser#41708
+       }
      } else if (topic === lazy.TorProviderTopics.CircuitCredentialsMatched) {
 -      const { username, password, circuits } = subject.wrappedJSObject;
 -      this.#updateCircuits(username, password, circuits);
 +      let streamInfo;
 +      try {
 +        streamInfo = subject?.QueryInterface(Ci.torITorStreamInfo);
 +      } catch (e) {
 +        logger.warn(
 +          "CircuitCredentialsMatched with invalid stream info",
 +          e,
 +          subject
 +        );
 +      }
 +      if (streamInfo) {
 +        const circuits = streamInfo.circuits?.map(circuit =>
 +          circuit.map(node => {
 +            return {
 +              fingerprint: node.fingerprint,
 +              ipAddrs: node.ipAddrs,
 +              isBridge: node.isBridge,
 +              bridgeType: node.bridgeType,
 +              regionCode: node.regionCode,
 +            };
 +          })
 +        );
 +        this.#updateCircuits(
 +          streamInfo.socksUsername,
 +          streamInfo.socksPassword,
 +          circuits
 +        );
 +      }
+     }
+   }

toolkit/components/tor-launcher/TorLauncherUtil.sys.mjs

@@ -644,17 +644,22 @@ export const TorLauncherUtil = {
     * Therefore, the messages should avoid containing any information that might
     * identify information about the user.
+    *
 -   * @param {string} type The log type (ERR, WARN, etc...)
 -   * @param {string} msg The log message
 +   * @param {string} severity The log severity (ERR, WARN, etc...)
 +   * @param {string} message The log message
     */
 -  log(type, msg) {
 +  log(severity, message) {
      const timestamp =
        new Date().toISOString().replace("T", " ").replace("Z", "") + " UTC";
      Services.obs.notifyObservers(
 -      { type, msg, timestamp },
 +      {
 +        severity,
 +        message,
 +        timestamp,
 +        QueryInterface: ChromeUtils.generateQI([Ci.torITorLogEntry]),
 +      },
        lazy.TorProviderTopics.TorLog
      );
 -    if (type === "WARN" || type === "ERR") {
 +    if (severity === "WARN" || severity === "ERR") {
        // Notify so that Copy Log can be enabled.
        Services.obs.notifyObservers(null, lazy.TorProviderTopics.HasWarnOrErr);
+     }

toolkit/components/tor-launcher/TorProvider.sys.mjs

@@ -7,10 +7,7 @@ import { clearTimeout, setTimeout } from "resource://gre/modules/Timer.sys.mjs";
  import { TorLauncherUtil } from "moz-src:///toolkit/components/tor-launcher/TorLauncherUtil.sys.mjs";
  import { TorParsers } from "moz-src:///toolkit/components/tor-launcher/TorParsers.sys.mjs";
  import { TorProviderBase } from "moz-src:///toolkit/components/tor-launcher/TorProviderBase.sys.mjs";
 -import {
 -  TorBootstrapError,
 -  TorProviderTopics,
 -} from "moz-src:///toolkit/components/tor-launcher/TorProviderBuilder.sys.mjs";
 +import { TorProviderTopics } from "moz-src:///toolkit/components/tor-launcher/TorProviderBuilder.sys.mjs";
  const lazy = {};
  ChromeUtils.defineESModuleGetters(lazy, {
@@ -57,12 +54,12 @@ const logger = console.createInstance({
   * @typedef NodeData
   * @property {NodeFingerprint} fingerprint The node fingerprint
   * @property {string[]} ipAddrs The ip addresses associated with this node
 - * @property {string?} bridgeType The bridge type for this node, or "" if the
 - *   node is a bridge but the type is unknown, or null if this is not a bridge
 - *   node
 - * @property {string?} regionCode An upper case 2-letter ISO3166-1 code for the
 - *   first ip address, or null if there is no region. This should also be a
 - *   valid BCP47 Region subtag
 + * @property {boolean} isBridge Whether the node is a bridge.
 + * @property {string} bridgeType The bridge type for this node, or an empty
 + *   string if the type is unknown or the node is not a bridge.
 + * @property {string} regionCode An upper case 2-letter ISO3166-1 code for the
 + *   first ip address. This should also be a valid BCP47 Region subtag.
 + *   It will be an empty string if the node is not a bridge.
   */
  const Preferences = Object.freeze({
@@ -929,14 +926,16 @@ export class TorProvider extends TorProviderBase {
        const node = {
          fingerprint: id,
          ipAddrs: [],
 -        bridgeType: null,
 -        regionCode: null,
 +        isBridge: false,
 +        bridgeType: "",
 +        regionCode: "",
        };
        const bridge = (await this.#controller.getBridges())?.find(
          foundBridge => foundBridge.id?.toUpperCase() === id.toUpperCase()
        );
        if (bridge) {
 +        node.isBridge = true;
          node.bridgeType = bridge.transport ?? "";
          // Attempt to get an IP address from bridge address string.
          const ip = bridge.addr.match(/^\[?([^\]]+)\]?:\d+$/)?.[1];
@@ -1006,7 +1005,10 @@ export class TorProvider extends TorProviderBase {
     */
    #processBootstrapStatus(statusObj, isNotification) {
      // Notify observers
 -    Services.obs.notifyObservers(statusObj, TorProviderTopics.BootstrapStatus);
 +    Services.obs.notifyObservers(
 +      new TorBootstrapStatus(statusObj),
 +      TorProviderTopics.BootstrapStatus
 +    );
      if (statusObj.PROGRESS === 100) {
        return;
@@ -1044,11 +1046,7 @@ export class TorProvider extends TorProviderBase {
        // anymore, since the first error eligible for notification will as a
        // matter of fact cancel the bootstrap.
        Services.obs.notifyObservers(
 -        new TorBootstrapError({
 -          phase: statusObj.TAG,
 -          reason: statusObj.REASON,
 -          summary: statusObj.SUMMARY,
 -        }),
 +        new TorBootstrapStatus(statusObj),
          TorProviderTopics.BootstrapError
        );
+     }
@@ -1147,14 +1145,24 @@ export class TorProvider extends TorProviderBase {
     * @param {StreamID} _streamId The ID of the stream that switched to the
     * sentconnect status.
     * @param {CircuitID} circuitId The ID of the circuit used by the stream
 -   * @param {string} username The SOCKS username
 -   * @param {string} password The SOCKS password
 +   * @param {string} socksUsername The SOCKS username
 +   * @param {string} socksPassword The SOCKS password
     */
 -  async onStreamSentConnect(_streamId, circuitId, username, password) {
 -    if (!username || !password) {
 +  async onStreamSentConnect(
 +    _streamId,
 +    circuitId,
 +    socksUsername,
 +    socksPassword
 +  ) {
 +    if (!socksUsername || !socksPassword) {
        return;
+     }
 -    logger.debug("Stream sentconnect event", username, password, circuitId);
 +    logger.debug(
 +      "Stream sentconnect event",
 +      socksUsername,
 +      socksPassword,
 +      circuitId
 +    );
      if (!this.#circuits.has(circuitId)) {
        // tor-browser#42132: When using onion-grater (e.g., in Tails), we might
        // not receive the CIRC BUILT event, as it is impossible to know whether
@@ -1194,13 +1202,33 @@ export class TorProvider extends TorProviderBase {
      );
      Services.obs.notifyObservers(
+       {
 -        wrappedJSObject: {
 -          username,
 -          password,
 -          circuits,
 -        },
 +        socksUsername,
 +        socksPassword,
 +        circuits,
 +        QueryInterface: ChromeUtils.generateQI([Ci.torITorStreamInfo]),
        },
        TorProviderTopics.CircuitCredentialsMatched
      );
+   }
+ }
++
 +/**
 + * A _javascript_ implementation of torITorBootstrapStatus.
 + */
 +class TorBootstrapStatus {
 +  /**
 +   * Construct a typed status object from a status object sent by TorController.
 +   *
 +   * @param {object} statusObj The status object parsed by the controller
 +   */
 +  constructor(statusObj) {
 +    this.progress = statusObj.PROGRESS;
 +    this.severity = statusObj.TYPE;
 +    this.tag = statusObj.TAG;
 +    this.summary = statusObj.SUMMARY;
 +    this.reason = statusObj.REASON ?? "";
 +    this.shouldWarn = statusObj.RECOMMENDATION !== "ignore";
 +  }
++
 +  QueryInterface = ChromeUtils.generateQI([Ci.torITorBootstrapStatus]);
 +}

toolkit/components/tor-launcher/TorProviderBuilder.sys.mjs

@@ -81,9 +81,9 @@ export const TorProviders = Object.freeze({
  /**
   * @typedef {object} LogEntry An object with a log message
 - * @property {string} timestamp The local date-time stamp at which we received the message
 - * @property {string} type The message level
 - * @property {string} msg The message
 + * @property {string} timestamp The UTC date-time stamp at which we received the message
 + * @property {string} severity The message severity
 + * @property {string} message The message
   */
  /**
@@ -182,7 +182,18 @@ export class TorProviderBuilder {
      );
      this.#logObserver = subject => {
 -      this.#addLogEntry(subject.wrappedJSObject);
 +      let entry;
 +      try {
 +        entry = subject.QueryInterface(Ci.torITorLogEntry);
 +      } catch (e) {
 +        lazy.logger.warn("TorLog with invalid subject", e, subject);
 +        return;
 +      }
 +      this.#addLogEntry({
 +        severity: entry.severity,
 +        message: entry.message,
 +        timestamp: entry.timestamp,
 +      });
      };
      Services.obs.addObserver(this.#logObserver, TorProviderTopics.TorLog);

toolkit/components/tor-launcher/TorProviderMock.sys.mjs

@@ -3,19 +3,19 @@ import { TorProviderBase } from "moz-src:///toolkit/components/tor-launcher/TorP
  import { TorProviderTopics } from "moz-src:///toolkit/components/tor-launcher/TorProviderBuilder.sys.mjs";
  const kBootstrapSteps = [
 -  { PROGRESS: 5, TAG: "starting", SUMMARY: "Starting" },
 -  { PROGRESS: 14, TAG: "handshake", SUMMARY: "Handshaking with a relay" },
 +  { progress: 5, tag: "starting", summary: "Starting" },
 +  { progress: 14, tag: "handshake", summary: "Handshaking with a relay" },
+   {
 -    PROGRESS: 45,
 -    TAG: "requesting_descriptors",
 -    SUMMARY: "Asking for relay descriptors",
 +    progress: 45,
 +    tag: "requesting_descriptors",
 +    summary: "Asking for relay descriptors",
    },
+   {
 -    PROGRESS: 75,
 -    TAG: "loading_descriptors",
 -    SUMMARY: "Loading relay descriptors",
 +    progress: 75,
 +    tag: "loading_descriptors",
 +    summary: "Loading relay descriptors",
    },
 -  { PROGRESS: 100, TAG: "done", SUMMARY: "Done" },
 +  { progress: 100, tag: "done", summary: "Done" },
  ];
  const kBootstrapStepDelayMs = 500;
@@ -48,7 +48,15 @@ export class TorProviderMock extends TorProviderBase {
        const id = setTimeout(
          () => {
            Services.obs.notifyObservers(
 -            { ...step, TYPE: "NOTICE" },
 +            {
 +              ...step,
 +              severity: "NOTICE",
 +              reason: "",
 +              shouldWarn: false,
 +              QueryInterface: ChromeUtils.generateQI([
 +                Ci.torITorBootstrapStatus,
 +              ]),
 +            },
              TorProviderTopics.BootstrapStatus
            );
          },

toolkit/components/tor-launcher/moz.build

 +XPIDL_MODULE = "torlauncher"
 +XPIDL_SOURCES += ["tor-launcher.idl"]
++
  MOZ_SRC_FILES += [
      "TorBootstrapRequest.sys.mjs",
      "TorControlPort.sys.mjs",

toolkit/components/tor-launcher/tor-launcher.idl

 +/* This Source Code Form is subject to the terms of the Mozilla Public
 + * License, v. 2.0. If a copy of the MPL was not distributed with this
 + * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
++
 +#include "nsISupports.idl"
++
 +/**
 + * The information about the bootstrap status.
 + * The values are extracted from C-tor's STATUS_CLIENT events, except for
 + * shouldWarn, which is derived from the RECOMMENDATION value.
 + */
 +[scriptable, uuid(64b3197d-0b1e-46a1-aa18-8cea11bacf97)]
 +interface torITorBootstrapStatus : nsISupports {
 +  readonly attribute octet progress;
 +  readonly attribute ACString severity;
 +  readonly attribute ACString tag;
 +  readonly attribute ACString summary;
 +  readonly attribute ACString reason;
 +  readonly attribute boolean shouldWarn;
 +};
++
 +/**
 + * A tor log message.
 + * The severity might be also something not used by C-tor.
 + */
 +[scriptable, uuid(f6d18f7d-c29c-4bf3-bf70-7d6bed3b427e)]
 +interface torITorLogEntry : nsISupports {
 +  readonly attribute ACString severity;
 +  readonly attribute ACString message;
 +  readonly attribute ACString timestamp;
 +};
++
 +/**
 + * A tor node information.
 + * The bridgeType and regionCode should be used only when isBridge is true.
 + */
 +[scriptable, uuid(7547d8e5-a93e-4a0c-9876-a7a2cc44e80f)]
 +interface torITorNodeInfo : nsISupports {
 +  readonly attribute ACString fingerprint;
 +  readonly attribute Array<ACString> ipAddrs;
 +  readonly attribute boolean isBridge;
 +  readonly attribute ACString bridgeType;
 +  readonly attribute ACString regionCode;
 +};
++
 +/**
 + * The information to associate a SOCKS isolation credential (the combination
 + * of SOCKS username and password) to one or more circuits.
 + */
 +[scriptable, uuid(a85269dc-1aca-4aec-87a6-88ff035f0eaa)]
 +interface torITorStreamInfo : nsISupports {
 +  readonly attribute ACString socksUsername;
 +  readonly attribute ACString socksPassword;
 +  readonly attribute Array<Array<torITorNodeInfo> > circuits;
 +};

toolkit/modules/TorAndroidIntegration.sys.mjs

@@ -130,13 +130,19 @@ class TorAndroidIntegrationImpl {
            {}
          );
          break;
 -      case lazy.TorProviderTopics.TorLog:
 -        lazy.EventDispatcher.instance.sendRequest(EmittedEvents.torLogs, {
 -          logType: subj.wrappedJSObject.type ?? "",
 -          message: subj.wrappedJSObject.msg ?? "",
 -          timestamp: subj.wrappedJSObject.timestamp ?? "",
 -        });
 +      case lazy.TorProviderTopics.TorLog: {
 +        try {
 +          const entry = subj.QueryInterface(Ci.torITorLogEntry);
 +          lazy.EventDispatcher.instance.sendRequest(EmittedEvents.torLogs, {
 +            logType: entry.severity,
 +            message: entry.message,
 +            timestamp: entry.timestamp,
 +          });
 +        } catch (e) {
 +          logger.warn("Failed to dispatch a log event", e, subj);
 +        }
          break;
 +      }
        case lazy.TorSettingsTopics.Ready:
          lazy.EventDispatcher.instance.sendRequest(EmittedEvents.settingsReady, {
            settings: lazy.TorSettings.getSettings(),

tools/torbrowser/l10n/migrate.py

  """
 -Migration script for running migration recipes.
 +Migration script for running Tor Browser migration recipes.
 -Requires the mozilla fluent.migrate package (available with pip).
 +Based on the Firefox migration script, adapted for Tor Browser. See
 +https://firefox-source-docs.mozilla.org/l10n/migrations/ for more context and
 +information on how to write the migration recipes.
 -NOTE: This will likely send queries to the weblate API as part of the run.
 -Weblate may have a query limit of 100 requests per day for unauthorised users.
 +## Concepts
++
 ++ String. Here, when we say "string", it refers to a piece of text that can be
 +  translated. In practice, you can think of it as a being defined by a triple:
 +  a file path relative to a locale's directory, an ID, and some content. For
 +  example `("./tor-browser.ftl", "my-id", "my-id =\\n .label=Content")`.
 +  When a string is translated the file path and ID stay the same, whilst the
 +  translatable part of the content can vary.
 ++ Reference files. These are the en-US source Fluent files that contain the
 +  *manual* string changes made by a developer. For most migrations, there is
 +  only one reference file.
 ++ Migration recipe. A collection of instructions that take some string inputs
 +  and transforms them into new strings. These are meant to mirror the manual
 +  changes that were made in the reference files, in a way that can be applied
 +  to any locale.
 ++ Translation repository. This refers to a local copy of the `translation`
 +  repository (https://gitlab.torproject.org/tpo/translation). This repository
 +  contains a different branch for different collections of strings. For
 +  Tor Browser we usually use `tor-browser`, `base-browser` and
 +  `fenix-torbrowserstringsxml`. Each branch will contain an `en-US` directory,
 +  which contains the "source" files for translators to translate. These source
 +  files are taken from the `tor-browser` repository. The branches also contain
 +  a directory for each locale that is to be translated, in a file structure that
 +  reflects the source `en-US` directory. This is where the migration script will
 +  write changes to the translated files.
++
++
 +## Usage
++
 +You will likely want to run this with `./mach python`, so that it uses the
 +`fluent.migrate` and `fluent.syntax` packages provided with the `tor-browser`
 +repository.
++
 +For example, you might run this as
 -Based on the firefox migration script, adapted for tor browser. See
 -https://firefox-source-docs.mozilla.org/l10n/migrations/ for more context and
 -information on how to write the migration recipes.
 +```
 +    ./mach python migrate.py --translation-git /home/user/translation --locales 'es-ES sr' ./migrations/bug-xxxx-my-migration-recipe.py
 +```
++
 +Here `/home/user/translation` is a local translation repository with one of its
 +branches checked out (see below). This will run the migration recipe given in
 +`./migrations/bug-xxxx-my-migration-recipe.py` for the `es-ES` and `sr`
 +sub-directories within the `translation/` directory.
++
 +### Changing the reference location
++
 +You can optionally run the script with `--reference_directory` to read the
 +reference en-US files from somewhere other than the `translation` directory.
 +This can be useful  when your manual changes have yet to reach the translation
 +repository, so you want to point the script to read the reference from the
 +`tor-browser` working directory instead. E.g.
++
 +```
 +    --reference-directory /home/user/tor-browser/toolkit/locales/en-US/toolkit/global/
 +```
++
++
 +## Recipes
++
 +Migration recipes are meant to mirror some manual change that was made to the
 +en-US source strings, in a way that can be reproduced in another locale.
 +### Example 1
 -Usage with an example:
 +For this example, a developer wants to remove the string content from
 +`old-strings.properties`:
 -We have some en-US file "updated.ftl" in the tor-browser repository that we have
 -added new strings to. Some of these strings are copies or concatenations of some
 -already existing strings in a `.dtd`, `.properties` or `.ftl` file (including
 -strings within "updated.ftl").
 +```
 +my.old.string=Some string content
 +my.old.title=This is the tooltip
 +```
++
 +And add them to `tor-browser.ftl` instead, as:
 -So we also write a migration recipe in
 -`./l10n_migrations/bug-xxxx-my-migration-recipe.py`
 -which includes a `migrate(ctx)` method. This method takes the old strings and
 -create new Messages or Terms for "updated.ftl" using `ctx.add_transforms`. These
 -should match what was already done manually in "updated.ftl".
 +```
 +my-new-string = Some string content
 +    .title = This is the tooltip
 +```
++
 +For the en-US source strings, the developer simply deletes the two lines in the
 +`old-strings.properties` file (or the whole file, if these are the last two).
 +And they manually write in the content of `my-new-string` to `tor-browser.ftl`.
 +These manual changes will then eventually reach the `translation` repository to
 +be translated.
++
 +But to save translators making the same manual changes, or re-translating, the
 +developer can write a migration recipe that mirror's their manual changes. In
 +this case, this migration recipe would contain:
++
 +```
 +ctx.add_transforms(
 +    "tor-browser.ftl", # The path to write to.
 +    "tor-browser.ftl", # The path to the reference file.
 +    transforms_from(
 +        \"\"\"
 +my-new-string = { COPY(path, "my.old.string") }
 +    .title = { COPY(path, "my.old.title") }
 +\"\"\",
 +        path="old-strings.properties", # The path to read from.
 +    ),
 +)
 +```
++
 +Note, the first argument of `add_transforms` is the target path, which is
 +`tor-browser.ftl` in this case. This means that the migration script will try to
 +write the resulting `my-new-string` to the locale's `./tor-browser.ftl` file.
 +For example, to `translation/es-ES/tor-browser.ftl`.
++
 +The second argument refers to the *reference* path. In almost all cases the
 +reference file will have the same name and path as the target path, but it has a
 +different role. Here the path is relative to the reference directory, which
 +contains the en-US source files. In this case, by default this means that
 +`translation/en-US/tor-browser.ftl` will act as the reference, but the exact
 +path could be changed with the `--reference-directory` argument. The existing
 +`my-new-string` will be read from this file to confirm that the migration
 +recipe produces the correct result.
++
 +The file `old-strings.properties` is used as an input. This means that the
 +existing strings in the locale's `old-strings.properties` file will be read to
 +construct the new string `my-new-string`. For example, it will be read from
 +`translation/es-ES/old-strings.properties`.
++
 +The `COPY` acts like a Fluent function, which asks the transformation to copy
 +the content from the translated string directly.
++
 +### Example 2
++
 +For this example, a developer wants to swap a string in `tor-browser.ftl` from:
++
 +```
 +my-old-string2 = Some string content
 +    .title = This is the tooltip
 +```
++
 +to
++
 +```
 +my-new-string2 =
 +    .label = Some string content
 +    .title = This is the tooltip
 +```
 -Then we copy the en-US file to our local translation repository, say at
 -`/home/user/translation/en-US/updated.ftl`. The en-US file is needed as a
 -reference during migration to know where in the new file the new Messages or
 -Terms should be placed. Moreover, the migration can be verified against the
 -en-US file to ensure it is working as intended.
 +The developer removes `my-old-string2` from the file and adds `my-new-string2`
 +instead. This manual change will then eventually reach the `translation`
 +repository for `my-new-string2` to be translated.
 -Then we run the migration for individual locales:
 +The developer also writes a migration recipe to mirror this change:
  ```
 -    python migrate_l10n.py --translation-git /home/user/translation --locales 'es-ES sr' l10n_migrations.bug-xxxx-my-migration-recipe
 +ctx.add_transforms(
 +    "tor-browser.ftl",
 +    "tor-browser.ftl",
 +    transforms_from(
 +        \"\"\"
 +my-new-string2 =
 +    .label = { COPY_PATTERN(path, "my-old-string2") }
 +    .title = { COPY_PATTERN(path, "my-old-string2.title") }
 +\"\"\",
 +        path="tor-browser.ftl",
 +    ),
 +)
  ```
 -This will first run a mock migration using the en-US localization files. This is
 -to help ensure that the migration will work as intended. I.e. if we ran the
 -migration recipe for en-US, using it as both the source of old strings and as a
 -reference, then each transformation using these old strings should produce a
 -Message or Term that is identical to the one in the reference file.
 +Note that in this case the locale's `tor-browser.ftl` file is being used as both
 +the input and the output.
++
 +Note that for a Fluent-to-Fluent migration we use `COPY_PATTERN` rather than
 +`COPY`. The second argument provides an ID that either point's to the
 +Fluent Messages' value (roughly, the text content) by giving the Message's ID,
 +or one of its attributes by adding a corresponding suffix to the ID.
++
 +### Other examples
++
 +Migration recipes can support a lot more, including more advanced
 +transformations like removing or replacing HTML tags from content. There are
 +some existing recipes in the `./migrations` directory that can be used as a
 +reference.
++
++
 +## translation directory
++
 +In most cases, you will just need to check out a `translation` branch that
 +contains the translated strings used by the migration recipe, as well as the
 +Fluent file that will be written to. Usually, this will be a branch based on
 +the origin/upstream `tor-browser` or `base-browser` branches.
++
 +However, if the migration recipe requires source files that are in a different
 +branch to the Fluent file that is being written to, then you will need to
 +manually copy those files into the working directory before running the script.
++
++
 +## Script procedure
 -Then this will run `migrate(ctx)` for the es-ES and sr locales. Some of the
 -transformations will not be completed for a locale if that locale does not
 -contain a translated version of the old strings the transformation requires
 -(because there is no string to copy).
 +### Test en-US migration
 -If one of the old strings is from a `.dtd` or `.properties` file, this will
 -check whether they are marked as translated on weblate using its API. This
 -prevents copying "placeholder" en-US values into the locale's fluent files.
 +The script will first run a test migration using the en-US strings. It will run
 +the migration using the files from `translation/en-US/` as the input. In the
 +previous example 1, this will read `my.old.string` and `my.old.title` from
 +`translation/en-US/old-strings.properties`. And in example 2, this will read
 +`my-old-string2` from `translation/en-US/tor-browser.ftl`.
 -Any warnings or errors will be logged to stderr in the console.
 +If any of the input strings are missing, this indicates that there is likely a
 +mistake in the recipe or the translation directory and the script will be
 +aborted without running the migration for the other locales.
++
 +Otherwise, it then compares the result of this migration with the strings found
 +in the reference files. In the previous example 1, this will read the entry for
 +`my-new-string` from `<reference-dir>/tor-browser.ftl`, where `<reference-dir>`
 +is `translation/en-US/` unless `--reference-directory` is given to use a
 +different directory. If the reference entry for `my-new-string` differs from the
 +entry that the recipe automatically produced, then this indicates that there is
 +a mistake in the recipe and the script will be aborted.
++
 +### Locale migrations
++
 +If the test migration passed, then the recipe will be re-run for each of the
 +specified locales. If the locale is missing some strings or files that a single
 +transformation requires, then that transformation will be skipped and the
 +corresponding entry won't be written to the Fluent file. Otherwise the new
 +entries will be appended to the existing Fluent files.
++
 +#### Non-Fluent strings and Weblate queries
++
 +Some non-Fluent formats, like DTD and properties, will fill untranslated strings
 +with the source en-US content. And we don't want these untranslated strings to
 +be used for migrations. There is no metadata within the files to determine this,
 +and simply being the same as the en-US string is not a reliable indicator.
++
 +So for these strings the script will additionally make a remote query to the
 +Weblate API to fetch the metadata that indicates whether the string is
 +considered translated or not. If a transformation requires a string that is
 +marked as untranslated, it will be skipped.
++
 +NOTE: The Weblate metadata is not always reliable, so you should still manually
 +review the changes.
++
 +NOTE: When testing before, the Weblate API was limited to 100 requests per day
 +per IP address for unauthorised users. If this becomes an issue you may want to
 +run the migrations in limited batches of locales with new IP addresses. Or, you
 +can create a Weblate account and change this script to pass an authorisation
 +token with the request.
  """
  import argparse
@@ -63,142 +257,299 @@ import logging
  import os
  import sys
  import urllib.request
 +from collections.abc import Iterator
 +from typing import Any, NamedTuple, Protocol, cast
  from fluent.migrate.context import MigrationContext
  from fluent.migrate.errors import EmptyLocalizationError, UnreadableReferenceError
  from fluent.syntax import ast, parse, serialize
 -def in_red(string):
 +def in_red(string: str) -> str:
      """
      Wrap a string so that it is shown as red in the console.
 +    :param string: The string to wrap.
 +    :returns: The wrapped string.
      """
      return f"\x1b[1;91m{string}\x1b[0m"
 +def assert_keys(
 +    check_dict: dict[Any, Any], expected_keys: tuple[str, ...], url: str
 +) -> None:
 +    """
 +    Verify that the dictionary contains *at least* the expected keys,
 +    otherwise this throws.
 +    :param check_dict: The dictionary to check.
 +    :param url: The url where the dictionary was fetched from.
 +    """
 +    for key in expected_keys:
 +        if key not in check_dict:
 +            raise ValueError(f"Missing '{key}' in response for {url}")
++
++
 +class WeblateUnit:
 +    """
 +    Represents a Weblate "unit": roughly corresponds to a translated string.
++
 +    See https://docs.weblate.org/en/latest/api.html#units.
 +    """
++
 +    def __init__(self, data: dict[Any, Any], url: str) -> None:
 +        """
 +        :param data: The Weblate data response.
 +        :param url: The URL that the data came from.
 +        """
 +        assert_keys(data, ("context", "translated"), url)
 +        string_id = data["context"]
 +        translated = data["translated"]
 +        if not isinstance(string_id, str):
 +            raise ValueError(f"Unexpected 'context' type in response for {url}")
 +        if not isinstance(translated, bool):
 +            raise ValueError(f"Unexpected 'translated' type in response for {url}")
++
 +        self.string_id = string_id
 +        self.translated = translated
++
++
 +class WeblateTranslation:
 +    """
 +    Represents a Weblate "translation": roughly corresponds to the translation
 +    of a file for a given locale/language.
++
 +    See https://docs.weblate.org/en/latest/api.html#translations.
 +    """
++
 +    def __init__(self, data: dict[Any, Any], url: str) -> None:
 +        """
 +        :param data: The Weblate data response.
 +        :param url: The URL that the data came from.
 +        """
 +        assert_keys(data, ("filename", "units_list_url"), url)
 +        locale_path = data["filename"]
 +        units_url = data["units_list_url"]
 +        if not isinstance(locale_path, str):
 +            raise ValueError(f"Unexpected 'filename' type in response for {url}")
 +        if not isinstance(units_url, str):
 +            raise ValueError(f"Unexpected 'units_list_url' type in response for {url}")
++
 +        self.locale_path = locale_path
 +        self.units_url = units_url
 +        # The units, indexed by their string ID. Lazy-loaded and `None` whilst
 +        # unfilled.
 +        self.units: None | dict[str, WeblateUnit] = None
++
++
 +class WeblateComponent:
 +    """
 +    Represents a Weblate "component": roughly corresponds to a source (en-US)
 +    file that can be translated.
++
 +    See https://docs.weblate.org/en/latest/api.html#components.
 +    And https://docs.weblate.org/en/latest/user/basic.html.
 +    """
++
 +    def __init__(self, data: dict[Any, Any], url: str) -> None:
 +        """
 +        :param data: The Weblate data response.
 +        :param url: The URL that the data came from.
 +        """
 +        assert_keys(data, ("template", "translations_url", "branch"), url)
 +        template_path = data["template"]
 +        translations_url = data["translations_url"]
 +        branch = data["branch"]
 +        if not isinstance(template_path, str):
 +            raise ValueError(f"Unexpected 'template' type in response for {url}")
 +        if not isinstance(translations_url, str):
 +            raise ValueError(
 +                f"Unexpected 'translations_url' type in response for {url}"
 +            )
 +        if not isinstance(branch, str):
 +            raise ValueError(f"Unexpected 'branch' type in response for {url}")
++
 +        self.branch = branch
 +        # The path to the source (en-US) file.
 +        self.template_path = template_path
 +        # The URL to fetch the component's translations from.
 +        self.translations_url = translations_url
 +        # The translations data, indexed by the locale file paths. Lazy-loaded
 +        # and `None` whilst unfilled.
 +        self.translations: None | dict[str, WeblateTranslation] = None
++
++
  class WeblateMetadata:
      """
 -    Manages and fetches string metadata from weblate.
 +    Manages and fetches string metadata from Weblate.
      """
 -    def __init__(self):
 +    # The translation branches that we expect to be used for Weblate.
 +    _BROWSER_BRANCHES = ["tor-browser", "base-browser", "fenix-torbrowserstringsxml"]
 +    _WEBLATE_API_URL = "https://hosted.weblate.org/api/"
 +    _WEBLATE_API_TOR_COMPONENTS_URL = _WEBLATE_API_URL + "projects/tor/components/"
++
 +    def __init__(self) -> None:
 +        """
 +        Create a new instance for fetching Weblate metadata.
 +        """
          self.logger = logging.getLogger("weblate-metadata")
          self.logger.setLevel(logging.INFO)
 -        # The _components property will be lazy-loaded with weblate data.
 -        #
 -        # On weblate, for monolingual formats, the component will have a
 -        # "template" file, which matches the en-US file path in the
 -        # "translation" git repo. So we can find a component through a matching
 -        # template.
 -        #
 -        # Each translation in that component will have a "filename" that will
 -        # match the locale's file path in the "translation" git repo. So we can
 -        # find a translation through a matching filename.
 -        #
 -        # Each translation can be queried for its units, including metadata.
 -        # Each unit's "context" will match the string's id in the corresponding
 -        # file.
 -        #
 -        # Expect the final structure to be:
 -        # {
 -        #   template: {
 -        #     "translations-url": str,     # Used for API translations query.
 -        #     "translations": {
 -        #        filename: {
 -        #          "units-url": str,       # Used for API units query.
 -        #          "units": {
 -        #            context: {
 -        #              "translated": bool,
 -        #            },
 -        #          },
 -        #        },
 -        #     },
 -        #   },
 -        # }
 -        self._components = None
+-
 -    def _get_weblate_response(self, url):
 +        # The _components property will be lazy-loaded with Weblate data.
 +        self._components: dict[str, WeblateComponent] | None = None
++
 +    def _get_weblate_response(self, url: str) -> Any:
 +        """
 +        Make a single query to Weblate.
 +        :param url: The URL to fetch.
 +        :returns: The JSON response.
 +        """
 +        if not url.startswith(self._WEBLATE_API_URL):
 +            raise ValueError(f"Unexpected URL request: {url}")
++
          weblate_request = urllib.request.Request(
              url,
              # NOTE: can set the request header:
              # "Authorization": "Token WEBLATE_TOKEN"
 -            # to get around rate-limiting
 +            # to get around rate-limiting.
 +            # NOTE: We empty the User-Agent to override the default
 +            # value of "Python-urllib/{major}.{minor}".
              headers={"User-Agent": ""},
+         )
 -        with urllib.request.urlopen(weblate_request, timeout=20) as response:
 +        with urllib.request.urlopen(weblate_request) as response:
              return json.load(response)
 -    def _get_from_weblate(self, url):
 -        ret = []
 +    def _get_from_weblate(self, url: str) -> list[dict[Any, Any]]:
 +        """
 +        Fetch a list of results from Weblate.
 +        :param url: The initial URL to fetch a response from.
 +        :returns: The returned list of results.
 +        """
 +        ret: list[dict[Any, Any]] = []
          while url:
              response = self._get_weblate_response(url)
 +            if not isinstance(response, dict):
 +                raise ValueError(f"Unexpected response type for {url}")
 +            assert_keys(response, ("results", "next"), url)
++
 +            res_val = response["results"]
 +            if not isinstance(res_val, list):
 +                raise ValueError(f"Unexpected 'results' type for {url}")
 +            for res_item in res_val:
 +                if not isinstance(res_item, dict):
 +                    raise ValueError(f"Unexpected 'results' item type for {url}")
 +                ret.append(res_item)
++
              # Continue to fetch the next page, if it is present.
 -            # Expect the "next" url to be empty
 +            # Expect the "next" url to be null
              # or the same url with "?page=2", etc.
 -            url = response["next"]
 -            ret.extend(response["results"])
 +            next_val = response["next"]
 +            if next_val is not None and not isinstance(next_val, str):
 +                raise ValueError(f"Unexpected 'next' type in response for {url}")
 +            url = "" if next_val is None else next_val
          return ret
 -    def _get_components(self):
 +    def _get_components(self) -> dict[str, WeblateComponent]:
 +        """
 +        Get all the Tor Browser Weblate components.
++
 +        We identify each Weblate component by its template path: the en-US
 +        file path in the translation repository.
++
 +        NOTE: We assume that the template path uniquely identifies the
 +        component, even though this is not guaranteed in general by Weblate.
++
 +        :returns: A dictionary of components, indexed by their en-US template
 +          path.
 +        """
 +        url = self._WEBLATE_API_TOR_COMPONENTS_URL
          if self._components is None:
              self._components = {
 -                comp["template"]: {
 -                    "translations": None,
 -                    "translations-url": comp["translations_url"],
 -                }
 -                for comp in self._get_from_weblate(
 -                    "https://hosted.weblate.org/api/projects/tor/components/"
 +                comp.template_path: comp
 +                for comp in (
 +                    WeblateComponent(data, url) for data in self._get_from_weblate(url)
+                 )
 -                if comp["template"]
 +                if comp.template_path and comp.branch in self._BROWSER_BRANCHES
+             }
          return self._components
 -    def _get_translations(self, template):
 -        component = self._get_components().get(template, None)
 +    def _get_translations(
 +        self, template_path: str
 +    ) -> dict[str, WeblateTranslation] | None:
 +        """
 +        Get the Weblate translations for a given Weblate component.
++
 +        We identify each translation by its file path: the locale-specific path
 +        that the translated file is written to.
++
 +        :param template_path: The component's en-US template path.
 +        :returns: A dictionary of translations, indexed by their locale file
 +          paths. Or `None` if no components were found.
 +        """
 +        component = self._get_components().get(template_path, None)
          if not component:
 -            self.logger.warning(f"No component in weblate for {template}.")
 +            self.logger.warning(f"No component in Weblate for {template_path}.")
              return None
 -        if component["translations"] is None:
 -            component["translations"] = {
 -                trans["filename"]: {
 -                    "units": None,
 -                    "units-url": trans["units_list_url"],
 -                }
 -                for trans in self._get_from_weblate(component["translations-url"])
 +        if component.translations is None:
 +            url = component.translations_url
 +            component.translations = {
 +                trans.locale_path: trans
 +                for trans in (
 +                    WeblateTranslation(data, url)
 +                    for data in self._get_from_weblate(url)
 +                )
+             }
 -        return component["translations"]
 +        return component.translations
++
 +    def _get_units(
 +        self, template_path: str, locale_path: str
 +    ) -> dict[str, WeblateUnit] | None:
 +        """
 +        Get the Weblate units for a given Weblate translation.
++
 +        We identify each unit by its string ID.
 -    def _get_units(self, template, file):
 -        translation_dict = self._get_translations(template)
 +        :param template_path: The containing component's en-US template path.
 +        :param locale_path: The translation's locale file path.
 +        :returns: A dictionary of units, indexed by their string ID. Or `None`
 +          if no translations could be found.
 +        """
 +        translation_dict = self._get_translations(template_path)
          if translation_dict is None:
              return None
 -        translation = translation_dict.get(file, None)
 +        translation = translation_dict.get(locale_path, None)
          if translation is None:
 -            self.logger.warning(f"No translation in weblate for {file}.")
 +            self.logger.warning(f"No translation in Weblate for {locale_path}.")
              return None
 -        if translation["units"] is None:
 -            translation["units"] = {
 -                unit["context"]: {
 -                    "translated": unit["translated"],
 -                }
 -                for unit in self._get_from_weblate(translation["units-url"])
 +        if translation.units is None:
 +            url = translation.units_url
 +            translation.units = {
 +                unit.string_id: unit
 +                for unit in (
 +                    WeblateUnit(data, url) for data in self._get_from_weblate(url)
 +                )
+             }
 -        return translation["units"]
 +        return translation.units
 -    def is_translated(self, template_path, locale_path, string_id):
 +    def is_translated(self, file_path: str, locale: str, string_id: str) -> bool:
          """
 -        Whether the given string is marked as translated on weblate.
 +        Test whether the given string is marked as translated on Weblate.
++
 +        :param file_path: The file to check the translation of, relative to the
 +          locale's directory.
 +        :param locale: The locale to check for.
 +        :param string_id: The ID of the string to check.
          """
 +        template_path = os.path.join("en-US", file_path)
 +        locale_path = os.path.join(locale, file_path)
          unit_dict = self._get_units(template_path, locale_path)
          if unit_dict is None:
              return False
          unit = unit_dict.get(string_id, None)
          if unit is None:
 -            self.logger.warning(f"No unit in weblate for {locale_path}:{string_id}.")
 +            self.logger.warning(f"No unit in Weblate for {locale_path}:{string_id}.")
              return False
 -        return unit["translated"]
 +        return unit.translated
  class TorBrowserMigrationContext(MigrationContext):
@@ -206,12 +557,18 @@ class TorBrowserMigrationContext(MigrationContext):
      Extension which adds some extra methods to use for tor-browser.
      """
 -    def __init__(self, locale, reference_dir, localization_dir):
 +    def __init__(self, locale: str, reference_dir: str, localization_dir: str) -> None:
          super().__init__(locale, reference_dir, localization_dir)
 -    def _fluent_keys(self, resource):
 +    def _fluent_keys(self, resource: ast.Resource) -> Iterator[str]:
 +        """
 +        Generate all the keys within a Fluent resource, where a key is an
 +        identifier for a Term, a Message, a Term attribute, or a Message
 +        attribute.
 +        :yield: The Fluent keys.
 +        """
          # ast.Resource, want to extract all Message and Term identifiers, as
 -        # well as their
 +        # well as their attributes.
          for entry in resource.body:
              if not isinstance(entry, (ast.Term, ast.Message)):
                  continue
@@ -223,12 +580,13 @@ class TorBrowserMigrationContext(MigrationContext):
              for attr in entry.attributes:
                  yield f"{key}.{attr.id.name}"
 -    def tb_get_available_strings(self):
 +    def tb_get_available_strings(self) -> set[tuple[str, str]]:
          """
 -        Return all the (path, string_id) pairs for all loaded localization
 +        Get all the (path, string_id) pairs for all loaded localization
          resources.
 +        :returns: The string pairs.
          """
 -        all_strings = set()
 +        all_strings: set[tuple[str, str]] = set()
          # ctx.localization_resources is a dict containing all the loaded
          # localization_resources that have been added during add_transforms.
          # { localization_path: resource }
@@ -237,14 +595,13 @@ class TorBrowserMigrationContext(MigrationContext):
                  all_strings.update((path, key) for key in self._fluent_keys(resource))
              else:
                  # dictionary of { identifies: value } in legacy resource.
 -                # For tor-browser,
 -                # Only include references that differ from the en-US strings.
                  all_strings.update((path, key) for key in resource.keys())
          return all_strings
 -    def tb_get_missing_resources(self):
 +    def tb_get_missing_resources(self) -> set[str]:
          """
 -        Return the missing localization resources.
 +        Get the missing localization resources.
 +        :returns: The set of resource paths.
          """
          return set(
              path
@@ -253,25 +610,51 @@ class TorBrowserMigrationContext(MigrationContext):
              if path not in self.localization_resources
+         )
 -    def tb_get_transform(self, target_path, transform_id):
 +    def tb_get_transform(
 +        self, target_path: str, transform_id: str
 +    ) -> ast.Message | ast.Term | None:
          """
 -        Find the transformation node with the given id for the given path.
 +        Find a transformation node.
 +        :param target_path: The target path of the transformation.
 +        :param transform_id: The ID of the transformation, AKA the string ID.
 +        :returns: The matching transformation node, or `None` if there is no
 +          match.
          """
          for node in self.transforms[target_path]:
              if node.id.name == transform_id:
                  return node
          return None
 -    def tb_get_reference_entry(self, target_path, entry_id):
 +    def tb_get_reference_entry(
 +        self, target_path: str, transform_id: str
 +    ) -> ast.Message | ast.Term | None:
          """
 -        Find the reference node that would be used for the given id and path.
 +        Find a reference Message or Term for a given transformation.
 +        :param target_path: The target path of the transformation.
 +        :param transform_id: The ID of the transformation, AKA the string ID.
 +        :returns: The matching reference entry for the transformation, or `None`
 +          if there is no match.
          """
          for entry in self.reference_resources[target_path].body:
 -            if isinstance(entry, (ast.Term, ast.Message)) and entry.id.name == entry_id:
 +            if (
 +                isinstance(entry, (ast.Term, ast.Message))
 +                and entry.id.name == transform_id
 +            ):
                  return entry.clone()
          return None
 +class RecipeModule(Protocol):
 +    def migrate(self, context: MigrationContext) -> None: ...
++
++
 +class FluentSyntaxError(NamedTuple):
 +    path: str
 +    message: str
 +    line: int
 +    sample: str
++
++
  class TorBrowserMigrator:
      """
      Performs a tor-browser migration.
@@ -279,26 +662,38 @@ class TorBrowserMigrator:
      def __init__(
          self,
 -        en_US_dir,
 -        locale_dirs,
 -        migrate_module,
 -        weblate_metadata,
 -    ):
 +        en_US_ref_dir: str,
 +        en_US_target_dir: str,
 +        locale_dirs: dict[str, str],
 +        recipe_module: RecipeModule,
 +        weblate_metadata: WeblateMetadata,
 +    ) -> None:
 +        """
 +        :param en_US_ref_dir: The path to the en-US directory where reference
 +          Fluent entries for the recipe can be found.
 +        :param en_US_target_dir: The path to the en-US directory where existing
 +          strings used by the recipe can be found.
 +        :param locale_dirs: The collection of locales to run the migrations for.
 +        :param recipe_module: The python module that contains the recipe
 +          instructions.
 +        :param weblate_metadata: The object to fetch Weblate metadata from.
 +        """
          self.logger = logging.getLogger("tor-browser-migrator")
          self.logger.setLevel(logging.INFO)
 -        self.en_US_dir = en_US_dir
 +        self.en_US_ref_dir = en_US_ref_dir
 +        self.en_US_target_dir = en_US_target_dir
          self.locale_dirs = locale_dirs
 -        self.migrate_module = migrate_module
 +        self.recipe_module = recipe_module
          self.weblate_metadata = weblate_metadata
 -    def run(self):
 +    def run(self) -> None:
          """
          Run the migration.
          """
          if not self._check_en_US_resources():
              sys.exit(1)
 -        fluent_errors = []
 +        fluent_errors: list[FluentSyntaxError] = []
          for locale, locale_dir in self.locale_dirs.items():
              if locale == "en-US":
                  print("", file=sys.stderr)
@@ -316,12 +711,18 @@ class TorBrowserMigrator:
                  "Migration does not need to be run again, but the following "
                  "syntax errors should be fixed manually.\n"
                  + "\n".join(
 -                    f"{in_red(full_path)}: line {line}: {message}: [[{sample}]]"
 -                    for full_path, message, line, sample in fluent_errors
 +                    f"{in_red(err.path)}: line {err.line}: {err.message}: [[{err.sample}]]"
 +                    for err in fluent_errors
+                 )
+             )
 -    def _run_locale(self, locale, locale_dir):
 +    def _run_locale(self, locale: str, locale_dir: str) -> list[FluentSyntaxError]:
 +        """
 +        Run a migration for a given locale.
 +        :param locale: The name of the locale.
 +        :param locale_dir: The path to the locale's directory.
 +        :returns: A list of Fluent errors in the written files.
 +        """
          print("\n\n", file=sys.stderr)
          self.logger.info(f"Migrating '{in_red(locale)}' locale\n")
@@ -358,7 +759,7 @@ class TorBrowserMigrator:
          available_strings = ctx.tb_get_available_strings()
          wrote_file = False
 -        errors = []
 +        errors: list[FluentSyntaxError] = []
          for target_path, reference in ctx.reference_resources.items():
              translated_ids = [
@@ -422,13 +823,13 @@ class TorBrowserMigrator:
                          break
                      # Strings in legacy formats might have an entry in the file
                      # that is just a copy of the en-US strings.
 -                    # For these we want to check the weblate metadata to ensure
 +                    # For these we want to check the Weblate metadata to ensure
                      # it is a translated string.
                      if not path.endswith(
                          ".ftl"
                      ) and not self.weblate_metadata.is_translated(
 -                        os.path.join("en-US", path),
 -                        os.path.join(locale, path),
 +                        path,
 +                        locale,
                          string_id,
                      ):
                          can_transform = False
@@ -436,7 +837,7 @@ class TorBrowserMigrator:
                              f"Skipping transform {target_path}:{transform_id} "
                              f"for '{locale}' locale because the string "
                              f"{path}:{string_id} has not been translated on "
 -                            "weblate."
 +                            "Weblate."
+                         )
                          break
                  if not can_transform:
@@ -463,7 +864,9 @@ class TorBrowserMigrator:
              wrote_file = True
              # Collect any fluent parsing errors from the newly written file.
              errors.extend(
 -                (full_path, message, line, sample)
 +                FluentSyntaxError(
 +                    path=full_path, message=message, line=line, sample=sample
 +                )
                  for message, line, sample in self._fluent_errors(full_content)
+             )
@@ -471,27 +874,42 @@ class TorBrowserMigrator:
              self.logger.info(f"No files written for '{locale}' locale.")
          return errors
 -    def _fluent_errors(self, fluent):
 +    def _fluent_errors(self, fluent_content: str) -> Iterator[tuple[str, int, str]]:
          """
 -        Verify that the given fluent string can be parsed correctly.
 +        Parse the given content as a Fluent file and generate all the syntax
 +        errors.
 +        :param fluent_content: The file content to parse.
 +        :yield: Each encountered Fluent syntax error as a triple of the message,
 +        the line number, and a sample.
          """
 -        resource = parse(fluent)
 +        resource = parse(fluent_content)
          for entry in resource.body:
              if not isinstance(entry, ast.Junk):
                  continue
              for annotation in entry.annotations:
 -                line = fluent[0 : annotation.span.start].count("\n") + 1
 -                sample_start = max(annotation.span.start - 15, 0)
 -                sample = "…" + fluent[sample_start : sample_start + 30] + "…"
 -                yield annotation.message, line, sample
+-
 -    def _get_migration_context(self, locale, locale_dir):
 -        prev_missing_resources = set()
 +                start = 0
 +                if annotation.span:
 +                    start = annotation.span.start
 +                line = fluent_content[0:start].count("\n") + 1
 +                sample_start = max(start - 15, 0)
 +                sample = "…" + fluent_content[sample_start : sample_start + 30] + "…"
 +                yield annotation.message or "", line, sample
++
 +    def _get_migration_context(
 +        self, locale: str, locale_dir: str
 +    ) -> TorBrowserMigrationContext:
 +        """
 +        Create a new migration context.
 +        :param locale: The name of the locale.
 +        :param locale_dir: The directory path for the locale.
 +        :returns: The new context.
 +        """
 +        prev_missing_resources: set[str] = set()
          while True:
 -            ctx = TorBrowserMigrationContext(locale, self.en_US_dir, locale_dir)
 +            ctx = TorBrowserMigrationContext(locale, self.en_US_ref_dir, locale_dir)
              try:
 -                self.migrate_module.migrate(ctx)
 +                self.recipe_module.migrate(ctx)
              except EmptyLocalizationError:
                  # This case will be handled by missing_resources below.
                  # NOTE: At the time of writing, add_transforms only throws if
@@ -543,20 +961,28 @@ class TorBrowserMigrator:
              # before localization_resources was fully populated.
              prev_missing_resources = missing_resources
 -    def _remove_if_empty(self, path):
 +    def _remove_if_empty(self, path: str) -> None:
 +        """
 +        Remove a file if it is empty.
 +        :param path: The path to remove.
 +        """
          if os.stat(path).st_size:
              self.logger.warning(f"{path} is no longer empty. Not deleting.")
              return
          os.remove(path)
 -    def _check_en_US_resources(self):
 -        # We pass in the en-US directory as the localization directory, as well
 -        # as the reference directory.
 -        ctx = TorBrowserMigrationContext("en-US", self.en_US_dir, self.en_US_dir)
 +    def _check_en_US_resources(self) -> bool:
 +        """
 +        Verify that the migration recipe works as expected using en-US strings.
 +        :returns: Whether the recipe worked as expected.
 +        """
 +        ctx = TorBrowserMigrationContext(
 +            "en-US", self.en_US_ref_dir, self.en_US_target_dir
 +        )
          have_error = False
          try:
 -            self.migrate_module.migrate(ctx)
 +            self.recipe_module.migrate(ctx)
          except EmptyLocalizationError:
              # Handle with localization_resources check.
              # NOTE: This throwing may have prevented further add_transforms from
@@ -566,7 +992,9 @@ class TorBrowserMigrator:
              have_error = True
          except UnreadableReferenceError:
              # Reference filename is printed before this.
 -            self.logger.error("Missing an en-US reference file.")
 +            self.logger.error(
 +                "Missing an en-US reference file. Is --reference-directory correct?"
 +            )
              return False
          # Check each transform would create the same entry in the target as the
@@ -602,7 +1030,8 @@ class TorBrowserMigrator:
              reference_entry = ctx.tb_get_reference_entry(target_path, transform_id)
              if reference_entry is None:
                  self.logger.error(
 -                    f"Missing en-US reference entry for transform {transform_name}"
 +                    f"Missing en-US reference entry for transform {transform_name}. "
 +                    "Is --reference-directory correct?"
+                 )
                  have_error = True
                  continue
@@ -625,9 +1054,50 @@ class TorBrowserMigrator:
          return not have_error
 +def main(recipe_path: str, translation_dir: str, locales: str, ref_dir: str) -> None:
 +    """
 +    The main method.
 +    :param recipe_path: The path to the recipe script.
 +    :param translation_dir: The path to the translation repository directory.
 +    :param locales: The locales to run the recipe for, separated by spaces.
 +    :param ref_dir: The path to the reference directory.
 +    """
 +    if not os.path.isfile(recipe_path):
 +        print(f"{in_red(recipe_path)} is not a file.", file=sys.stderr)
 +        sys.exit(1)
++
 +    recipe_module_spec = importlib.util.spec_from_file_location("_recipe", recipe_path)
 +    recipe_module = cast(
 +        RecipeModule, importlib.util.module_from_spec(recipe_module_spec)
 +    )
 +    recipe_module_spec.loader.exec_module(recipe_module)
++
 +    def check_dir(path: str) -> str:
 +        if not os.path.isdir(path):
 +            print(f"{in_red(path)} is not a directory.", file=sys.stderr)
 +            sys.exit(1)
 +        return path
++
 +    translation_dir = check_dir(translation_dir)
 +    en_US_target_dir = check_dir(os.path.join(translation_dir, "en-US"))
 +    en_US_ref_dir = en_US_target_dir if ref_dir is None else check_dir(ref_dir)
++
 +    TorBrowserMigrator(
 +        en_US_ref_dir,
 +        en_US_target_dir,
 +        {
 +            locale: check_dir(os.path.join(translation_dir, locale))
 +            for locale in (l.strip() for l in locales.split(" "))
 +            if locale
 +        },
 +        recipe_module,
 +        WeblateMetadata(),
 +    ).run()
++
++
  parser = argparse.ArgumentParser(
      description="Run a tor-browser localization migration. "
 -    "See documentation within migrate_l10n.py."
 +    "See documentation within migrate.py."
+ )
  parser.add_argument(
      "--translation-git",
@@ -638,35 +1108,30 @@ parser.add_argument(
  parser.add_argument(
      "--locales",
      required=True,
 -    metavar="<locale1> <locale2> ...",
 -    help="Set of locales to restrict the migration to, separated by space.",
 +    metavar="'<locale1> <locale2> ...'",
 +    help="Set of locales to run the migration for, separated by space.",
+ )
  parser.add_argument(
 -    "migration",
 -    help="Migration to run, given as a python module. "
 -    'E.g. "l10n_migrations.my-migration-script".',
 +    "--reference-directory",
 +    metavar="<dir>",
 +    help="Location of the en-US directory that contains the reference changes "
 +    "that the recipe corresponds to. E.g. if the recipe constructs the string "
 +    "`my-new-string` in `./tor-browser.ftl`, it should point to a directory "
 +    "that contains the en-US `tor-browser.ftl` with `my-new-string` already "
 +    "within it. Defaults to the `en-US/` sub-directory within the "
 +    "translation-git directory.",
 +)
 +parser.add_argument(
 +    "recipe",
 +    help="The path to the migration recipe to run.",
+ )
  parsed_args = parser.parse_args()
+-
 -def check_dir(path):
 -    if not os.path.isdir(path):
 -        print(f"{in_red(path)} is not a directory.", file=sys.stderr)
 -        sys.exit(1)
 -    return path
+-
+-
 -translation_dir = check_dir(os.path.abspath(parsed_args.translation_git))
+-
 -TorBrowserMigrator(
 -    check_dir(os.path.join(translation_dir, "en-US")),
 -    {
 -        locale: check_dir(os.path.join(translation_dir, locale))
 -        for locale in (l.strip() for l in parsed_args.locales.split(" "))
 -        if locale
 -    },
 -    importlib.import_module(parsed_args.migration),
 -    WeblateMetadata(),
 -).run()
 +main(
 +    parsed_args.recipe,
 +    parsed_args.translation_git,
 +    parsed_args.locales,
 +    parsed_args.reference_directory,
 +)