New Alpha Release: Tor Browser 14.0a2
Tor Project blog (morgan)Tor Browser 14.0a2 is now available from the Tor Browser download page and also from our distribution directory.
This version includes important security updates to Firefox.
ESR Progress
As discussed in our previous blog post, we are hard at work updating Tor Browser to the Firefox ESR-128. New in this version we have our first updated Tor Browser Android build, we have completed our Bugzilla issue triage and code-audits, reviewed various upstream changes discovered from this work, and fixed various issues.
AndroidMassive Rebase
Tor Browser Android always requiers a bit more extra attention each year to update. One of the reasons for this is that Mozilla has altered the project layout non-trivally on us with each of the major updates.
Firefox Android (and therefore Tor Browser Android) has historically consisted of several separate components spread across multiple git repos: application-services, android-components, fenix, and GeckoView (GeckoView is the same codebase used to build desktop Firefox).
Last summer we had to update our patches as upstream's android-components and fenix had been merged into a single firefox-android repo which meant we had to merge all of the patches we had applied to these projects into our own firefox-android fork, on top of also updating our patches to work with all the other changes made during the year.
This summer we have had to do a similar thing once more, as Mozilla merged firefox-android into GeckoView in Firefox 126. So again we had to move and update all of our Tor Browser Android patches.
All of this work requires a lot of attention to detail, and has the annoying property that the work cannot be done incrementally. Someone basically has to go do all of this work locally while our users and the rest of the team patiently wait for the end result. That can be a stressful spot to be in, and the fact that we have to do this is outside our control is also rather frustrating.
Fortunately, there is a silver lining. After Tor Browser 14.0 stabilises, almost all of our the code which makes Tor Browser different from Firefox will be in the same repo. This will greatly simplify both maintenance and new feature development because changes which may require updates to multiple components, can now be reviewed in a single merge-request instead of being scattered across multiple repos. It will also make our patchset easier to reason about for this same reason. A single repo also makes it much easier for new developers to become familiar with the codebase since all the source lives in just one place!
The other silver lining from all of this is that we shouldn't need to do this again as there are no more components to migrate! Well, almost. The application-services component could be next but we have long-term plans.
Reproducibility IssuesTo help protect against various possible threats (release infrastructure compromise, toolchain attacks, rogue developers, etc) we have hard requirement that our releases are reproducible. We build our releases multiple times on multiple different machines on different networks and ensure the build outputs match byte-per-byte. Currently we are typically building on 3 different machines:
- a Tor Project build servers
- a Tor Browser developer PC
- a Mullvad build server
If all three machines (which are controlled and adminstered by different parties) build the exact same artifacts, then we sign and publish our builds. You can see this process in action in our 14.0a2 release-prep ticket on our Gitlab:
The kind of cool thing about this process is that users don't have to just trust our binaries, since they can be easily(ish) built locally. They can also make our builds and verify the build system does what we claim it does.
The other kind of cool thing about this setup is that we don't need to be super confident about the integrity of any one individual build machine. If any of the aforementioned machines were somehow compromised and inserting unknown code into our releases, it would be discovered immediately after building since the outputs would be different.
Another layer of assurance we have is that none of the the Tor Browser developers responsible for releases even have administrative access to the Mullvad build-server. We can only request a signed-tag be built and then it tells us the outputs.
As we've come to expect with a year's worth of toolchain updates, we uncovered some reproducibility problems in our Android apk generation. Fortunately, the problem was a well-understood one in the build-reproducibility space.
To summarise, groups of objects are often stored in some unordered set, and then enumerated to a list with a particular order. Depending on how these objects were originally stored and the method by which they are enumerated, one can get a differently ordered list (and therefore different build outputs) from run to run.
Fortunately, the solution is generally pretty simple: either sort the list afterward or change the underlying data-structure to be one which enumerates its contents deterministically (e.g. convert a HashSet<T>
to a BTreeSet<T>
).
We have triaged all of upstream Bugzilla issues closed by Mozilla in there releases from Firefox 116 through 128. From this massive list of literally thousands of issues, we have identified 256 particular issues developers need to investigate further. Of these we have investigated and potentially patched 56.
This work can be tracked in this Gitlab query.
We have also run out automated code-audit scripts on the entire relevant commit range and identified a handful of commits which should be looked at more closely.
Send us your feedback
If you find a bug or have a suggestion for how we could improve this release, please let us know.
Known Issues
There are a few known issues which we are aware of.
No Tor Browser 14.0a2 for x86 and x86_64 on Google Play StoreOur alpha release exceeds the Google Play Store's limit on APK size for x86 and x86_64 devices. This is being tracked here:
Tor Browser Android crashes when searching DuckDuckGo from the toolbar
This issue will be fixed in the next alpha release. It is being tracked here:
Full changelog
The full changelog since Tor Browser 14.0a1 is:
- All Platforms
- Updated NoScript to 11.4.34
- Bug tor-browser#42759: CI: remove localization file names that are in neither 14.0 nor 13.5 branches
- Bug tor-browser#42762: Review Mozilla 1498512: Enable by default setSinkId pref
- Bug tor-browser#42788: Review Mozilla 1828606: Add Recently Closed tabs to its own page
- Bug tor-browser#42789: Review Mozilla 1830157: Add new telemetry probe to determine how often an extension process had to be...
- Bug tor-browser#42792: Review Mozilla 1837097: Implement "Show less frequently" behavior for Pocket suggestions
- Bug tor-browser#42810: Review Mozilla 1840584: Support autofilling
first name
andlast name
field in a credit card form - Bug tor-browser#42814: Opt out from Firefox relay by default.
- Bug tor-browser#42818: Review Mozilla 1841295: Update PocketSuggestions for the final suggestions schema
- Bug tor-browser#42835: Filter data transfers containing files
- Bug tor-browser#42846: Review Mozilla 1841995: Enable Credit Card Autofill in ES and IT in nightly
- Bug tor-browser#42847: Review Mozilla 1841996: Enable Credit Card Autofill in AT, BE, and PL in nightly
- Bug tor-browser#42848: Review Mozilla 1841998: Enable Credit Card Autofill for ES,IT,AT,BE and PL locales in release. r=dimi...
- Bug tor-browser#42886: Review Mozilla 1848048: Add a result menu to disable trending results. r=dao,fluent-reviewers,setting...
- Bug tor-browser#42996: Review Mozilla 1517786: Implement and ship CanvasRenderingContext2D.getContextAttributes()
- Bug tor-browser#42999: Rebase Tor Browser Alpha onto 128.1.0esr
- Bug tor-browser#43011: Ship only one copy of the MIT license, like upstream.
- Bug tor-browser-build#41207: Upgrade lyrebird to 0.3.0
- Windows + macOS + Linux
- Updated Firefox to 128.1.0esr
- Bug tor-browser#42488: ESR 128: Remove role="code" from tor circuit panel
- Bug tor-browser#42596: Several console errors: Console.maxLogLevelPref used with a non-existing pref:
- Bug tor-browser#42612: Re-implement moz-toggle customizations for ESR 128
- Bug tor-browser#42622: Offline state is unreachable in about:torconnect (first bootstrap attempt)
- Bug tor-browser#42629: Tweak
isOnNewTabPage
patch - Bug tor-browser#42641: Move from panel-footer class to moz-button-group
- Bug tor-browser#42642: Downloads button warning no longer announced on Orca
- Bug tor-browser#42643: downloads panel separator has mismatched margin
- Bug tor-browser#42644: toolbar rules in panelUI-shared.css are unneccessary
- Bug tor-browser#42661: Re-run update_emojis.py and update locales
- Bug tor-browser#42662: Use data-hidden-from-search for hiding the firefox connection settings
- Bug tor-browser#42663: Tor Browser "Connection" settings missing a tooltip
- Bug tor-browser#42667: Add description-deemphasized class to our additions to about:preferences
- Bug tor-browser#42679: Use a more robust approach to hide the "tracking protection" urlbar button
- Bug tor-browser#42691: Simplified bridge cards prevent censored users from modifying built-in bridges
- Bug tor-browser#42695: Use
--arrowpanel-
variables for tor circuit panel spacing - Bug tor-browser#42696: Update
mail
icon used in "Find more bridges" - Bug tor-browser#42697: Remove padding to left of
tor-bridges-provider-list
under "Find more bridges" - Bug tor-browser#42699: Drop level="top" attribute from panels
- Bug tor-browser#42700: Remove !nodes condition from gTorCircuitPanel._updateCurrentBrowser
- Bug tor-browser#42704: Drop the badged="true" attribute from security level button
- Bug tor-browser#42705: Update our preferences to account for new line height
- Bug tor-browser#42713: Some --in-content CSS variables were renamed/removed
- Bug tor-browser#42806: Use the
lh
CSS unit - Bug tor-browser#42855: Review Mozilla 1843130: Pocket newtab use new recs api for locale list config if new api pref is set
- Bug tor-browser#42862: Review Mozilla 1845428: Instrument Translations Panel With Telemetry
- Bug tor-browser#42863: Review Mozilla 1847150: Add more TranslationsTelemetry event keys for panel open r=gregtatum, a=dsmith
- Bug tor-browser#42864: Review Mozilla 1848845: Pocket newtab migrate existing markets to new API. r=gvn a=RyanVM
- Bug tor-browser#42872: Disable translations until audited and solved the UX problems
- Windows + macOS
- Bug tor-browser#42774: Review Mozilla 1848815: Add a user-facing setting to enable enterprise roots import, and enable it by default
- Bug tor-browser#43021: Revert the OS deprecation notification introduced in #42347
- Windows
- Bug tor-browser#43051: windows: remove UI for "open Tor Browser automatically when computer starts"
- Android
- Updated GeckoView to 128.1.0esr
- Bug tor-browser#43048: Firefox logo on splash
- Bug tor-browser#43050: Center text in connect buttons
- Bug tor-browser#43057: fenix/.../search/list.json failing linting
- Build System
- All Platforms
- Updated Go to 1.23.0
- Bug tor-browser#42799: Do not run lint pipelines on new tag
- Bug tor-browser#43014: Add purgecaches to the dev build
- Bug tor-browser-build#41203: Tor Blog generation script uses the wrong url scheme for alpha releases
- Bug tor-browser-build#41213: Update the update_manual.py script to notify when no changes needed
- Windows + macOS + Linux
- Bug tor-browser#42668: Drop torconnect rule in eslint-plugin-mozilla
- Windows
- Bug tor-browser-build#41185: Drop Windows 7 support for 14.0 from build tools
- Bug tor-browser-build#41201: Bump the Windows version checked by the installer
- macOS
- Bug tor-browser-build#41202: 14.0a1 fails to run on macOS because of invalid signature
- Android
- Bug tor-browser-build#40544: Bump Java 8 version to something more recent
- Bug tor-browser-build#41123: Drop the firefox-android project
- Bug tor-browser-build#41171: Switch Android containers to Debian bookworm
- Bug tor-browser-build#41172: Refactor the android-toolchain project
- Bug tor-browser-build#41178: Force IPv4 when downloading in fix_gradle_deps.py
- Bug tor-browser-build#41200: Remove allowed_addons.json and the related tools
- Bug tor-browser-build#41206: GeckoView ignores the number of processors
- Bug tor-browser-build#41210: Use tor-expert-bundle-aar in geckoview/build_apk
- Bug tor-browser-build#41211: The Android license file is not deterministic anymore
- Bug tor-browser-build#41214: Update geckoview/config to be more like firefox/config
- Bug tor-browser-build#41217: Update realprep.py script to handle Firefox 128-based Tor Browser Android
- All Platforms
Generated by RSStT. The copyright belongs to the original author.