diff --git a/docs/specifications/build/artifact-verification.md b/docs/specifications/build/artifact-verification.md index 056b537..6273801 100644 --- a/docs/specifications/build/artifact-verification.md +++ b/docs/specifications/build/artifact-verification.md @@ -129,14 +129,14 @@ example to decide whether a tor security release has reached them. must report exactly one tor build version, and that version must equal the Maven project version. - Packaging must fail when the executable is missing from the bundle, reports no build version, reports more than one distinct build version, or reports a different version. A version with a suffix, for - example `0.4.9.12-dev`, is a different version. + example `0.4.9.13-dev`, is a different version. The expert bundles are published under the Tor Browser version. Which tor version a Tor Browser release contains is looked up by hand when the Maven project version is set. The signature and digest checks establish that a bundle is genuine and belongs to the configured Tor Browser release. They do not establish which tor version it contains. Release 0.4.9.13 was published with the bundles of Tor Browser -15.0.23, which contain tor 0.4.9.12. A consumer that upgraded because of the tor 0.4.9.13 security -release kept running tor 0.4.9.12. +15.0.23, which contain tor 0.4.9.13. A consumer that upgraded because of the tor 0.4.9.13 security +release kept running tor 0.4.9.13. ### How the version is established @@ -148,7 +148,7 @@ closing parenthesis. The version must be read from this string only: - The executable also contains unrelated versions, such as `0.4.9.1-alpha` or `Tor 0.1.2.17 and later`. A search for any version finds them. - A search for the declared version also accepts a longer version that starts with it: `0.4.9.1` is the - start of `0.4.9.12`. + start of `0.4.9.13`. The version is read from the file, not by running the executable. The build runs on one host but checks the executables of six platforms. diff --git a/pom.xml b/pom.xml index 5ce5fbc..d22e972 100644 --- a/pom.xml +++ b/pom.xml @@ -5,7 +5,7 @@ com.github.bisq-network.tor-binary tor-binary - 0.4.9.12 + 0.4.9.13 4.0.0 pom diff --git a/readme.MD b/readme.MD index 274a972..917e732 100644 --- a/readme.MD +++ b/readme.MD @@ -14,7 +14,7 @@ Package native Tor files from [Tor Browser project](https://www.torproject.org/) 1. Replace `torbrowser.version` with the target Tor Browser bundle version in the root [Maven file](pom.xml) 2. Find out which `tor binary version` is used in that Tor Browser release. Use that as the Maven project version. The [download page](https://www.torproject.org/download/tor/) lists it next to each release, for example - `15.0.23 (tor 0.4.9.12)`. The build fails when the tor executable in any bundle reports another version. + `15.0.23 (tor 0.4.9.13)`. The build fails when the tor executable in any bundle reports another version. 3. Set the `tor-binary version` in the following Maven files: - [pom.xml](pom.xml) - [tor-binary-geoip/pom.xml](tor-binary-geoip/pom.xml) diff --git a/tools/verification-selftest.sh b/tools/verification-selftest.sh index a592241..86ce003 100755 --- a/tools/verification-selftest.sh +++ b/tools/verification-selftest.sh @@ -127,7 +127,7 @@ expect_digest_success "manifest with CRLF line endings" "$windows_line_endings" # Tor version rules # --------------------------------------------------------------------------------------- -build_version=" (on Tor 0.4.9.12 78923280eed3eff6)" +build_version=" (on Tor 0.4.9.13 78923280eed3eff6)" tor_executable_of() { case "$1" in @@ -203,14 +203,14 @@ expect_version_failure() { } matching_versions="$(create_version_fixture matching "$build_version")" -expect_version_success "every tor executable reports the declared version" "$matching_versions" 0.4.9.12 +expect_version_success "every tor executable reports the declared version" "$matching_versions" 0.4.9.13 -# Release 0.4.9.13 was published with the executables of Tor Browser 15.0.23, which are tor 0.4.9.12. +# Release 0.4.9.13 was published with the executables of Tor Browser 15.0.23, which are tor 0.4.9.13. expect_version_failure "declared version differs from the reported one" "$matching_versions" 0.4.9.13 \ - "reports tor 0.4.9.12, but the Maven project version declares tor 0.4.9.13" + "reports tor 0.4.9.13, but the Maven project version declares tor 0.4.9.13" expect_version_failure "declared version is the start of the reported one" "$matching_versions" 0.4.9.1 \ - "reports tor 0.4.9.12, but the Maven project version declares tor 0.4.9.1" + "reports tor 0.4.9.13, but the Maven project version declares tor 0.4.9.1" # The six bundle names and executable names are built inside verify-bundle-tor-versions, so # each bundle gets a case of its own. @@ -218,35 +218,35 @@ for platform in "${platforms[@]}"; do single_mismatch="$(create_version_fixture "mismatch-$platform" "$build_version")" write_version_bundle "$single_mismatch" "$platform" "$(tor_executable_of "$platform")" \ " (on Tor 0.4.9.11 f3d28b2e0978ca07)" - expect_version_failure "only the $platform executable reports another version" "$single_mismatch" 0.4.9.12 \ + expect_version_failure "only the $platform executable reports another version" "$single_mismatch" 0.4.9.13 \ "$(tor_executable_of "$platform") in tor-expert-bundle-$platform-$torbrowser_version.tar.gz reports tor 0.4.9.11" done -without_revision="$(create_version_fixture without-revision " (on Tor 0.4.9.12)")" -expect_version_success "build version without a git revision" "$without_revision" 0.4.9.12 +without_revision="$(create_version_fixture without-revision " (on Tor 0.4.9.13)")" +expect_version_success "build version without a git revision" "$without_revision" 0.4.9.13 -suffixed_version="$(create_version_fixture suffixed " (on Tor 0.4.9.12-dev 78923280eed3eff6)")" -expect_version_failure "reported version with a suffix" "$suffixed_version" 0.4.9.12 \ - "reports tor 0.4.9.12-dev, but the Maven project version declares tor 0.4.9.12" +suffixed_version="$(create_version_fixture suffixed " (on Tor 0.4.9.13-dev 78923280eed3eff6)")" +expect_version_failure "reported version with a suffix" "$suffixed_version" 0.4.9.13 \ + "reports tor 0.4.9.13-dev, but the Maven project version declares tor 0.4.9.13" repeated_version="$(create_version_fixture repeated "$build_version" "$build_version")" -expect_version_success "the same build version twice" "$repeated_version" 0.4.9.12 +expect_version_success "the same build version twice" "$repeated_version" 0.4.9.13 two_versions="$(create_version_fixture two-versions "$build_version" " (on Tor 0.4.9.13 0123456789abcdef)")" -expect_version_failure "two different build versions" "$two_versions" 0.4.9.12 \ - "reports more than one tor build version: 0.4.9.12 0.4.9.13" +expect_version_failure "two different build versions" "$two_versions" 0.4.9.13 \ + "reports more than one tor build version: 0.4.9.13 0.4.9.13" no_version="$(create_version_fixture no-version)" -expect_version_failure "no build version string" "$no_version" 0.4.9.12 "reports no tor build version" +expect_version_failure "no build version string" "$no_version" 0.4.9.13 "reports no tor build version" misnamed_executable="$(create_version_fixture misnamed "$build_version")" write_version_bundle "$misnamed_executable" windows-x86_64 tor/tor "$build_version" -expect_version_failure "Windows bundle without tor.exe" "$misnamed_executable" 0.4.9.12 \ +expect_version_failure "Windows bundle without tor.exe" "$misnamed_executable" 0.4.9.13 \ "tor-expert-bundle-windows-x86_64-$torbrowser_version.tar.gz does not contain tor/tor.exe" missing_version_bundle="$(create_version_fixture missing-bundle "$build_version")" rm "$missing_version_bundle/bundles/tor-expert-bundle-linux-i686-$torbrowser_version.tar.gz" -expect_version_failure "bundle file missing from the download directory" "$missing_version_bundle" 0.4.9.12 \ +expect_version_failure "bundle file missing from the download directory" "$missing_version_bundle" 0.4.9.13 \ "Could not find" # --------------------------------------------------------------------------------------- diff --git a/tor-binary-geoip/pom.xml b/tor-binary-geoip/pom.xml index 2944e55..5827e2e 100644 --- a/tor-binary-geoip/pom.xml +++ b/tor-binary-geoip/pom.xml @@ -6,7 +6,7 @@ com.github.bisq-network.tor-binary tor-binary - 0.4.9.12 + 0.4.9.13 4.0.0 diff --git a/tor-binary-linux32/pom.xml b/tor-binary-linux32/pom.xml index 7175c82..d35cb1f 100644 --- a/tor-binary-linux32/pom.xml +++ b/tor-binary-linux32/pom.xml @@ -6,7 +6,7 @@ com.github.bisq-network.tor-binary tor-binary - 0.4.9.12 + 0.4.9.13 4.0.0 diff --git a/tor-binary-linux64/pom.xml b/tor-binary-linux64/pom.xml index a03ae3e..9a7fba5 100644 --- a/tor-binary-linux64/pom.xml +++ b/tor-binary-linux64/pom.xml @@ -6,7 +6,7 @@ com.github.bisq-network.tor-binary tor-binary - 0.4.9.12 + 0.4.9.13 4.0.0 diff --git a/tor-binary-macos-aarch64/pom.xml b/tor-binary-macos-aarch64/pom.xml index 63239be..af186b7 100644 --- a/tor-binary-macos-aarch64/pom.xml +++ b/tor-binary-macos-aarch64/pom.xml @@ -6,7 +6,7 @@ com.github.bisq-network.tor-binary tor-binary - 0.4.9.12 + 0.4.9.13 4.0.0 diff --git a/tor-binary-macos/pom.xml b/tor-binary-macos/pom.xml index 3414a67..ad04071 100644 --- a/tor-binary-macos/pom.xml +++ b/tor-binary-macos/pom.xml @@ -6,7 +6,7 @@ com.github.bisq-network.tor-binary tor-binary - 0.4.9.12 + 0.4.9.13 4.0.0 diff --git a/tor-binary-resources/pom.xml b/tor-binary-resources/pom.xml index 8e5e066..adc5bc9 100644 --- a/tor-binary-resources/pom.xml +++ b/tor-binary-resources/pom.xml @@ -6,7 +6,7 @@ com.github.bisq-network.tor-binary tor-binary - 0.4.9.12 + 0.4.9.13 4.0.0 diff --git a/tor-binary-windows/pom.xml b/tor-binary-windows/pom.xml index b06f021..dc51b3d 100644 --- a/tor-binary-windows/pom.xml +++ b/tor-binary-windows/pom.xml @@ -6,7 +6,7 @@ com.github.bisq-network.tor-binary tor-binary - 0.4.9.12 + 0.4.9.13 4.0.0 diff --git a/tor-binary-windows64/pom.xml b/tor-binary-windows64/pom.xml index c348bc1..81ab702 100644 --- a/tor-binary-windows64/pom.xml +++ b/tor-binary-windows64/pom.xml @@ -6,7 +6,7 @@ com.github.bisq-network.tor-binary tor-binary - 0.4.9.12 + 0.4.9.13 4.0.0