Skip to content

Add missing replacement of 0.4.9.12 with 0.4.9.13 #23

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
HenrikJannsen merged 1 commit into from
Sep 30, 2026
Merged

Add missing replacement of 0.4.9.12 with 0.4.9.13 #23

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
8 changes: 4 additions & 4 deletions docs/specifications/build/artifact-verification.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -129,14 +129,14 @@ example to decide whether a tor security release has reached them.
must report exactly one tor build version, and that version must equal the Maven project version.
- Packaging must fail when the executable is missing from the bundle, reports no build version, reports
more than one distinct build version, or reports a different version. A version with a suffix, for
example `0.4.9.12-dev`, is a different version.
example `0.4.9.13-dev`, is a different version.

The expert bundles are published under the Tor Browser version. Which tor version a Tor Browser release
contains is looked up by hand when the Maven project version is set. The signature and digest checks
establish that a bundle is genuine and belongs to the configured Tor Browser release. They do not
establish which tor version it contains. Release 0.4.9.13 was published with the bundles of Tor Browser
15.0.23, which contain tor 0.4.9.12. A consumer that upgraded because of the tor 0.4.9.13 security
release kept running tor 0.4.9.12.
15.0.23, which contain tor 0.4.9.13. A consumer that upgraded because of the tor 0.4.9.13 security
release kept running tor 0.4.9.13.

### How the version is established

Expand All @@ -148,7 +148,7 @@ closing parenthesis. The version must be read from this string only:
- The executable also contains unrelated versions, such as `0.4.9.1-alpha` or `Tor 0.1.2.17 and later`.
A search for any version finds them.
- A search for the declared version also accepts a longer version that starts with it: `0.4.9.1` is the
start of `0.4.9.12`.
start of `0.4.9.13`.

The version is read from the file, not by running the executable. The build runs on one host but
checks the executables of six platforms.
Expand Down
2 changes: 1 addition & 1 deletion pom.xml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -5,7 +5,7 @@

<groupId>com.github.bisq-network.tor-binary</groupId>
<artifactId>tor-binary</artifactId>
<version>0.4.9.12</version>
<version>0.4.9.13</version>

<modelVersion>4.0.0</modelVersion>
<packaging>pom</packaging>
Expand Down
2 changes: 1 addition & 1 deletion readme.MD
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -14,7 +14,7 @@ Package native Tor files from [Tor Browser project](https://www.torproject.org/)
1. Replace `torbrowser.version` with the target Tor Browser bundle version in the root [Maven file](pom.xml)
2. Find out which `tor binary version` is used in that Tor Browser release. Use that as the Maven project version.
The [download page](https://www.torproject.org/download/tor/) lists it next to each release, for example
`15.0.23 (tor 0.4.9.12)`. The build fails when the tor executable in any bundle reports another version.
`15.0.23 (tor 0.4.9.13)`. The build fails when the tor executable in any bundle reports another version.
3. Set the `tor-binary version` in the following Maven files:
- [pom.xml](pom.xml)
- [tor-binary-geoip/pom.xml](tor-binary-geoip/pom.xml)
Expand Down
34 changes: 17 additions & 17 deletions tools/verification-selftest.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -127,7 +127,7 @@ expect_digest_success "manifest with CRLF line endings" "$windows_line_endings"
# Tor version rules
# ---------------------------------------------------------------------------------------

build_version=" (on Tor 0.4.9.12 78923280eed3eff6)"
build_version=" (on Tor 0.4.9.13 78923280eed3eff6)"

tor_executable_of() {
case "$1" in
Expand Down Expand Up @@ -203,50 +203,50 @@ expect_version_failure() {
}

matching_versions="$(create_version_fixture matching "$build_version")"
expect_version_success "every tor executable reports the declared version" "$matching_versions" 0.4.9.12
expect_version_success "every tor executable reports the declared version" "$matching_versions" 0.4.9.13

# Release 0.4.9.13 was published with the executables of Tor Browser 15.0.23, which are tor 0.4.9.12.
# Release 0.4.9.13 was published with the executables of Tor Browser 15.0.23, which are tor 0.4.9.13.
expect_version_failure "declared version differs from the reported one" "$matching_versions" 0.4.9.13 \
"reports tor 0.4.9.12, but the Maven project version declares tor 0.4.9.13"
"reports tor 0.4.9.13, but the Maven project version declares tor 0.4.9.13"

expect_version_failure "declared version is the start of the reported one" "$matching_versions" 0.4.9.1 \
"reports tor 0.4.9.12, but the Maven project version declares tor 0.4.9.1"
"reports tor 0.4.9.13, but the Maven project version declares tor 0.4.9.1"

# The six bundle names and executable names are built inside verify-bundle-tor-versions, so
# each bundle gets a case of its own.
for platform in "${platforms[@]}"; do
single_mismatch="$(create_version_fixture "mismatch-$platform" "$build_version")"
write_version_bundle "$single_mismatch" "$platform" "$(tor_executable_of "$platform")" \
" (on Tor 0.4.9.11 f3d28b2e0978ca07)"
expect_version_failure "only the $platform executable reports another version" "$single_mismatch" 0.4.9.12 \
expect_version_failure "only the $platform executable reports another version" "$single_mismatch" 0.4.9.13 \
"$(tor_executable_of "$platform") in tor-expert-bundle-$platform-$torbrowser_version.tar.gz reports tor 0.4.9.11"
done

without_revision="$(create_version_fixture without-revision " (on Tor 0.4.9.12)")"
expect_version_success "build version without a git revision" "$without_revision" 0.4.9.12
without_revision="$(create_version_fixture without-revision " (on Tor 0.4.9.13)")"
expect_version_success "build version without a git revision" "$without_revision" 0.4.9.13

suffixed_version="$(create_version_fixture suffixed " (on Tor 0.4.9.12-dev 78923280eed3eff6)")"
expect_version_failure "reported version with a suffix" "$suffixed_version" 0.4.9.12 \
"reports tor 0.4.9.12-dev, but the Maven project version declares tor 0.4.9.12"
suffixed_version="$(create_version_fixture suffixed " (on Tor 0.4.9.13-dev 78923280eed3eff6)")"
expect_version_failure "reported version with a suffix" "$suffixed_version" 0.4.9.13 \
"reports tor 0.4.9.13-dev, but the Maven project version declares tor 0.4.9.13"

repeated_version="$(create_version_fixture repeated "$build_version" "$build_version")"
expect_version_success "the same build version twice" "$repeated_version" 0.4.9.12
expect_version_success "the same build version twice" "$repeated_version" 0.4.9.13

two_versions="$(create_version_fixture two-versions "$build_version" " (on Tor 0.4.9.13 0123456789abcdef)")"
expect_version_failure "two different build versions" "$two_versions" 0.4.9.12 \
"reports more than one tor build version: 0.4.9.12 0.4.9.13"
expect_version_failure "two different build versions" "$two_versions" 0.4.9.13 \
"reports more than one tor build version: 0.4.9.13 0.4.9.13"

no_version="$(create_version_fixture no-version)"
expect_version_failure "no build version string" "$no_version" 0.4.9.12 "reports no tor build version"
expect_version_failure "no build version string" "$no_version" 0.4.9.13 "reports no tor build version"

misnamed_executable="$(create_version_fixture misnamed "$build_version")"
write_version_bundle "$misnamed_executable" windows-x86_64 tor/tor "$build_version"
expect_version_failure "Windows bundle without tor.exe" "$misnamed_executable" 0.4.9.12 \
expect_version_failure "Windows bundle without tor.exe" "$misnamed_executable" 0.4.9.13 \
"tor-expert-bundle-windows-x86_64-$torbrowser_version.tar.gz does not contain tor/tor.exe"

missing_version_bundle="$(create_version_fixture missing-bundle "$build_version")"
rm "$missing_version_bundle/bundles/tor-expert-bundle-linux-i686-$torbrowser_version.tar.gz"
expect_version_failure "bundle file missing from the download directory" "$missing_version_bundle" 0.4.9.12 \
expect_version_failure "bundle file missing from the download directory" "$missing_version_bundle" 0.4.9.13 \
"Could not find"

# ---------------------------------------------------------------------------------------
Expand Down
2 changes: 1 addition & 1 deletion tor-binary-geoip/pom.xml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -6,7 +6,7 @@
<parent>
<groupId>com.github.bisq-network.tor-binary</groupId>
<artifactId>tor-binary</artifactId>
<version>0.4.9.12</version>
<version>0.4.9.13</version>
</parent>

<modelVersion>4.0.0</modelVersion>
Expand Down
2 changes: 1 addition & 1 deletion tor-binary-linux32/pom.xml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -6,7 +6,7 @@
<parent>
<groupId>com.github.bisq-network.tor-binary</groupId>
<artifactId>tor-binary</artifactId>
<version>0.4.9.12</version>
<version>0.4.9.13</version>
</parent>

<modelVersion>4.0.0</modelVersion>
Expand Down
2 changes: 1 addition & 1 deletion tor-binary-linux64/pom.xml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -6,7 +6,7 @@
<parent>
<groupId>com.github.bisq-network.tor-binary</groupId>
<artifactId>tor-binary</artifactId>
<version>0.4.9.12</version>
<version>0.4.9.13</version>
</parent>

<modelVersion>4.0.0</modelVersion>
Expand Down
2 changes: 1 addition & 1 deletion tor-binary-macos-aarch64/pom.xml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -6,7 +6,7 @@
<parent>
<groupId>com.github.bisq-network.tor-binary</groupId>
<artifactId>tor-binary</artifactId>
<version>0.4.9.12</version>
<version>0.4.9.13</version>
</parent>

<modelVersion>4.0.0</modelVersion>
Expand Down
2 changes: 1 addition & 1 deletion tor-binary-macos/pom.xml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -6,7 +6,7 @@
<parent>
<groupId>com.github.bisq-network.tor-binary</groupId>
<artifactId>tor-binary</artifactId>
<version>0.4.9.12</version>
<version>0.4.9.13</version>
</parent>

<modelVersion>4.0.0</modelVersion>
Expand Down
2 changes: 1 addition & 1 deletion tor-binary-resources/pom.xml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -6,7 +6,7 @@
<parent>
<groupId>com.github.bisq-network.tor-binary</groupId>
<artifactId>tor-binary</artifactId>
<version>0.4.9.12</version>
<version>0.4.9.13</version>
</parent>

<modelVersion>4.0.0</modelVersion>
Expand Down
2 changes: 1 addition & 1 deletion tor-binary-windows/pom.xml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -6,7 +6,7 @@
<parent>
<groupId>com.github.bisq-network.tor-binary</groupId>
<artifactId>tor-binary</artifactId>
<version>0.4.9.12</version>
<version>0.4.9.13</version>
</parent>

<modelVersion>4.0.0</modelVersion>
Expand Down
2 changes: 1 addition & 1 deletion tor-binary-windows64/pom.xml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -6,7 +6,7 @@
<parent>
<groupId>com.github.bisq-network.tor-binary</groupId>
<artifactId>tor-binary</artifactId>
<version>0.4.9.12</version>
<version>0.4.9.13</version>
</parent>

<modelVersion>4.0.0</modelVersion>
Expand Down
Loading