From 34ea29b8861b58dfd7487e9684bae4e67e8653c6 Mon Sep 17 00:00:00 2001 From: HenrikJannsen Date: Fri, 16 Oct 2026 09:08:29 +0700 Subject: [PATCH 1/4] Update tor binary to v0.4.9.14 Update tor browser (expert bundle) to 15.0.25 Update checksums --- pom.xml | 4 +- readme.MD | 4 +- tools/verification-selftest.sh | 2 +- tor-binary-geoip/pom.xml | 2 +- tor-binary-linux32/pom.xml | 2 +- tor-binary-linux64/pom.xml | 2 +- tor-binary-macos-aarch64/pom.xml | 2 +- tor-binary-macos/pom.xml | 2 +- .../checksums/sha256sums-signed-build.txt | 104 +++++++++--------- .../checksums/sha256sums-signed-build.txt.asc | 26 ++--- tor-binary-resources/pom.xml | 2 +- tor-binary-windows/pom.xml | 2 +- tor-binary-windows64/pom.xml | 2 +- 13 files changed, 78 insertions(+), 78 deletions(-) diff --git a/pom.xml b/pom.xml index d22e972..f1dcc84 100644 --- a/pom.xml +++ b/pom.xml @@ -5,7 +5,7 @@ com.github.bisq-network.tor-binary tor-binary - 0.4.9.13 + 0.4.9.14 4.0.0 pom @@ -17,7 +17,7 @@ - gpg in path for PGP signature verification - tar with gzip/xz support in path --> - 15.0.24 + 15.0.25 https://archive.torproject.org/tor-package-archive/torbrowser/${torbrowser.version} ${torbrowser.download.base.url}/sha256sums-signed-build.txt hkps://keys.openpgp.org diff --git a/readme.MD b/readme.MD index 72959e6..ac62783 100644 --- a/readme.MD +++ b/readme.MD @@ -14,7 +14,7 @@ Package native Tor files from [Tor Browser project](https://www.torproject.org/) 1. Replace `torbrowser.version` with the target Tor Browser bundle version in the root [Maven file](pom.xml) 2. Find out which `tor binary version` is used in that Tor Browser release. Use that as the Maven project version. The [download page](https://www.torproject.org/download/tor/) lists it next to each release, for example - `15.0.23 (tor 0.4.9.13)`. The build fails when the tor executable in any bundle reports another version. + `15.0.25 (tor 0.4.9.14)`. The build fails when the tor executable in any bundle reports another version. 3. Set the `tor-binary version` in the following Maven files: - [pom.xml](pom.xml) - [tor-binary-geoip/pom.xml](tor-binary-geoip/pom.xml) @@ -29,7 +29,7 @@ Package native Tor files from [Tor Browser project](https://www.torproject.org/) version under `torbrowser.checksum.source.url`: ``` curl --fail --remote-name-all \ - https://archive.torproject.org/tor-package-archive/torbrowser/15.0.24/{sha256sums-signed-build.txt,sha256sums-signed-build.txt.asc} + https://archive.torproject.org/tor-package-archive/torbrowser/15.0.25/{sha256sums-signed-build.txt,sha256sums-signed-build.txt.asc} mv sha256sums-signed-build.txt sha256sums-signed-build.txt.asc tor-binary-resources/checksums/ ``` Store the manifest exactly as published, with all its entries and without adding anything. It has to stay diff --git a/tools/verification-selftest.sh b/tools/verification-selftest.sh index d7513ed..6db9e19 100755 --- a/tools/verification-selftest.sh +++ b/tools/verification-selftest.sh @@ -14,7 +14,7 @@ set -o nounset project_root="$(cd "$(dirname "$0")/.." && pwd)" ant_command="${ANT:-ant}" -torbrowser_version="15.0.24" +torbrowser_version="15.0.25" tor_fingerprint="EF6E286DDA85EA2A4BA7DE684E2C6E8793298290" platforms=(windows-i686 windows-x86_64 macos-x86_64 macos-aarch64 linux-i686 linux-x86_64) diff --git a/tor-binary-geoip/pom.xml b/tor-binary-geoip/pom.xml index 5827e2e..316d3cd 100644 --- a/tor-binary-geoip/pom.xml +++ b/tor-binary-geoip/pom.xml @@ -6,7 +6,7 @@ com.github.bisq-network.tor-binary tor-binary - 0.4.9.13 + 0.4.9.14 4.0.0 diff --git a/tor-binary-linux32/pom.xml b/tor-binary-linux32/pom.xml index d35cb1f..21556fd 100644 --- a/tor-binary-linux32/pom.xml +++ b/tor-binary-linux32/pom.xml @@ -6,7 +6,7 @@ com.github.bisq-network.tor-binary tor-binary - 0.4.9.13 + 0.4.9.14 4.0.0 diff --git a/tor-binary-linux64/pom.xml b/tor-binary-linux64/pom.xml index 9a7fba5..b303b35 100644 --- a/tor-binary-linux64/pom.xml +++ b/tor-binary-linux64/pom.xml @@ -6,7 +6,7 @@ com.github.bisq-network.tor-binary tor-binary - 0.4.9.13 + 0.4.9.14 4.0.0 diff --git a/tor-binary-macos-aarch64/pom.xml b/tor-binary-macos-aarch64/pom.xml index af186b7..90577de 100644 --- a/tor-binary-macos-aarch64/pom.xml +++ b/tor-binary-macos-aarch64/pom.xml @@ -6,7 +6,7 @@ com.github.bisq-network.tor-binary tor-binary - 0.4.9.13 + 0.4.9.14 4.0.0 diff --git a/tor-binary-macos/pom.xml b/tor-binary-macos/pom.xml index ad04071..b7cd340 100644 --- a/tor-binary-macos/pom.xml +++ b/tor-binary-macos/pom.xml @@ -6,7 +6,7 @@ com.github.bisq-network.tor-binary tor-binary - 0.4.9.13 + 0.4.9.14 4.0.0 diff --git a/tor-binary-resources/checksums/sha256sums-signed-build.txt b/tor-binary-resources/checksums/sha256sums-signed-build.txt index 234b9ae..1a5a955 100644 --- a/tor-binary-resources/checksums/sha256sums-signed-build.txt +++ b/tor-binary-resources/checksums/sha256sums-signed-build.txt @@ -1,52 +1,52 @@ -638ecea8b739ba30f6ff201d8b22f8511da9cee0938a2dc5584385c965af5ebc geckodriver-linux-x86_64-15.0.24.tar.xz -d87d0732ecdca4409c0d71d6cd420399a860d0cd0981aa5866e4f2c2f1f9bc04 mar-tools-linux-i686-15.0.24.zip -6b1e9202a6280417fe92f1ce0a19b19884744df373c19460c72d23c73beabd19 mar-tools-linux-x86_64-15.0.24.zip -9374665bd1ec1510969343b55b665951505c958cf08e7a7058093aad1bba0012 mar-tools-macos-x86_64-15.0.24.zip -f0028fa1ca350a0e01162a8080cd62d4ab33f48b3c3ca1f6d2daaedfb5e4d93f mar-tools-windows-i686-15.0.24.zip -ebe9359cfb930306d3f8b1669e175eb68397d62f52a26d5f8f1a3a986868f713 mar-tools-windows-x86_64-15.0.24.zip -c217a69a1c929a81d5217247eb10dc5306176d94b2ab7918ddd9e4c5a28e169f src-firefox-tor-browser-140.17.0esr-15.0-1-build4.tar.xz -4ab64993293d1643b9b746f17f222478217c486226006e40711ce44e1e4d14d2 tor-browser-15.0.24-androidTest.apk.idsig -4b8d51527ab516c5e8ecf7ea25dabbcb0e4bdfb54d55eadb12ad09a36f227cda tor-browser-android-aarch64-15.0.24.apk -8489b7dce1273ab270bf1b0f77841efa26ce315f2e3782105c9f595e86a766f0 tor-browser-android-armv7-15.0.24.apk -7f887e778a9728dd57bfcfc083f131cd9c8f7318801bf40c8eb47beb775c8dc5 tor-browser-android-x86-15.0.24.apk -2d92439e67e8e8cbc59a8821ecbef8dacd11fd64b0f305827a3023764da75b39 tor-browser-android-x86_64-15.0.24.apk -777cb5db37107fa905beccbb07e39bb7df21e94e510342f7ac1472f29b29fec2 tor-browser-debug-symbols-linux-i686-15.0.24.tar.xz -41a0cd04f7a9e181310e81c9fdae7e8461e3f266df77ea88b9b9fb608211f286 tor-browser-debug-symbols-linux-x86_64-15.0.24.tar.xz -dd58a73a896864c48df06c65fb5a5134fd2936195bec75639e60f933d04f44c2 tor-browser-debug-symbols-windows-i686-15.0.24.zip -6aa71a8e32d022e5a09a06142fd5927fcbc83edbefb719b1878b6d004d2f3d0d tor-browser-debug-symbols-windows-x86_64-15.0.24.zip -7cf860b0f9f0bca3528b266899e8fd0de8b0586f06ad4f57ce325b165eedd197 tor-browser-linux-i686-15.0.24.mar -0eeb32d6b546713df5684ab87e2f9844c9c0af72a6c3962421a6dbd9b0b7c084 tor-browser-linux-i686-15.0.24.tar.xz -0353f8d97c9315e3d1d6ec2158ef76e1c872cc7331fb53281c30450697003b24 tor-browser-linux-x86_64-15.0.24.mar -b03eefb6ebe2acb53a1d64f82c95c0df0ced9c0f9d626586e8c6c81d9805d604 tor-browser-linux-x86_64-15.0.24.tar.xz -169e30fe19d1cba2582cb29b75df9e76d908f0a5bb84f9e3bfe73c64046910d3 tor-browser-macos-15.0.24.dmg -a67c0f80a7a18dd7d55d22954d6c2bfbbc0f046afeb0cb7bc098bc5c1a0cecf8 tor-browser-macos-15.0.24.mar -bdafb39d73ec9e007cc5eee0a3ec05fcdbb36cd357088f8f955f6492d7b1b063 tor-browser-noopt-android-aarch64-15.0.24.apk.idsig -6497fcc813aceb9d516c599bd954ffd9e5576d4363f24b072fe6b849dc0317eb tor-browser-noopt-android-armv7-15.0.24.apk.idsig -67bfb895f50ce53a0d717f1b9ebccf06a1dc5c2934b0626d44349faee4d52dbe tor-browser-noopt-android-x86-15.0.24.apk.idsig -736b9e97ba62a6240fa7e2d8cae86f302bc80179bbb516e71a5ded7e51dc4ff3 tor-browser-noopt-android-x86_64-15.0.24.apk.idsig -60af3e642e6e57ff82da916f7c88efbcb50c0989ec0267a19689cad2cbc4f937 tor-browser-qa-android-aarch64-15.0.24.apk -19cdefce81da4f9cc7be8bd3faea5f67556efc1dfe7b7639e57c489fd4954736 tor-browser-qa-android-aarch64-15.0.24.apk.idsig -e347d9c8173f4976a7110665038b701f2fe8f8dd2a35d5a544269763d7d377dd tor-browser-qa-android-armv7-15.0.24.apk -789dd69f1ce9719a78d567c7a4b3667a01cca587ad331139b09ec55e9b55900c tor-browser-qa-android-armv7-15.0.24.apk.idsig -bb3961f64a3e7b960a3f728e143a702e0b727ecf76ec19340b4337bfc1c45cf1 tor-browser-qa-android-x86-15.0.24.apk -d7f911b12dcf37927869fbb478740d89df46dcacfa120122a07eb6d2e60261d5 tor-browser-qa-android-x86-15.0.24.apk.idsig -b9d9e4d55340b24c66897394e095f9c40ae52330eceb2ac7b13de023dc8b5027 tor-browser-qa-android-x86_64-15.0.24.apk -e3be44cb1b75f461f06f443e011786067edf57df70d05ec2465573fbe2be04e2 tor-browser-qa-android-x86_64-15.0.24.apk.idsig -44a4d69040d045213e691919a5f0fc9e6da63144fd9033f2f0c7316c4bc10613 tor-browser-qa-unsign-android-aarch64-15.0.24.bspatch -a404ab61f6445e5750474e093a053ea296f4906651646c3049872c741d0ef175 tor-browser-qa-unsign-android-armv7-15.0.24.bspatch -f61a44c9da0ea4b524d4d6aafb572f848880c5646a5921f2a1b3c6bb39852e6a tor-browser-qa-unsign-android-x86-15.0.24.bspatch -af97aab95854ee66c16d1a91dc1020ad7c4a5ecf0196a4849d40f7ade19efead tor-browser-qa-unsign-android-x86_64-15.0.24.bspatch -34c73ac0f4f5320d6e1d6d75b7991fd6769f5037d707a07ab8df07fe10cf3604 tor-browser-windows-i686-15.0.24.mar -d30acc71e3413a58b6f405421e72cf222e6633576ffa9e95750f3f56821668b8 tor-browser-windows-i686-portable-15.0.24.exe -75b603ec80e4c1d2c3b286469534de40a2f37792685b180260ab5d4725b9f52c tor-browser-windows-x86_64-15.0.24.mar -a549824c31dd9ee8143ecc6bc97b8f2d5fd5cba8b13f528f1444a0b769758c6c tor-browser-windows-x86_64-portable-15.0.24.exe -2a7a02484149b05f64b582a4a1e8eb8aabb9f6cd32daca4e03c58e09839bb7a8 tor-expert-bundle-android-aarch64-15.0.24.tar.gz -9416f72b9cd31eda0f7f5a1fa3e2eec789b88b8160e20f5d690bc4ba8c29811e tor-expert-bundle-android-armv7-15.0.24.tar.gz -32532b4250d5823f07ac2d88197908c1d11ffa015354144d295ee64302107917 tor-expert-bundle-android-x86-15.0.24.tar.gz -500d51006f1938dfd5ecd0653b0d2a156feff8a4dc5e2b61b81793d47854fc90 tor-expert-bundle-android-x86_64-15.0.24.tar.gz -7537fea3478d05b8af25d7f8199c031b281f7015c32bb4177bef71f8e5100d9b tor-expert-bundle-linux-i686-15.0.24.tar.gz -8e012ec6815d7899cb64011582e2dade88e74119c6661068a2a3252de0ccd7f2 tor-expert-bundle-linux-x86_64-15.0.24.tar.gz -d47afd04b6c751129978390ad003d74ac8b88adfbb939350f0f89999e6570644 tor-expert-bundle-macos-aarch64-15.0.24.tar.gz -8acb0b590f6be34084dcb6d84009ac0c61cc7c5261b7a19d2ab94845aa9bd5b6 tor-expert-bundle-macos-x86_64-15.0.24.tar.gz -7c2755b09876ebc6c2e2d2d1d3279b2be3e9beec35ff0ca2e7df4c1abcad1ae4 tor-expert-bundle-windows-i686-15.0.24.tar.gz -e9dc6ccc93cd6afa507193f4de284d6424233ff5102155cd2c94b259e8a22b65 tor-expert-bundle-windows-x86_64-15.0.24.tar.gz +287564b5ccd04cdc97008f306698ae5fb5993d31509551b15fdf98acb834215a geckodriver-linux-x86_64-15.0.25.tar.xz +cf3de4d2b92647a275eab98c8a7fedc6d3cb8718ae1731233735dc0ea047a4df mar-tools-linux-i686-15.0.25.zip +0cba376512d0058896ed38689b00c3850dcdbe2733b0504812ccec6bad0665be mar-tools-linux-x86_64-15.0.25.zip +f14809540a47091a78fca5927cd7aabe9067996c129ee27a132799b70c67779b mar-tools-macos-x86_64-15.0.25.zip +7b58178df7875b07c4bf444382da5d326bdb2df4be5f8e536b59c1a8ec7f8ce4 mar-tools-windows-i686-15.0.25.zip +2360427b37b31c13cfa37da133447b0eb82ad57a50c051cbd273c35fe1fed667 mar-tools-windows-x86_64-15.0.25.zip +1b18e242d83a7e409b1b8b3b12cb06392e83389d6a9e4d3432bb23c1fe557179 src-firefox-tor-browser-140.17.0esr-15.0-1-build6.tar.xz +59bea60ce9279df1b42c6b06b24e4e16d9d362e350479958e832beb38d088b59 tor-browser-15.0.25-androidTest.apk.idsig +43b13364a9adc9b139f7c44279e552b7fdea07aef09a553310c7a8e5743c28b8 tor-browser-android-aarch64-15.0.25.apk +d917d2c13f4580c225eeced9c22bfcd2b7aa8290992615ee42c3be50624a8aef tor-browser-android-armv7-15.0.25.apk +076563cdcb41f19414be0ae2e1854ebf2992fcb4004c4e4926e4faac0cac5e4f tor-browser-android-x86-15.0.25.apk +9f7934ea3a4e68a6e405f04febcd55e6a5a87d112b221b9aac89c6d1bc77597e tor-browser-android-x86_64-15.0.25.apk +08e3f00ba4449152f30c5fe6dcf82356fd749473d9b1507138f5fcb0b6ee75ea tor-browser-debug-symbols-linux-i686-15.0.25.tar.xz +f1dd6d4989b6f359f595c4eb1e3233c53d965922e17a97ceeaa95c57e1833362 tor-browser-debug-symbols-linux-x86_64-15.0.25.tar.xz +e9aed58d08868689911edb4b296092a2c9ae67f79b40e9ba6f4408655760dd5e tor-browser-debug-symbols-windows-i686-15.0.25.zip +8bc13a3547c704f8858fd2c2d88de0ddd18b569f6bdf38fce915229b91336fb3 tor-browser-debug-symbols-windows-x86_64-15.0.25.zip +485f166e4281bf3dbfd7d41d33b1db8b758be5e0a5626c87253fcab04d809a13 tor-browser-linux-i686-15.0.25.mar +2c836601e0f49b21b9aace8c9df613cd1de01468c0f02c67d62e1bdea6a676a9 tor-browser-linux-i686-15.0.25.tar.xz +be033a580e91ad1a63a0a94ebfc73d6578ba7f30af0c313a2a17b8bbf81fcece tor-browser-linux-x86_64-15.0.25.mar +37432d6f4d9b1f1190ba2cfbbd4ab9dad5ccd52c14aa47a21795d08273f4a165 tor-browser-linux-x86_64-15.0.25.tar.xz +4771ad39f84323e60c1966b270a743c9a23f437569aca36dbb93988919c1a7ae tor-browser-macos-15.0.25.dmg +e5ae9c30b5ea8a25b00e4396d2d87829d758eb835aeebb442f683ebb7ab743fe tor-browser-macos-15.0.25.mar +5fd3dd957fc06bc18f6af2e4473632ca279b35f28809f33c04a8031ebfbb7657 tor-browser-noopt-android-aarch64-15.0.25.apk.idsig +cafcfd56952ddd29021ac23ba020be272dc0254402bfcf75e2effbaa513171aa tor-browser-noopt-android-armv7-15.0.25.apk.idsig +310f01666e5973f54324e936780874fb6ded399a7125073d358136c3212a2b53 tor-browser-noopt-android-x86-15.0.25.apk.idsig +f50ed879a6ab98eea337772cce3f513f74b7ef09dad01095604ec5bd3e29cc14 tor-browser-noopt-android-x86_64-15.0.25.apk.idsig +b81e1c95c631de4499caa4fb66abb3c94b8b15e48b1f49e45b268f7c2f2aa9d3 tor-browser-qa-android-aarch64-15.0.25.apk +89fd20fd094f66d46214bc478d25f46d54c20d47bfb373632e6a071d3e9b1578 tor-browser-qa-android-aarch64-15.0.25.apk.idsig +b8f1eea8447344128213c741dc131d73a31107b42e3cd060908db205b93cf635 tor-browser-qa-android-armv7-15.0.25.apk +d61be41f6718dae5223368378d7dc3f829cdb05fb697938b4be7d87ef2438995 tor-browser-qa-android-armv7-15.0.25.apk.idsig +ce679075e3e6b0c38ac74a16ec862be57180eb6105c769e0768f526fc0e5a0d2 tor-browser-qa-android-x86-15.0.25.apk +d66278ef38b03eb7d723a266bf9a4f11f137c6b5cdf158599083cad494848add tor-browser-qa-android-x86-15.0.25.apk.idsig +a3401bf36c4328cf0776f66c51d31c715a7df46cff0bde2968405ca2da3f633e tor-browser-qa-android-x86_64-15.0.25.apk +bc9193816b83315064037141581b09fbf7dd6eca3e82a2c2453c10668ff78416 tor-browser-qa-android-x86_64-15.0.25.apk.idsig +1d796f8fea916934dcaa2d1ce437ebbf4c1959ab558f5cb86ddbc83cd131984a tor-browser-qa-unsign-android-aarch64-15.0.25.bspatch +b01b122bb3ce7bc0cb5e441c6f88b6e39ee0f570546d59cb68f1b5a2a56627fa tor-browser-qa-unsign-android-armv7-15.0.25.bspatch +11449c441c33126341e09cb073b99cce23e1b4c3b807ac941b10aa289470174c tor-browser-qa-unsign-android-x86-15.0.25.bspatch +98b00ec31b2773bc569face8244832844b42a9fc8ad9697d3f4dc235ba8f7e6b tor-browser-qa-unsign-android-x86_64-15.0.25.bspatch +a3416f968a535901285ba2613537b6a0b8767c7afe6aa0278c1f7b3b334d7a78 tor-browser-windows-i686-15.0.25.mar +06ebb5051cd074e0cab2c1cdfad453a2212c8be286a70a7030744550b11c8863 tor-browser-windows-i686-portable-15.0.25.exe +b2f21c538ad2f83117460438d56f1a7620db99fd5fedf5f16c8d55a78ea5e9a4 tor-browser-windows-x86_64-15.0.25.mar +948f79f7312c7b62dffeb1d65a51d49ea6bcb22b47b271fdd2edee9d5e22d561 tor-browser-windows-x86_64-portable-15.0.25.exe +a1a67ec77ce0a7c4fca446fd9f915fbb0302c3107c2d56ab213196187cfd894a tor-expert-bundle-android-aarch64-15.0.25.tar.gz +4fcdb5540f7ea2f529b9063115d66dd7dfa61e5602bfaab96a78e8046bb4b8d5 tor-expert-bundle-android-armv7-15.0.25.tar.gz +a76c881f1b7feb10994cacb4d0bc0b1ba388a25463b4f25985b7805af2091bbb tor-expert-bundle-android-x86-15.0.25.tar.gz +11dbac44e2ee29df2cd6e3a5f38164d2630b2c85342f6a041b9cb57d7012d071 tor-expert-bundle-android-x86_64-15.0.25.tar.gz +e3195aa30946de60b1a31ef584f2e8bc2623a99815f4a102a89257a01bef9a77 tor-expert-bundle-linux-i686-15.0.25.tar.gz +19cf18726eecb362e0f21d27afa9ea9efe5da928bfdfbb1ceb5fe54519e87f4a tor-expert-bundle-linux-x86_64-15.0.25.tar.gz +a3febb6179152b0b4f56a0f5cc57bf5cc8ecef7db35e7c3e9d5a044c8158c26c tor-expert-bundle-macos-aarch64-15.0.25.tar.gz +e1ae4d4a734d28bb590839188511deb3cebc26fcbce9df66d01b2c452060fe95 tor-expert-bundle-macos-x86_64-15.0.25.tar.gz +55a1e4c9b6df47c6e5fde1b3d755c858374d6cc0809c1dd1533a8622bb52de96 tor-expert-bundle-windows-i686-15.0.25.tar.gz +c1988c701de2f24f7d098d1d6d7f507b58f27740d097f29c246e0524d639b252 tor-expert-bundle-windows-x86_64-15.0.25.tar.gz diff --git a/tor-binary-resources/checksums/sha256sums-signed-build.txt.asc b/tor-binary-resources/checksums/sha256sums-signed-build.txt.asc index 4f8d9a8..445a5a7 100644 --- a/tor-binary-resources/checksums/sha256sums-signed-build.txt.asc +++ b/tor-binary-resources/checksums/sha256sums-signed-build.txt.asc @@ -1,16 +1,16 @@ -----BEGIN PGP SIGNATURE----- -iQIzBAABCgAdFiEEAi2iSEMtKg4PVOZeMWwfrNYtB9kFAmq7t9cACgkQMWwfrNYt -B9lEug//dAADL6K81gCIn03b8/Cq/5dNCn1K6CsgikS3kqLca1WUtfDdYVHn3Pa3 -mk3jL7YkPNSddvgrsX05CU+7Vl2mNEUX/ElJEUau6+0IhdpWKC79IlSj6JQKvvGJ -u49MjsWEUVgoCBv33VIfoHeyc3DPmoCYZ1et8nZcvuXLRMZKN0GMNRW3nqjqeBJb -9HY+PTYBbLewJNYbHWYN6Wwit6HCO6w33UhIcGiPopNv0JPsUMk2HaueFx7sbrBL -vZ0QRPkSkdj6dUHvz5xDkLo5ID6hCBx1s7YBWQ7usm69zfXPw7GhdgBaga2Y6DEs -2SLGr6FGlrpeOWXvpBmupgQRVi9q+MJOMk4n7tUAER5ypnPeWQsm+9hlv6wRflEU -cZyWUk7ITwCHwkWSm3A5og8qtOUBS7pnawDgwnf2ccC2CQaFHH1oew9evuM1XWni -30Bnof/JmnKs9IKkwS4V+o0o/Yd/cRRBkdwRSg6LXs2ZOHtv762jWX4sA7gu8fsC -bY3HCjZ2LiKYyevSNM/w8oTIEwl7p6OzTl1Qy3oCFStw7W2xk8j7cK+MjGa4Qy2r -gET7DHFhNhjBh8GJuC5c2fVPvOGydV2GZ5HEFQqY5RAvg5+flynTt0ZcgemSsLgx -LgZLB/2a5B2ACprxKt+w2bhiBb+Gd8hZknD3LxBqlrg4mzt+tWc= -=2Tmp +iQIzBAABCgAdFiEEAi2iSEMtKg4PVOZeMWwfrNYtB9kFAmrNadoACgkQMWwfrNYt +B9mATA//T+hl6NH3x2bfJI7NkjtU2TEwd3MUyH83y4UCBth07F4vmnrwJabSOpay +kwTjKL50A//rENo+yunrR7TrPMznyOoc8+b131UEYsbh2N3PrG9sg7GVA6NGgVKR +2yT8pLYGFYu554hwwme9PO8OiNd4jziD0QxUGdv9u1xQDlrgS+ob0k1okH88jRjZ +3wHfpCfbTtdUByTDzXxLZrd+C6XcPPej8kP1Cao5gVGDeXe+M/S86sQYjlqJZSb6 +0yxa6aVnen2I8T/Fc364LesrFIG0LyBdfx/uGbpGwuAEARpqzBCzJ/Cuuh1u5XDo +/0BPSC+LrIiynRyV+obthjjZjcIJkGOvDdl84KQsKYg1fA8lXWF2KH76Zn84MN2k +1frbEtMr4/e4RGrSBTxkEd7e8O/yk4lUmGrz0kfqABYTTgWjsVZaA45w2zuhfFbg +KPMnbc8U3C7YJUVXOpyUUurIrdbveYb37eJt3S71eND+xQ/g/pYffK9w7mAmCzEH +lTB/r2vVgq6p2Rntz99L8AyagkpUAx28daQZMCAYyiJ8K9A2eNdnmsQbztZvA3jg +ujsLETkDOtBholIoCTy5xmLFVAu4JqQRXz6Wo8YX2nTo1xEW0EmRAjp7XMVk4Vp7 +dL/sDaf67ePCMiEMdaps9YyowiAc+6rwnkjueR45O4erLxshaho= +=N1CH -----END PGP SIGNATURE----- diff --git a/tor-binary-resources/pom.xml b/tor-binary-resources/pom.xml index adc5bc9..b5330cf 100644 --- a/tor-binary-resources/pom.xml +++ b/tor-binary-resources/pom.xml @@ -6,7 +6,7 @@ com.github.bisq-network.tor-binary tor-binary - 0.4.9.13 + 0.4.9.14 4.0.0 diff --git a/tor-binary-windows/pom.xml b/tor-binary-windows/pom.xml index dc51b3d..6ccfd4c 100644 --- a/tor-binary-windows/pom.xml +++ b/tor-binary-windows/pom.xml @@ -6,7 +6,7 @@ com.github.bisq-network.tor-binary tor-binary - 0.4.9.13 + 0.4.9.14 4.0.0 diff --git a/tor-binary-windows64/pom.xml b/tor-binary-windows64/pom.xml index 81ab702..7c0d78d 100644 --- a/tor-binary-windows64/pom.xml +++ b/tor-binary-windows64/pom.xml @@ -6,7 +6,7 @@ com.github.bisq-network.tor-binary tor-binary - 0.4.9.13 + 0.4.9.14 4.0.0 From 7d34c0ced4c0d25836be967d45a58dfd75d01e69 Mon Sep 17 00:00:00 2001 From: HenrikJannsen Date: Fri, 16 Oct 2026 09:09:09 +0700 Subject: [PATCH 2/4] Fix verification self-test on bash before 4.4 macOS ships bash 3.2, where expanding an empty array with "${a[@]}" under set -o nounset fails with "unbound variable". create_key and sign_as hit this whenever no faked system time is given. Use the guarded expansion ${a[@]+"${a[@]}"}, which works in every bash version. --- tools/verification-selftest.sh | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/tools/verification-selftest.sh b/tools/verification-selftest.sh index 6db9e19..867460e 100755 --- a/tools/verification-selftest.sh +++ b/tools/verification-selftest.sh @@ -269,7 +269,8 @@ create_key() { local user_id="$1" expiry="${2:-never}" faked_time="${3:-}" local time_option=() [ -n "$faked_time" ] && time_option=(--faked-system-time "$faked_time") - signer_gpg "${time_option[@]}" --passphrase '' --quick-generate-key \ + # The guarded expansion keeps an empty array working under nounset in bash before 4.4 (macOS). + signer_gpg ${time_option[@]+"${time_option[@]}"} --passphrase '' --quick-generate-key \ "$user_id" default default "$expiry" >/dev/null 2>&1 signer_gpg --list-keys --with-colons "$user_id" 2>/dev/null | awk -F: '$1=="fpr"{print $10; exit}' } @@ -279,7 +280,7 @@ sign_as() { local fingerprint="$1" file="$2" faked_time="${3:-}" local time_option=() [ -n "$faked_time" ] && time_option=(--faked-system-time "$faked_time") - signer_gpg "${time_option[@]}" --detach-sign --armor --local-user "$fingerprint" \ + signer_gpg ${time_option[@]+"${time_option[@]}"} --detach-sign --armor --local-user "$fingerprint" \ --output "$file.asc" "$file" >/dev/null 2>&1 } From fb01438a7b11de78c3be30c06f52d025a184ae9d Mon Sep 17 00:00:00 2001 From: HenrikJannsen Date: Fri, 16 Oct 2026 09:09:59 +0700 Subject: [PATCH 3/4] Complete the PGP signature check command in the docs The prerequisites in readme.MD named only mvn -Pcheck-pgp-signatures, which fails with "No goals have been specified". Use the full command mvn -N -Pcheck-pgp-signatures verify, as in the update steps and CI, also in the verification specification. --- docs/specifications/build/artifact-verification.md | 2 +- readme.MD | 3 ++- 2 files changed, 3 insertions(+), 2 deletions(-) diff --git a/docs/specifications/build/artifact-verification.md b/docs/specifications/build/artifact-verification.md index 6273801..fa9ba70 100644 --- a/docs/specifications/build/artifact-verification.md +++ b/docs/specifications/build/artifact-verification.md @@ -172,7 +172,7 @@ the version scheme. This rule does not make that decision. The manifest is checked before the bundles are downloaded, so that an unauthenticated or outdated manifest stops the run immediately. -| Verification point | `ant -f build.xml` | `mvn -Pcheck-pgp-signatures verify` | `mvn clean install` | +| Verification point | `ant -f build.xml` | `mvn -N -Pcheck-pgp-signatures verify` | `mvn clean install` | | --- | --- | --- | --- | | Manifest signature | yes | yes | no | | Manifest against its published source | yes | yes | no | diff --git a/readme.MD b/readme.MD index ac62783..ffe8699 100644 --- a/readme.MD +++ b/readme.MD @@ -103,7 +103,8 @@ correct. Review such changes separately. - Apache Ant on `PATH` to run `tools/verification-selftest.sh` or `ant -f build.xml`. The Maven builds use Maven's Ant plugin and do not need the standalone `ant` command. -- GPG, when checking signatures with `mvn -Pcheck-pgp-signatures` or `build.xml`, and for the self-test +- GPG, when checking signatures with `mvn -N -Pcheck-pgp-signatures verify` or `ant -f build.xml`, and for + the self-test - tar with gzip/xz support - network access to `archive.torproject.org` for the bundles, and to the configured keyserver (`hkps://keys.openpgp.org`) for the Tor signing key From d7708ed8d1123263ca046f6997f55df874ab809d Mon Sep 17 00:00:00 2001 From: HenrikJannsen Date: Fri, 16 Oct 2026 09:10:31 +0700 Subject: [PATCH 4/4] Read torbrowser.version from pom.xml in the verification self-test The self-test hard-coded the Tor Browser version for its fixture bundle names, and the value had to be bumped by hand on every update. Read it from the root POM instead, and stop with an error when exactly one version cannot be read. The readme notes that the self-test needs no change for a version update. --- readme.MD | 3 ++- tools/verification-selftest.sh | 8 +++++++- 2 files changed, 9 insertions(+), 2 deletions(-) diff --git a/readme.MD b/readme.MD index ffe8699..1a663db 100644 --- a/readme.MD +++ b/readme.MD @@ -82,7 +82,8 @@ from the Maven project version. This check runs in `tor-binary-resources` during fixtures and its own throwaway test keys. It covers the digest rules, the tor version rules, the signature rules, including a signature made with an unrelated key, a revoked key, an expired key and content changed after signing, and the key fetch against a stub keyserver on the loopback interface. It needs no network -access and never touches your own GPG keyring. +access and never touches your own GPG keyring. It reads `torbrowser.version` from the root [pom.xml](pom.xml), +so it needs no change for a version update. Tor Browser versions can be found here: https://archive.torproject.org/tor-package-archive/torbrowser/[torbrowser.version] diff --git a/tools/verification-selftest.sh b/tools/verification-selftest.sh index 867460e..dc8b7b6 100755 --- a/tools/verification-selftest.sh +++ b/tools/verification-selftest.sh @@ -14,7 +14,13 @@ set -o nounset project_root="$(cd "$(dirname "$0")/.." && pwd)" ant_command="${ANT:-ant}" -torbrowser_version="15.0.25" +# The fixtures use the bundle names of the configured release, so they follow pom.xml. +torbrowser_version="$(sed -n 's|.*\(.*\).*|\1|p' "$project_root/pom.xml")" +version_pattern='^[0-9]+(\.[0-9]+)+[a-z0-9]*$' +if ! [[ "$torbrowser_version" =~ $version_pattern ]]; then + echo "FAIL cannot read a single torbrowser.version from $project_root/pom.xml: '$torbrowser_version'" + exit 1 +fi tor_fingerprint="EF6E286DDA85EA2A4BA7DE684E2C6E8793298290" platforms=(windows-i686 windows-x86_64 macos-x86_64 macos-aarch64 linux-i686 linux-x86_64)