Merge branch 'feature/8031-refactor-10-rbb-hook' into testing

config/chroot_local-hooks/10-tbb

@@ -145,7 +145,8 @@ EOF
 install_debian_extensions() {
     local destination
     destination="${1}"
-    apt-get install --yes xul-ext-adblock-plus xul-ext-torbutton
+    shift
+    apt-get install --yes "${@}"
     ln -s /usr/share/xul-ext/adblock-plus/ \
           "${destination}"/'{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}'
     ln -s /usr/share/xul-ext/torbutton/ \
@@ -170,43 +171,24 @@ create_default_profile() {
     done
 }
 
-# Get the below with `grep "tor-browser-linux32-.*\.tar.xz" sha256sums.txt`
-BUNDLES="$(cat <<EOF
-d43236d3a8b6d9ce17bdc490c5349da7726800113872835e20961609f6cfb0ca  tor-browser-linux32-4.0_ar.tar.xz
-b1007109555d79fc0b959343bd204b9f19c22e11b42c760a8a4adc7ee0a5cc88  tor-browser-linux32-4.0_de.tar.xz
-2511830a5eea5136e90dc14e309f036d5890d728a0ed3dbb557eeee4d733359c  tor-browser-linux32-4.0_en-US.tar.xz
-7e48ab4d0360ace4e481fb145cf7e11da0fe43cf5518e1285d60390cd777e1aa  tor-browser-linux32-4.0_es-ES.tar.xz
-560e81777b097a53918d861b5e3864bfcd6641e4be87044b1c9f227266ed9800  tor-browser-linux32-4.0_fa.tar.xz
-c28fbad043b66a6fe5d76111232c6bce3a0334f6401c52f152d4941029ac27c5  tor-browser-linux32-4.0_fr.tar.xz
-73906106a501a3e9be43d048cd4daaf8146ef9702272661fe40fdaa6378d8ec1  tor-browser-linux32-4.0_it.tar.xz
-5497c51bc47d73f047f4b84ff163462134a52e0a3fb511f968df44f3aa65a187  tor-browser-linux32-4.0_ko.tar.xz
-c11b8d3b5b8d2488e15c524e85993fbad2261b53a7a16aeee722a0fadeffe28c  tor-browser-linux32-4.0_nl.tar.xz
-cad5625b18785a11ee49432e858e776a1b1f02d8c0eda9d2e79358fc1d7793a0  tor-browser-linux32-4.0_pl.tar.xz
-29f51b4fb9d51ccab2668f2d84e88850e3458c41400369d4da45410af11b981e  tor-browser-linux32-4.0_pt-PT.tar.xz
-4d23c36fce0f56d4316469ba33c2fa079e7cf2eea6e67c4c8a5b271b72e3ce6d  tor-browser-linux32-4.0_ru.tar.xz
-463e38b98c93473142d79d65626cc53584c27e77ea799ad2d0702b25d5495093  tor-browser-linux32-4.0_tr.tar.xz
-66a00595224dbf2fba1925bcb60e0fb7ae1a6915cb112d903e5f861b68d019f4  tor-browser-linux32-4.0_vi.tar.xz
-720e680d42ea939ce2551dbd43559c6960097ae6de45de507da151403dfa5ac9  tor-browser-linux32-4.0_zh-CN.tar.xz
-EOF
-)"
+TBB_SHA256SUMS_FILE=/usr/share/tails/tbb-sha256sums.txt
+TBB_TARBALLS="$(grep "\<tor-browser-linux32-.*\.tar.xz$" "${TBB_SHA256SUMS_FILE}")"
 
 # We'll use the en-US bundle as our basis; only langpacks will be
 # installed from the other bundles.
-MAIN_BUNDLE="$(echo "${BUNDLES}" | grep -o "tor-browser-linux32-.*_en-US.tar.xz")"
-VERSION="$(echo "${MAIN_BUNDLE}" | sed 's/tor-browser-linux32-\(.*\)_en-US.tar.xz/\1/')"
-# Note that we cannot use https here since apt-cacher-ng (used by vagrant)
-# gets confused and throws a 403. It doesn't matter, though, since we verify
-# the checksums of each file downloaded.
-#TBB_DIST_URL="http://archive.torproject.org/tor-package-archive/torbrowser/${VERSION}"
-#TBB_DIST_URL="http://www.torproject.org/dist/torbrowser/${VERSION}/"
-TBB_DIST_URL="http://people.torproject.org/~mikeperry/builds/${VERSION}/"
-#TBB_DIST_URL="http://people.torproject.org/~gk/testbuilds/${VERSION}"
-#TBB_DIST_URL="http://people.torproject.org/~linus/builds/${VERSION}"
+MAIN_TARBALL="$(echo "${TBB_TARBALLS}" | grep -o "tor-browser-linux32-.*_en-US.tar.xz")"
+VERSION="$(echo "${MAIN_TARBALL}" | sed 's/tor-browser-linux32-\(.*\)_en-US.tar.xz/\1/')"
+TBB_DIST_URL_FILE=/usr/share/tails/tbb-dist-url.txt
+TBB_TARBALLS_BASE_URL="$(cat "${TBB_DIST_URL_FILE}")/${VERSION}"
+
+# The Debian Iceweasel extensions we want to install and make
+# available in the Tor Browser.
+DEBIAN_EXT_PKGS="xul-ext-adblock-plus xul-ext-torbutton"
 
 TMP="$(mktemp -d)"
-download_and_verify_files "${TBB_DIST_URL}" "${BUNDLES}" "${TMP}"
+download_and_verify_files "${TBB_TARBALLS_BASE_URL}" "${TBB_TARBALLS}" "${TMP}"
 
-install_tor_browser "${TMP}/${MAIN_BUNDLE}" "${TBB_INSTALL}"
+install_tor_browser "${TMP}/${MAIN_TARBALL}" "${TBB_INSTALL}"
 
 mkdir -p "${TBB_EXT}"
 install_langpacks_from_bundles "${TMP}" "${TBB_EXT}"
@@ -223,7 +205,7 @@ rmdir "${TBB_INSTALL}"/TorBrowser/Data/Browser/profile.default/extensions
 FIREFOX_VERSION=$(get_firefox_version "${TBB_INSTALL}"/application.ini)
 FAKE_ICEWEASEL_VERSION=${FIREFOX_VERSION}+fake1
 install_fake_iceweasel_pkg "${FAKE_ICEWEASEL_VERSION}"
-install_debian_extensions "${TBB_EXT}"
+install_debian_extensions "${TBB_EXT}" ${DEBIAN_EXT_PKGS}
 
 mkdir -p "${TBB_PROFILE}"
 create_default_profile "${TBB_INSTALL}"/TorBrowser/Data/Browser/profile.default "${TBB_EXT}" "${TBB_PROFILE}"

config/chroot_local-hooks/98-remove_unwanted_files

@@ -13,3 +13,7 @@ find /usr/share/doc -type f -name NEWS.Debian.gz      -delete
 
 # Remove .in files managed by intltool
 rm $POTFILES_DOT_IN
+
+# These files are not needed after the Tor Browser has been installed
+# (by the 10-tbb hook)
+rm /usr/share/tails/tbb-*.txt

config/chroot_local-includes/usr/share/tails/tbb-dist-url.txt

+http://people.torproject.org/~mikeperry/builds

config/chroot_local-includes/usr/share/tails/tbb-sha256sums.txt

+d43236d3a8b6d9ce17bdc490c5349da7726800113872835e20961609f6cfb0ca  tor-browser-linux32-4.0_ar.tar.xz
+b1007109555d79fc0b959343bd204b9f19c22e11b42c760a8a4adc7ee0a5cc88  tor-browser-linux32-4.0_de.tar.xz
+2511830a5eea5136e90dc14e309f036d5890d728a0ed3dbb557eeee4d733359c  tor-browser-linux32-4.0_en-US.tar.xz
+7e48ab4d0360ace4e481fb145cf7e11da0fe43cf5518e1285d60390cd777e1aa  tor-browser-linux32-4.0_es-ES.tar.xz
+560e81777b097a53918d861b5e3864bfcd6641e4be87044b1c9f227266ed9800  tor-browser-linux32-4.0_fa.tar.xz
+c28fbad043b66a6fe5d76111232c6bce3a0334f6401c52f152d4941029ac27c5  tor-browser-linux32-4.0_fr.tar.xz
+73906106a501a3e9be43d048cd4daaf8146ef9702272661fe40fdaa6378d8ec1  tor-browser-linux32-4.0_it.tar.xz
+5497c51bc47d73f047f4b84ff163462134a52e0a3fb511f968df44f3aa65a187  tor-browser-linux32-4.0_ko.tar.xz
+c11b8d3b5b8d2488e15c524e85993fbad2261b53a7a16aeee722a0fadeffe28c  tor-browser-linux32-4.0_nl.tar.xz
+cad5625b18785a11ee49432e858e776a1b1f02d8c0eda9d2e79358fc1d7793a0  tor-browser-linux32-4.0_pl.tar.xz
+29f51b4fb9d51ccab2668f2d84e88850e3458c41400369d4da45410af11b981e  tor-browser-linux32-4.0_pt-PT.tar.xz
+4d23c36fce0f56d4316469ba33c2fa079e7cf2eea6e67c4c8a5b271b72e3ce6d  tor-browser-linux32-4.0_ru.tar.xz
+463e38b98c93473142d79d65626cc53584c27e77ea799ad2d0702b25d5495093  tor-browser-linux32-4.0_tr.tar.xz
+66a00595224dbf2fba1925bcb60e0fb7ae1a6915cb112d903e5f861b68d019f4  tor-browser-linux32-4.0_vi.tar.xz
+720e680d42ea939ce2551dbd43559c6960097ae6de45de507da151403dfa5ac9  tor-browser-linux32-4.0_zh-CN.tar.xz

wiki/src/contribute/release_process/tor-browser.mdwn

@@ -5,19 +5,41 @@
 Have a look at
 
 * https://archive.torproject.org/tor-package-archive/torbrowser/
-* http://www.torproject.org/dist/torbrowser/
-* http://people.torproject.org/~mikeperry/builds/
+* https://www.torproject.org/dist/torbrowser/
+* https://people.torproject.org/~mikeperry/builds/
 * https://people.torproject.org/~linus/builds/
 
 and see if the desired version is available. We prefer
 `archive.torproject.org` since the other sources periodically cleans
-up old releases.
+up old releases. Set `DIST_URL` to the chosen url, and set `VERSION`
+to the desired TBB version, for example:
 
-Fetch the version's `sha256sums.txt` (and verify it with
-`sha256sums.txt.asc`) and then update the variables in
-`config/chroot_local-hooks/10-tbb` as follows:
+    DIST_URL=https://people.torproject.org/~mikeperry/builds/
+    VERSION=4.0
 
-* set `TBB_DIST_URL` to the url chosen above.
-* set `BUNDLES` to the output of:
+Fetch the version's `sha256sums.txt` and `sha256sums.txt.asc` and
+verify with `gpg`:
 
-    grep "tor-browser-linux32-.*\.tar.xz" sha256sums.txt
+    wget ${DIST_URL}/${VERSION}/sha256sums.txt{,.asc} && \
+    gpg --verify sha256sums.txt.asc
+
+Filter the tarballs we want and make them available at build time,
+when the tarballs are fetched:
+
+    grep "\<tor-browser-linux32-.*\.tar.xz$" sha256sums.txt > \
+         config/chroot_local-includes/usr/share/tails/tbb-sha256sums.txt
+
+Then update the url to the one chosen above:
+
+    echo "${DIST_URL}" | sed "s,^https://,http://," > \
+         config/chroot_local-includes/usr/share/tails/tbb-dist-url.txt
+
+NOTE: We must use http (not http**s**) due to limitations/bugs in
+`apt-cacher-ng`, which often is used in Tails build
+environments. However, it is of no consequence since we verify the
+checksum file.
+
+Lastly, commit:
+
+    git commit config/chroot_local-includes/usr/share/tails/tbb-*.txt \
+        -m "Upgrade TBB to ${VERSION}."