Update torbrowser to v15.0.22 with tor binary version 0.4.9.12

.gitignore

@@ -32,3 +32,6 @@ target/
 /tor-binary-macos-aarch64/src
 /tor-binary-windows/src
 /tor-binary-windows64/src
+
+### Agent temporary files
+/temp/

build.xml

@@ -2,8 +2,10 @@
 <project name="tor-binaries" default="checkSignatures">
 
     <property name="project.source.directory" value="tmp"/>
-    <property name="torbrowser.version" value="15.0.21"/>
+    <xmlproperty file="pom.xml" prefix="pom"/>
+    <property name="torbrowser.version" value="${pom.project.properties.torbrowser.version}"/>
     <property name="torbrowser.download.base.url" value="https://archive.torproject.org/tor-package-archive/torbrowser/${torbrowser.version}"/>
+    <property name="checksum.file" value="tor-binary-resources/checksums/sha256sums-signed-build.txt"/>
     <target name="checkSignatures">
 
         <delete dir="${project.source.directory}" failonerror="false"/>
@@ -85,11 +87,43 @@
             </exec>
         </parallel>
 
-        <checksum algorithm="SHA-256" todir="tor-binary-resources/checksums">
-            <fileset dir="${project.source.directory}">
-                <exclude name="*.asc"/>
-            </fileset>
-        </checksum>
+        <macrodef name="verify-checksum">
+            <attribute name="bundle"/>
+            <attribute name="id"/>
+            <sequential>
+                <loadfile property="checksum.@{id}.expected" srcfile="${checksum.file}">
+                    <filterchain>
+                        <linecontainsregexp>
+                            <regexp pattern="^[0-9a-f]{64}  @{bundle}$"/>
+                        </linecontainsregexp>
+                        <tokenfilter>
+                            <replaceregex pattern="  .*" replace=""/>
+                        </tokenfilter>
+                        <striplinebreaks/>
+                    </filterchain>
+                </loadfile>
+                <fail unless="checksum.@{id}.expected"
+                      message="No checksum found for @{bundle} in ${checksum.file}"/>
+                <checksum algorithm="SHA-256"
+                          file="${project.source.directory}/@{bundle}"
+                          property="${checksum.@{id}.expected}"
+                          verifyproperty="checksum.@{id}.verified"/>
+                <fail message="Checksum verification failed for @{bundle}">
+                    <condition>
+                        <not>
+                            <equals arg1="${checksum.@{id}.verified}" arg2="true"/>
+                        </not>
+                    </condition>
+                </fail>
+            </sequential>
+        </macrodef>
+
+        <verify-checksum bundle="tor-expert-bundle-windows-i686-${torbrowser.version}.tar.gz" id="windows-i686"/>
+        <verify-checksum bundle="tor-expert-bundle-windows-x86_64-${torbrowser.version}.tar.gz" id="windows-x86_64"/>
+        <verify-checksum bundle="tor-expert-bundle-macos-x86_64-${torbrowser.version}.tar.gz" id="macos-x86_64"/>
+        <verify-checksum bundle="tor-expert-bundle-macos-aarch64-${torbrowser.version}.tar.gz" id="macos-aarch64"/>
+        <verify-checksum bundle="tor-expert-bundle-linux-i686-${torbrowser.version}.tar.gz" id="linux-i686"/>
+        <verify-checksum bundle="tor-expert-bundle-linux-x86_64-${torbrowser.version}.tar.gz" id="linux-x86_64"/>
 
         <delete dir="${project.source.directory}"/>
     </target>

docs/specifications/build/artifact-verification.md

@@ -0,0 +1,16 @@
+# Tor Artifact Verification
+
+## Required behavior
+
+- Every downloaded Tor expert bundle must have exactly one matching entry in the tracked SHA-256 manifest.
+- Packaging must fail when a required entry is absent or the downloaded bundle's digest differs.
+- Bundle names in the manifest must match exactly; a digest for another platform or Tor Browser version must not satisfy verification.
+- The tracked manifest must use a version-independent filename so an update replaces one file rather than creating parallel per-version checksum files.
+
+## Manifest provenance
+
+The manifest must contain all entries from Tor Browser's `sha256sums-signed-build.txt`, unchanged and in upstream order, preceded only by a comment identifying the exact source URL. Keeping the complete list makes review against the upstream source straightforward.
+
+Before replacing the tracked manifest, the updater must download the corresponding detached `.asc` signature and verify it using the Tor Browser Developers signing key. The source URL and manifest entries must correspond to the configured `torbrowser.version`.
+
+The tracked hashes remain pinned inputs to normal builds. The optional PGP verification build and the standalone Ant build provide independent verification of each selected expert bundle's detached signature.

pom.xml

@@ -5,7 +5,7 @@
 
     <groupId>com.github.bisq-network.tor-binary</groupId>
     <artifactId>tor-binary</artifactId>
-    <version>0.4.9.11</version>
+    <version>${revision}</version>
 
     <modelVersion>4.0.0</modelVersion>
     <packaging>pom</packaging>
@@ -17,8 +17,12 @@
         - gpg in path for PGP signature verification
         - tar with gzip/xz support in path
         -->
-        <torbrowser.version>15.0.21</torbrowser.version>
+
+        <revision>0.4.9.12</revision>
+        <torbrowser.version>15.0.22</torbrowser.version>
+
         <torbrowser.download.base.url>https://archive.torproject.org/tor-package-archive/torbrowser/${torbrowser.version}</torbrowser.download.base.url>
+        <torbrowser.checksum.source.url>${torbrowser.download.base.url}/sha256sums-signed-build.txt</torbrowser.checksum.source.url>
         <pgp.signature.keyserver>keys.openpgp.org</pgp.signature.keyserver>
 
         <project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>

readme.MD

@@ -11,49 +11,34 @@ Package native Tor files from [Tor Browser project](https://www.torproject.org/)
 
 # Update to new version
 
-1. Replace `torbrowser.version` with the target Tor Browser bundle version in the [build file](build.xml) and the [Maven file](pom.xml)
+1. Replace `torbrowser.version` with the target Tor Browser bundle version in the root [Maven file](pom.xml)
 2. Find out which `tor binary version` is used in that Tor Browser release. Use that as the Maven project version.
-3. Set the `tor-binary version` in following Maven files:
-   - [pom.xml](pom.xml)
-   - [tor-binary-geoip/pom.xml](tor-binary-geoip/pom.xml)
-   - [tor-binary-linux32/pom.xml](tor-binary-linux32/pom.xml)
-   - [tor-binary-linux64/pom.xml](tor-binary-linux64/pom.xml)
-   - [tor-binary-macos/pom.xml](tor-binary-macos/pom.xml)
-   - [tor-binary-macos-aarch64/pom.xml](tor-binary-macos-aarch64/pom.xml)
-   - [tor-binary-resources/pom.xml](tor-binary-resources/pom.xml)
-   - [tor-binary-windows/pom.xml](tor-binary-windows/pom.xml)
-   - [tor-binary-windows64/pom.xml](tor-binary-windows64/pom.xml)
-4. Get the hash values of the new version from https://archive.torproject.org/tor-package-archive/torbrowser/[torbrowser.version]/sha256sums-signed-build.txt and update the files inside [tor-binary-resources/checksums](tor-binary-resources/checksums). Alternatively, run `ant -f build.xml` to verify signatures and regenerate the checksum files.
+3. Set `revision` to the `tor-binary version` in the root [Maven file](pom.xml)
+4. Download the complete `sha256sums-signed-build.txt` for the new version from `torbrowser.checksum.source.url`, preserve every upstream entry, and add its source URL as the first comment in [the tracked checksum manifest](tor-binary-resources/checksums/sha256sums-signed-build.txt).
 5. Verify the Tor expert bundle PGP signatures with Maven:
    ```
    mvn -N -Pcheck-pgp-signatures verify
    ```
 
-When updating checksums, make sure the six filenames in `tor-binary-resources/checksums` exactly match the six bundles listed in `build.xml`. Remove checksum files from the previous Tor Browser version before running Ant; Ant writes new files but does not remove obsolete files. For a manual update, copy the SHA-256 value for each `tor-expert-bundle-*.tar.gz` from the signed checksum list for the selected Tor Browser version into a file named `<bundle>.tar.gz.SHA-256` (the file must contain only the hash). For the current version, the [signed checksum list](https://archive.torproject.org/tor-package-archive/torbrowser/15.0.21/sha256sums-signed-build.txt) is the source of truth. Then verify the result with:
+The version-independent manifest filename makes future updates a one-file replacement. Keeping all upstream entries makes the tracked file easy to compare with its source, while the build requires an exact manifest entry and matching SHA-256 digest for every downloaded expert bundle. The source comment is intentionally the only line added to the upstream contents. For the current version, the [Tor Browser 15.0.22 checksum list](https://archive.torproject.org/tor-package-archive/torbrowser/15.0.22/sha256sums-signed-build.txt) is the source of truth. Verify its detached signature before updating the tracked manifest, then verify the bundles with:
 
 ```
-rm tor-binary-resources/checksums/tor-expert-bundle-*.SHA-256
-ant -f build.xml
+curl --fail --remote-name-all \
+    https://archive.torproject.org/tor-package-archive/torbrowser/15.0.22/{sha256sums-signed-build.txt,sha256sums-signed-build.txt.asc}
+gpg --verify sha256sums-signed-build.txt.asc sha256sums-signed-build.txt
 mvn -N -Pcheck-pgp-signatures verify
+mvn clean install
 ```
 
-The first two commands download the bundles, verify their PGP signatures, and regenerate the checksum files. Because each tracked checksum file contains only a hash, use the following command to compare the regenerated checksums with the downloaded bundles in `tmp`:
+The first two commands authenticate the downloaded checksum list before it is copied into the repository. The Maven signature profile independently verifies each expert bundle's detached signature; `mvn clean install` then checks every bundle against the pinned manifest before packaging it.
 
-```
-for checksum in tor-binary-resources/checksums/*.SHA-256; do
-    bundle="${checksum##*/}"
-    bundle="${bundle%.SHA-256}"
-    test "$(cat "$checksum")" = "$(sha256sum "tmp/$bundle" | cut -d' ' -f1)"
-done
-```
-
-After changing `torbrowser.version`, also update the Maven project version in every module listed above, then run `mvn clean install` to confirm that all platform artifacts and the GeoIP artifact can be built.
+After changing the two version properties, run `mvn clean install` to confirm that all platform artifacts and the GeoIP artifact can be built.
 
 Tor Browser versions can be found here: https://archive.torproject.org/tor-package-archive/torbrowser/[torbrowser.version]
 
 # Pre-requisites
 
-- GPG, when checking PGP signatures with Maven or refreshing checksums with `build.xml`
+- GPG, when checking PGP signatures with Maven or `build.xml`
 - tar with gzip/xz support
 - network access to `archive.torproject.org` and `keys.openpgp.org` for PGP signature checks
 

tor-binary-geoip/pom.xml

@@ -6,7 +6,7 @@
     <parent>
         <groupId>com.github.bisq-network.tor-binary</groupId>
         <artifactId>tor-binary</artifactId>
-        <version>0.4.9.11</version>
+        <version>${revision}</version>
     </parent>
 
     <modelVersion>4.0.0</modelVersion>

tor-binary-linux32/pom.xml

@@ -6,7 +6,7 @@
     <parent>
         <groupId>com.github.bisq-network.tor-binary</groupId>
         <artifactId>tor-binary</artifactId>
-        <version>0.4.9.11</version>
+        <version>${revision}</version>
     </parent>
 
     <modelVersion>4.0.0</modelVersion>

tor-binary-linux64/pom.xml

@@ -6,7 +6,7 @@
     <parent>
         <groupId>com.github.bisq-network.tor-binary</groupId>
         <artifactId>tor-binary</artifactId>
-        <version>0.4.9.11</version>
+        <version>${revision}</version>
     </parent>
 
     <modelVersion>4.0.0</modelVersion>

tor-binary-macos-aarch64/pom.xml

@@ -6,7 +6,7 @@
     <parent>
         <groupId>com.github.bisq-network.tor-binary</groupId>
         <artifactId>tor-binary</artifactId>
-        <version>0.4.9.11</version>
+        <version>${revision}</version>
     </parent>
 
     <modelVersion>4.0.0</modelVersion>

tor-binary-macos/pom.xml

@@ -6,7 +6,7 @@
     <parent>
         <groupId>com.github.bisq-network.tor-binary</groupId>
         <artifactId>tor-binary</artifactId>
-        <version>0.4.9.11</version>
+        <version>${revision}</version>
     </parent>
 
     <modelVersion>4.0.0</modelVersion>

tor-binary-resources/checksums/sha256sums-signed-build.txt

@@ -0,0 +1,53 @@
+# Source: https://archive.torproject.org/tor-package-archive/torbrowser/15.0.22/sha256sums-signed-build.txt
+89e1b449d02ca04a4c897200efcf12ee050a7c6bb5a035604e43bee3c4902fcd  geckodriver-linux-x86_64-15.0.22.tar.xz
+7d9c52b205c0eb3ad5c35c66a828561d1ded0ca20f6e185e9f4dc425301795e7  mar-tools-linux-i686-15.0.22.zip
+d7c83ab6f92b40c4f5d3e12766438ea1c4e8f00116d6c2c68170472424d1feff  mar-tools-linux-x86_64-15.0.22.zip
+9ae6f220d1bae4525da3801de811860b66f013ad9469520b6ddfb1f7818c4bc6  mar-tools-macos-x86_64-15.0.22.zip
+a9c93a84b3ffe5b6c71af714f4b65f6490a190c6c42a19fe1afc2d0a8ff329bb  mar-tools-windows-i686-15.0.22.zip
+a84cf3b1171dcc36f710299493cca0020451c29e72a91c5577f7e1123155b6a6  mar-tools-windows-x86_64-15.0.22.zip
+2ab574cf1f7e200b137aad095b31fb3a908d1773e7dc598ebb6c1de5c0673de9  src-firefox-tor-browser-140.15.0esr-15.0-1-build2.tar.xz
+f6cd8f8ce3360f38bae11f80ba680a357c753e1c14f47876f5ae33ee8e4fdfe6  tor-browser-15.0.22-androidTest.apk.idsig
+b4a998cc8737feb9c085faaa944091a5fbe94337de3150b85b9d29d5a3cef4ad  tor-browser-android-aarch64-15.0.22.apk
+3720967372b669666248b6fc7b0830ccf5261073eff0c0a99cd0aa340916d026  tor-browser-android-armv7-15.0.22.apk
+99b6058d2714f23f2fea34c83605254c924651e4d731690d47943a02885eac07  tor-browser-android-x86-15.0.22.apk
+5be98b1e71d2c08415412c16b3121a6d26cad8af3e30b8cdd62712ed908341cf  tor-browser-android-x86_64-15.0.22.apk
+3fd90aa619696484f3ebf16e159d262ab6164e1d4913c42a5df759d7cb7b2bbc  tor-browser-debug-symbols-linux-i686-15.0.22.tar.xz
+1c3a29f990f5487a8a58002ef36e3a7f8ba6cae007836a026b4c021c22e2d4e8  tor-browser-debug-symbols-linux-x86_64-15.0.22.tar.xz
+ffb0e847e29ac1723ef6558f222cb2540abbb09c6678ddf5f944cf8d126dcd4d  tor-browser-debug-symbols-windows-i686-15.0.22.zip
+c7273fdabcf6fff7d0d9d42b54c0f3bc080892724efa5cc932387a06ed7c4938  tor-browser-debug-symbols-windows-x86_64-15.0.22.zip
+59b588bb5ad9877d4dd07dbe3ca4ea9060d4b3b2a2ac8bc9c9eb6f54cdb1affe  tor-browser-linux-i686-15.0.22.mar
+d49f3675d13c0ea5523a74b8c88e1ac8bcb1dcc04ffbe4cea272ee946b01cf81  tor-browser-linux-i686-15.0.22.tar.xz
+aabfd0cf7b913561f59c6e78da0daa975704eba698d299fb322717d4f8e5dbff  tor-browser-linux-x86_64-15.0.22.mar
+c22ceb046c79ce5e7b33ba1b837894afd63b3ff1fc724c023db54bd813566457  tor-browser-linux-x86_64-15.0.22.tar.xz
+4e8f1a7a6e978b8bcd991f294b59b9c6bbf253c559b122c8888b10eefaf00d87  tor-browser-macos-15.0.22.dmg
+d04dbb46d115d377b7437574ccb5715c514bd55504a620b09855bcd616fc0c09  tor-browser-macos-15.0.22.mar
+6ffdd85215ea629345f5eddda879f1d9a36de63e54a5fa747ae03f5b699d7c1f  tor-browser-noopt-android-aarch64-15.0.22.apk.idsig
+5b9cdd3562a75df0618b9f9dab502dd0ede02fe085f7c6f453c11a9bfea96ff1  tor-browser-noopt-android-armv7-15.0.22.apk.idsig
+8f7dede61d796d48547082afd30c97fda6848dca094445a9b467d92f97c3f5b4  tor-browser-noopt-android-x86-15.0.22.apk.idsig
+fed4c627c075583a6637e91d57f6bb60023d354fb5f2891418ad158098862721  tor-browser-noopt-android-x86_64-15.0.22.apk.idsig
+085ddc22876e5cfe5ce746d3c6f3e3fe19055fc17551225ed4c3f4b3142e5149  tor-browser-qa-android-aarch64-15.0.22.apk
+2cb5cf800d742ef1a8b4571af10aebccfaf4f99c0346cd328f87df35b51c6965  tor-browser-qa-android-aarch64-15.0.22.apk.idsig
+4969b0a17f4f25180aaf6fce856be7ae3508cfa220483c826c2dc6234c5911d4  tor-browser-qa-android-armv7-15.0.22.apk
+9ca5f529714a2826e2a53919dcab9d3164c99981073b9886c3eb35da3ca91874  tor-browser-qa-android-armv7-15.0.22.apk.idsig
+a3eaf026d4a0c1f35647e2593632592844b7477b110341823eb3ad4bc482b57b  tor-browser-qa-android-x86-15.0.22.apk
+83c8766c410fd26f60bc283e3ffc7ad3a17623fa6f8d42e0da8c9224bf43516c  tor-browser-qa-android-x86-15.0.22.apk.idsig
+9291fb410976603c2c909238f801bf07ec091cceb5c67dfc5526bfa93ed04db4  tor-browser-qa-android-x86_64-15.0.22.apk
+02203c60671986f23f013a95eafb5543a641d710c3e1a272b5846cb86ea5d42a  tor-browser-qa-android-x86_64-15.0.22.apk.idsig
+db2b54061336b17467862d6fc48c569c02883cada3b57654d406aeb0b3cf289c  tor-browser-qa-unsign-android-aarch64-15.0.22.bspatch
+7a1aac2dabb6a63afde5619e1787aa0f88158259b95a47da83d5c199ea199502  tor-browser-qa-unsign-android-armv7-15.0.22.bspatch
+656186ec6093309e51159d16ea049ab8cc563fdd896b6839686ed578ef18be0f  tor-browser-qa-unsign-android-x86-15.0.22.bspatch
+a81b837cbfe9cad94431e939d40d56b2d7a8628b1e5465479b57db517d4d11a6  tor-browser-qa-unsign-android-x86_64-15.0.22.bspatch
+e25d8d3ad388360af99b06f9bc4f71be1afc480bb0d6235bd3b4624250191255  tor-browser-windows-i686-15.0.22.mar
+b7fc24edcda8043105ab838592f154d12f56b406851d5e53dad47569377395bf  tor-browser-windows-i686-portable-15.0.22.exe
+0afc01e0145dafcc87c72bcb235bb7a720eca0da0639e9f0b7df4d62777ba35e  tor-browser-windows-x86_64-15.0.22.mar
+1bca1c74798f6624e35ef6bd2713c51d92f71e51f2897d8f203991aa310476db  tor-browser-windows-x86_64-portable-15.0.22.exe
+ed4bc23065ee10f68efcdae63ea318ffa4b02b04ba00f13a3f59f8e3832fdfad  tor-expert-bundle-android-aarch64-15.0.22.tar.gz
+2bf7d66307db90fc3f76ca0d412723de9e37755454cbeb22d806a3b4c9c22595  tor-expert-bundle-android-armv7-15.0.22.tar.gz
+8718d85a70d083f099f75787879a50b92d7736ca65982a2b6a1511436208127b  tor-expert-bundle-android-x86-15.0.22.tar.gz
+88c8c6fe3d11db84bb6ea90bae801419f39b4650aac80baeff38528a82d3fd91  tor-expert-bundle-android-x86_64-15.0.22.tar.gz
+af684a8839d61778b5722938e43cc0c1cc9886f8fd8b7fb33d056077363edfba  tor-expert-bundle-linux-i686-15.0.22.tar.gz
+08d49de27f542b8f73e2014e064d8320562b5d20019c03d4725c5a5249d97985  tor-expert-bundle-linux-x86_64-15.0.22.tar.gz
+e8ea3f667c83309abad34280f0f9e1cfae52843da6b8db111ca15d6221051db5  tor-expert-bundle-macos-aarch64-15.0.22.tar.gz
+be1be1cb13cd093713f02a0beade0d2471b61119011bfeb0efc08353eadf2e4e  tor-expert-bundle-macos-x86_64-15.0.22.tar.gz
+1e4de9a4f1d99b8f40b5e0c75f3dcc3ea51b0aeab040d48fd23881e9fa94979a  tor-expert-bundle-windows-i686-15.0.22.tar.gz
+231dad6b9cb401a54c260db7046965ef04e4f72ff071b140d423fb5da281ab1e  tor-expert-bundle-windows-x86_64-15.0.22.tar.gz