[SRU] Multiple issues with Tor Browser Launcher

Bug #1896085 reported by AsciiWolf
14
This bug affects 2 people
Affects Status Importance Assigned to Milestone
torbrowser-launcher (Ubuntu)
Fix Released
Undecided
Unassigned
Focal
Invalid
Undecided
Thomas Ward
Groovy
Fix Released
Undecided
Unassigned

Bug Description

This bug is (now) a master bug for the SRU that encompasses these issues:

Tor does not download and install; repeated signature verification failed:
https://bugs.launchpad.net/ubuntu/+source/torbrowser-launcher/+bug/1856895

Version checking error in torbrowser-launcher since Tor Browser 10.0 was released:
https://bugs.launchpad.net/ubuntu/+source/torbrowser-launcher/+bug/1896752

Apparmor profile prevents Tor Browser from loading libstdc++.so.6 since Tor Browser 10.0 was released:
https://bugs.launchpad.net/ubuntu/+source/torbrowser-launcher/+bug/1897302

torbrowser-launcher has missing gnupg dependency:
https://bugs.launchpad.net/ubuntu/+source/torbrowser-launcher/+bug/1897306

All f the above issues are fixed in Groovy with the latest sync from Unstable.

Revision history for this message
AsciiWolf (asciiwolf) wrote :
AsciiWolf (asciiwolf)
description: updated
Revision history for this message
AsciiWolf (asciiwolf) wrote :

Here is the patch file included in the debdiff: https://salsa.debian.org/pkg-privacy-team/torbrowser-launcher/-/blob/72b87f502af0666954d9ae9f51b794d546e1ab6c/debian/patches/0028-Update-Tor-Browser-Developers-public-key-481.patch

The same patch file is already included in the torbrowser-launcher source package in Ubuntu Groovy.

Revision history for this message
AsciiWolf (asciiwolf) wrote :

Since yesterday release of Tor Browser 10.0, torbrowser-launcher fails its version checking and needs another simple patch to work properly: https://github.com/micahflee/torbrowser-launcher/pull/499

I will update this SRU once this is fixed in Debian.

Revision history for this message
Thomas Ward (teward) wrote :

> There should be none.

This is not a valid regression potential. There is never a case where the regression risk is exactly zero.

Revision history for this message
AsciiWolf (asciiwolf) wrote :

Thanks Thomas for reviewing this SRU. I have updated the regression potential, please let me know if it is ok now.

description: updated
Revision history for this message
AsciiWolf (asciiwolf) wrote :

Anyway, I will rewrite it once more after the second patch (see bug #1896752) is added.

Revision history for this message
Thomas Ward (teward) wrote :

That part looks good to me. i'm not on the SRU team, but I am on the sponsors team, so now we're just going to be waiting for the rest of the patches and fixes to be in. This is still in the hands of the SRU team in the interim. :)

Thomas Ward (teward)
Changed in torbrowser-launcher (Ubuntu Focal):
assignee: nobody → Thomas Ward (teward)
Changed in torbrowser-launcher (Ubuntu Groovy):
assignee: nobody → Thomas Ward (teward)
Changed in torbrowser-launcher (Ubuntu Focal):
status: New → In Progress
Changed in torbrowser-launcher (Ubuntu Groovy):
status: New → In Progress
Thomas Ward (teward)
Changed in torbrowser-launcher (Ubuntu Groovy):
status: In Progress → Fix Released
assignee: Thomas Ward (teward) → nobody
Revision history for this message
AsciiWolf (asciiwolf) wrote :

Thomas, thanks again for working on this SRU!

As discussed on IRC, this is what should be included in the SRU:
1.

Revision history for this message
AsciiWolf (asciiwolf) wrote :

Oops, sorry for sending the incomplete comment.

Thomas, thanks again for working on this SRU!

As discussed on IRC, this is what should be included in the SRU:
1. The new Tor Browser developer key patch: https://salsa.debian.org/pkg-privacy-team/torbrowser-launcher/-/commit/72b87f502af0666954d9ae9f51b794d546e1ab6c + entry in debian/patches/series
2. The version comparison fix patch: https://salsa.debian.org/pkg-privacy-team/torbrowser-launcher/-/commit/fa3115fbf6c2d298b12c1ccee8f679c13682c92c
3. AppArmor rules patch to fix libstdc++ issue: https://salsa.debian.org/pkg-privacy-team/torbrowser-launcher/-/commit/87859bce5779f89b37c4e4be334f7e1670b0a9f3
4. Patch to use /usr/bin/gpg instead of /usr/bin/gpg2 (that is just an alias that is not preinstalled on Linux Mint and many Ubuntu flavors) + dependency on gnupg (gnupg package is also missing out-of-box in some Ubuntu flavors): https://salsa.debian.org/pkg-privacy-team/torbrowser-launcher/-/commit/f83349ae954a888a7913ac64c98dbb53a284932f and https://salsa.debian.org/pkg-privacy-team/torbrowser-launcher/-/commit/68908ebd6567fad56642c57d2fb1f75dad6efe4a

Feel free to let me know if you have any issue or question.

Revision history for this message
AsciiWolf (asciiwolf) wrote :
Thomas Ward (teward)
summary: - [SRU] Backport patch to update Tor Browser Developers public key into
- Ubuntu 20.04
+ [SRU] Multiple issues with Tor Browser
summary: - [SRU] Multiple issues with Tor Browser
+ [SRU] Multiple issues with Tor Browser Launcher
description: updated
description: updated
Revision history for this message
Thomas Ward (teward) wrote :

Build tests have been done on this here: https://launchpad.net/~teward/+archive/ubuntu/torbrowser-launcher-focal

Please test this package in the PPA before I upload it to the Repositories - this needs additional review before I can put it into the repos, but we can at least determine if this solves all the specified issues.

Revision history for this message
AsciiWolf (asciiwolf) wrote :

I have just tested your build and it seems to work fine here on my Ubuntu 20.04 based Linux Mint 20 system.

I have also checked the source file and can confirm that every patch/change mentioned in my previous comments seems to be correctly applied. :-)

Thanks!

Revision history for this message
Thomas Ward (teward) wrote :

This bug has been marked obsolete with the other 4 bugs. This one therefore is being closed.

Changed in torbrowser-launcher (Ubuntu Focal):
status: In Progress → Invalid
To post a comment you must log in.
This report contains Public information  
Everyone can see this information.

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.