mbox series

[bug#42380,0/9] gnu: Add torbrowser-unbundle.

Message ID 20200915142128.GA12025@andel
Headers show
Series gnu: Add torbrowser-unbundle. | expand

Message

André Batista Sept. 15, 2020, 2:21 p.m. UTC 
Hi Ludo,

qua 09 set 2020 às 09:20:08 (1599654008), ludo@gnu.org enviou:
> Hi André,
> 
> André Batista <nandre@riseup.net> skribis:
> 
> > For sure. I'll give it a few more tries and cleanup the mess
> > here before sending this patch series. If I don't succeed, I'm
> > planning on sending it anyway so at least the libs can be
> > added and maybe someone can spot what I'm missing. But maybe
> > it's wise to hold Tor Browser itself since there has been an
> > announcement of some large percentage of exit relays messing
> > with Tor traffic[7].
> 
> I don’t think Guix users will radically increase traffic over Tor, so I
> think we can keep going.  :-)

Just to be sure: it's not so much about Guix users increasing the load
on Tor Network as of Guix users not having the benefits of this
extension and being prey to sslstriping.

Since you're giving a green light and I've encountered further
deterrence down the trail, I'll be sending this patch series which
also updates Tor Browser to the latest version. I've left comments
on code where I see room for improvement, in case someones wants to
help. For now, I'm trying to solve this issue and I think I'll
start a new thread for tracking it in order to avoid clutter here
as https-everywhere requires a good many new rust libs.

> >> Regarding Tor Browser itself, can you think of ways to factorize code
> >> with IceCat?
> >
> > Other than sharing the https-everywhere definition, I was
> > thinking maybe we could take a diff of Tor Browser and Firefox
> > and avoid downloading firefox source twice when building both
> > browsers. But I need to take a more careful look. I'll give
> > this question some thought.
> 
> OK.  I was expecting at least things like some of the build phases and
> most/all of the inputs to be the same, but I haven’t checked.

Indeed they both share many inputs and phases. I've actually started
this definition from the IceCat one. I'll think on how to merge
them back. Probably some inheritance is in need.

> Thanks again for all the work!

:)

---

This patch series adds Tor Browser version 9.5.4 to Guix.
Unsurprisignly, building it with '--rounds=2' seems to imply that
it is deterministic.