On Wed, 12 Feb 2020, clematis wrote:

Hello,

As people were porting tor-browser 9.0.4 to OpenBSD ports[1], there's been some concern it was built on top of a release candidate tarball (src-firefox-tor-browser-68.4.1esr-9.0-1-build1).

So two questions: 1/ How to identify a release candidate tarball? Not sure about the naming convention for the distfile.

We don't upload release candidates to dist.tpo. When we upload a build there, it means that it is very likely to be the final source tarball. Although there is still a small possibility that we find an issue at the last minute and decide to do a new build. However if the blog post announcing the release has been published, then the tarball on dist.tpo is the final one.

The naming convention is based on the git tag we are using: src-firefox-tor-browser-${firefox_version}-${torbrowser_branch}-${n}-build${m}

${n} is a number that we increase if we rebase our patches. Usually we don't rebase them on the same firefox version, so most of the time it is '1'.

${m} is a number that we increase when we added new patches. A -build2 for example indicates that we did a first build, then added new patches and did a second build (however only the last one is uploaded to dist.tpo).

For release candidates, we upload them to a different place (depending on who built it): https://people.torproject.org/~boklm/builds/ https://people.torproject.org/~sysrqb/builds/ https://people.torproject.org/~gk/builds/ https://people.torproject.org/~richard/builds/

We can also send you an email when we have a new release candidate if you want to test a build before it's released.

2/ This seems to be the only one in https://dist.torproject.org/torbrowser/9.0.4/ , so if this is a RC is that still OK? And was it expected?

There should always be only one firefox source tarball for each Tor Browser version on dist.tpo.

Thanks for working on this port!

Nicolas