Tor Browser Bundle 3.0alpha2 Released
In addition to providing important security updates to Firefox and Tor, these release binaries should now be exactly reproducible from the source code by anyone. They have been independently reproduced by at least 3 public builders using independent machines, and the Tor Package Archive contains all three builder's GPG signatures of the sha256sums.txt file in the package directory.
To build your own identical copies of these bundles from source code, check out the official repository and use git tag tbb-3.0alpha2-release (commit c0242c24bed086cc9c545c7bf2d699948792c1e3). These instructions should explain things from there. If you notice any differences from the official bundles, I would love to hear about it!
I will be writing a two part blog series explaining why this is important, and describing the technical details of how it was accomplished in the coming week or two. For now, a brief explanation can be found on the Liberation Technologies mailing list archive.
- All Platforms:
- Update Firefox to 17.0.7esr
- Update Tor to 0.2.4.14-alpha
- Include Tor's GeoIP file
- This should fix custom torrc issues with country-based node restrictions
- Fix several build determinism issues
- Include ChangeLog in bundles
- Fix many crash issues by disabling Direct2D support for now.
- Bug 8987: Disable TBB's 'Saved Application State' disk records on OSX 10.7+
- Use Ubuntu's 'hardening-wrapper' to build our Linux binaries
Major Known Issues
- Windows XP users may still experience crashes due to Bug 9084.
- Transifex issues are still causing problems with missing translation text in some bundles