[tor-talk] Interested in a Tor Browser update script for Debian, Ubuntu and derivatives?

[Abel Luck]

adrelanos:
> Downloading and gpg verifying Tor Browser each time there is an update
> gets really tiresome and I think many people either never gpg verified
> or don't do it sometimes.
> 
> What if we had a Debian package which contains a Tor Browser updater?
> 
> I could eventually provide something like this:
> 
> sudo apt-get install torbrowser-updater
> torbrowser -update
> 
> No manual download and verification would be required.
> 
> I wrote a script to do it. 

Link to the script?

It can do everything automatically. It
> renames the old TB folder (after success), downloads, fetches the gpg
> keys from the keyservers, gpg verifies and extracts it. Start menu
> entries and icons are ready. Also an update checker is basically done.
> 
> Anyone interested?
> 
> Just details have to be sorted out. And a Debian package has to be
> created. Anyone willing to help?
> 
> Open questions:
> 
> Do we download the Tor Browser archive in the clear or through Tor  have
> an option for that?
> 
> Download the Tor Browser signing keys dynamically from the keyservers
> (more prone to errors when keyserver is down) or ship the public keys?
> If the signing keys change the package needs to be updated so or so,
> because there is no package with the signing keys. [3]
> 
> Alternatives [1] [2].... None?
> 
> [1] Debian package with Tor Browser
> 
> Tickets #5236 "Make a deb of the Torbrowser and add to repository" [1[
> and #3994 "Get TorBrowser in Debian" would only solve the Linux issue
> and are totally unrealistic. [2]
> 
> Disto policy is a blocker. Tor Browser is too much of a hack. Too much
> writing into the home (profile) folder. Distro policy wants to prevent
> code duplication and does forbid to write (the profile) into the home
> folder. The policy or packer advice is for such cases is "put the
> functionality upstream".
> 
> Exactly this won't work either. According to distro policy it would be
> best if the Tor Browser specific changes to Firefox could be activated
> with a command line option. Ideally it could look like this...
> 
> The iceweasel package would look like:
> - depends on iceweasel-bin
> - depends on iceweasel-starter, i.e. normal iceweasel (Firefox) starter,
> start menu entry and iceweasel icon
> 
> A Tor Browser Debian package would look like:
> - depends on iceweasel-bin
> - depends on torbrowser-starter, i.e. Tor Browser starter, start menu
> entry and Tor Browser icon
> 
> This won't happen. Mozilla is generally disinterested takes ages to
> merge patches. Getting Tor Browser into Linux distros (with Debian-like
> policy) won't work.
> 
> [2] Thandy...
> 
> In which year we will get it?
> 
> References:
> 
> [1] https://trac.torproject.org/projects/tor/ticket/5236
> [2] https://trac.torproject.org/projects/tor/ticket/3994
> [3] https://trac.torproject.org/projects/tor/ticket/5606
> _______________________________________________
> tor-talk mailing list
> tor-talk at lists.torproject.org
> https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-talk
>