Fix URLs in the downloads.json file

Following changes from #19202 (moved), the URLs in the downloads.json file (added in #16551 (moved)) are broken.

added TorBrowserTeam201608R component::applications/tor browser owner::boklm priority::medium resolution::fixed severity::normal status::closed type::defect labels

Trac:
0001-Bug-16551-fix-URLs-in-downloads.json-file.patch

I attached a patch to fix that.

Additionally, this should make updating the config.yml file for a new release a little easier, as there is no more a version to update in the download_url option.

I checked on 6.5a2 that with make update_responses-alpha the xml files generated are the same with or without the patch, and the URLs in downloads.json are fixed.

Trac:
Keywords: N/A deleted, TorBrowserTeam201608R added
Status: new to needs_review

Fixed on master, maint-6.0 and hardened-builds (858cdf3e315b068277c9e6bda7ef6108498a85b5, f9d27acb00da3a44206024a6ee3549173d61e6fa and ce5edcb55cee57b56ea3577474232e85464ff78e).

Trac:
Status: needs_review to closed
Resolution: N/A to fixed

Is this supposed to be fixed in the live files currently deployed? As far as I can tell, all of them in the alpha channel json file 404.

Eg: https://dist.torproject.org/torbrowser/update_2/alpha/downloads.json (302 redirect -> https://aus1.torproject.org/torbrowser/update_2/alpha/downloads.json)

Trac:
Status: closed to reopened
Resolution: fixed to N/A

This is fixed on the release channel. For the alpha and hardened channels, this should be fixed tomorrow when we publish the new release.

Ok. For the sake of my sanity, is the redirect situation to aus1.torproject.org going to be an ongoing thing, or is the downloads.json file going to be on dist.torproject.org?

I'd like the redirect to go away if possible, since I want to pin the entire cert chain that I use to fetch said file...

If this is getting fixed tomorrow then I'll just re-close this I guess.

Closing again, since the situation was clarifed.

Trac:
Status: reopened to closed
Resolution: N/A to fixed

Replying to yawning:

Ok. For the sake of my sanity, is the redirect situation to aus1.torproject.org going to be an ongoing thing, or is the downloads.json file going to be on dist.torproject.org?

I'd like the redirect to go away if possible, since I want to pin the entire cert chain that I use to fetch said file...

Currently, the internal updater is using http://www.torproject.org/dist/torbrowser/update_2/ URLs, which is redirected to dist.tpo for the stable and aus1.tpo for the alpha. At some point we want to change the URL to aus1.tpo directly (and have a redirect on the old URLs for the older browsers). We have #19481 (moved) for that.

Replying to boklm:

Currently, the internal updater is using http://www.torproject.org/dist/torbrowser/update_2/ URLs, which is redirected to dist.tpo for the stable and aus1.tpo for the alpha. At some point we want to change the URL to aus1.tpo directly (and have a redirect on the old URLs for the older browsers). We have #19481 (moved) for that.

Contrary to what I said before, we'll be moving back the alpha and hardened channels to dist.tpo, until we have pinning for aus1.tpo.

Will the move back happen in the upcoming release? Or rather, assuming I am writing code now, that uses the downloads.json file and the auto-update related xml files, and that I will likely publish it after the next release happens, can I rip out the support for handling different hostnames now?

Replying to yawning:

Will the move back happen in the upcoming release? Or rather, assuming I am writing code now, that uses the downloads.json file and the auto-update related xml files, and that I will likely publish it after the next release happens, can I rip out the support for handling different hostnames now?

I opened ticket #20219 (moved) to ask sysadmins to update the redirects. I think the URL you should use is https://www.torproject.org/dist/torbrowser/update_2/alpha/downloads.json which will redirect to dist.tpo (when #20219 (moved) is done). When we have pinning for aus1.tpo we will update the redirects to point there instead of dist.tpo, so keeping support for handling different hostnames can be useful.

closed

moved to tpo/applications/tor-browser#19854 (closed)