Re: tor

[Denis 'GNUtoo' Carikli <GNUtoo@cyberdimension.org>]

[-- Attachment #1.1: Type: text/plain, Size: 2375 bytes --]

Hi again,

I had some data loss so I wasn't able to reply to this thread before.

I managed to make the tor-browser work in Guix proper, and I've
attached the script I used for that. It's hardcoded for i686 though so
it needs to be modified for x86_64.

Even if that works, there is a problematic issue: the tor-browser has a
potential freedom issue: on one hand it very strongly advises people
not to install any addons, on the other hand in "tools->Addons and
themes->Plugins", there is the following message:
> Get extensions and themes on addons.mozilla.org

And the issue is that that repository also contains nonfree addons.

If that address can get removed or changed, we could have something
where we could be sure that it is FSDG compliant, so we could probably
ship scripts like guix-tor-browser-installer for instance.

I've tried to find where that string is set in the binaries in the hope
of being able to make a dead simple sed script that would fix the
potential FSDG issue at least at installation time, but it didn't
find much:
> $ tar xf tor-browser-linux64-11.5.4_en-US.tar.xz
> $ grep addons.mozilla.org -r tor-browser_en-US
> tor-browser_en-US/Browser/TorBrowser/Docs/ChangeLog.txt:   * Bug
> 10464: Remove addons.mozilla.org from NoScript whitelist grep:
> tor-browser_en-US/Browser/libxul.so: binary file matches

> $ strings tor-browser_en-US/Browser/libxul.so | \
> grep addons.mozilla.org
> addons.mozilla.org
> $http://addons.mozilla.org/ca/crl.pem0
> signingca1.addons.mozilla.org1!0
> $http://addons.mozilla.org/ca/crl.pem0N

The issue is that this domain is also used for addons updates, so we
can't simply remove it blindly. We need to only remove that string in
"tools->Addons and themes->Plugins".

The advantage of patching binaries is that we don't need to rebuild it,
so we really have the tiniest amount of change possible to make it FSDG
compliant (and we can hope that it doesn't change the tor-browser
fingerprint).

As far as I understand it should also also be OK to use binaries like
that as long as we're also able to rebuild it in an FSDG distribution
somehow.

Though here the path forward is probably to dig into upstream bug
reports and see what upstream thinks about making the tor-browser FSDG
compliant and/or removing the information of where to find addons.

Denis.

[-- Attachment #1.2: tor-browser --]
[-- Type: application/octet-stream, Size: 1819 bytes --]

#!/bin/sh
# Copyright (C) 2022 Denis 'GNUtoo' Carikli <GNUtoo@cyberdimension.org>
#
# This program is free software: you can redistribute it and/or modify
# it under the terms of the GNU General Public License as published by
# the Free Software Foundation, either version 3 of the License, or
# (at your option) any later version.
#
# This program is distributed in the hope that it will be useful,
# but WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
# GNU General Public License for more details.
#
# You should have received a copy of the GNU General Public License
# along with this program.  If not, see <https://www.gnu.org/licenses/>.

set -e

cd ~/.local/share/torbrowser/tbb/i686/tor-browser_en-US/Browser/

# I have my Download folder somewhere else. Right now it's at
# /srv/data/Downloads on another partition. And I want tor-browser to
# use that folder for storing Downloads.
# For that to work we need to give the tor-browser write access to
# /srv/data/Downloads/. Other methods were tried but didn't work:
# - mounting /srv/data/Downloads/ to Downloads resulted in the
#   tor-browser failing to start.
# - Using --exporse=/srv/data/Downloads/=${HOME}/.../Browser/Downloads
#   did not work either because Download was unaccessible. Replacing
#   --expose by share in the command above didn't change anything.
# So I ended up using --share=/srv/data/Downloads/. That requires the
# user to do the symlink manually though.
guix shell \
	--share=/srv/data/Downloads/ \
	--expose=/run/user/$(id -u)/ \
	--expose=/tmp/.X11-unix \
	--expose=/tmp/.X1-lock \
	--container \
	--emulate-fhs \
	--network \
	bash coreutils dbus-glib file grep gcc:lib gtk+@3 libxt sed -- \
		bash -l -c "export DISPLAY=${DISPLAY}; ./start-tor-browser"

[-- Attachment #2: OpenPGP digital signature --]
[-- Type: application/pgp-signature, Size: 833 bytes --]