BearBrowser v150.0.4 — measured hardening + real vendor honeypot

BearBrowser v150.0.4 — measured hardening + real vendor honeypot

Third release in a week. This one is the first cut after a real CI runtime
audit passed end-to-end on Linux — the hardening is not just present, it is
observed doing its job.

Verified in this build (Linux CI, 209352e)

verifying package: .../obj-x86_64-pc-linux-gnu/dist/bearbrowser
================ 14 passed, 0 failed ================
RUNTIME AUDIT PASSED: hwCon=2 wrap=partial:deviceMemory:no-getter-descriptor

That is a real Firefox instance under xvfb, reporting: hardwareConcurrency
clamped to 2 (was 8 in v150.0.1/2), BearTrap actor ran, WebRTC gone, WebGPU
closed, sendBeacon removed, GPC on. The partial:deviceMemory is a benign
observation (the getter is behind a build flag on this Firefox), not a failure.

New since v150.0.3 (all shipped, all in 209352e)

• Real vendor honeypot — not just a denylist. Pref-gated
  bearbrowser.honeypot.vendor.sink; when on, blocked-vendor channels
  (detectportal.firefox.com, aus5.mozilla.org, incoming.telemetry, etc.)
  are redirected to a loopback /vendor-sink that records the full request
  (host, path, method, headers) and returns HTTP 204. The vendor never sees
  the connection, but we see what they would have sent. AUS/AMO endpoints
  stay hard-blocked so a misrouted request cannot become RCE.
• Newtab ad/profiling modules deleted at source — AdsFeed,
  DiscoveryStreamFeed, NewTabContentPing, InferredPersonalizationFeed
  removed from the packaged addon, not just pref-disabled. Pref can be flipped;
  absent code cannot run.
• RS mirror machinery in place — scheduled workflow syncs Mozilla
  RemoteSettings + AMO update manifests to
  gs://sourceos-artifacts-socioprophet/rs-mirror/live/. Not yet serving
  — waiting on GCP workload-identity secrets to be set. Once live, we will
  repoint services.settings.server at us; that closes the last privacy-vs-
  security "trade" I flagged in v150.0.3 (CRLite revocation on our host).
• Linux runtime audit in CI — every future Linux nightly runs the
  above criteria against the real binary and fails the build if any
  regression appears. Audit report + browser log archived as CI artifacts
  (60-day retention) so we can diff for slow drift.
• Cockpit assembly wired into CI (best-effort) — installs bun + pnpm,
  runs assemble-cockpit.sh. Skips cleanly if either is missing; the
  cockpit code path is entirely gated on <GreD>/cockpit existing so a
  cockpit-less build is bit-for-bit unaffected.

Also new — how the build itself is defended

• Package verification gate on all three lanes (mac, linux, windows) —
  static assertion that the ad-blocker lists are staged, autoconfig registered,
  endpoints stripped, sidecar+GeoIP present. This gate is what caught the
  regressed ad-blocker in v150.0.3, before it shipped.
• Adversarial self-review pass (PR #137, in-flight, awaiting Copilot):
  5 issues found in my own recent code (weak SINK_UNSAFE regex,
  silent-success on upstream renames, muddied fedora path, unpinned bun,
  no honeypot integration test). Landing separately as v150.0.5 with the
  Copilot fixes folded in.

🔴 Deliberately deferred, stated not hidden

• Windows was not rebuilt for this release. Michael deprioritized it
  yesterday. Windows artifacts remain at v150.0.3 (sha256:7f21b3b2… /
  753eafaf…) — install from that release for now. Next tomorrow.
• RS mirror serving requires two secrets on the BearBrowser repo:
  GCP_WIF_PROVIDER and GCP_MIRROR_SA. Until set, the workflow syncs
  • reviews but skips the upload — safe fallback. Michael's action item.
• Unsigned. No code-signing certs yet — his explicit choice. macOS:
  right-click → Open, or xattr -dr com.apple.quarantine /Applications/BearBrowser.app (Homebrew de-quarantines automatically).

Verify it yourself

bash scripts/verify-package.sh /Applications/BearBrowser.app/Contents/Resources
# expect 14/14 passed

node scripts/audit/surface-audit-server.mjs &
open -n /Applications/BearBrowser.app --args -no-remote \
  -profile /tmp/bb-verify "http://127.0.0.1:8099/"
# runtime audit reports hardwareConcurrency=2, WebRTC gone, etc.

# then flip the vendor honeypot on:
printf '%s\n' 'user_pref("bearbrowser.honeypot.vendor.sink", true);' >> \
  /tmp/bb-verify/user.js
# re-launch and hit http://127.0.0.1:8093/honeypot to see the vendor
# requests we redirected into the sink.